What CIDR notation means
An IPv4 address is 32 bits, conventionally written as four decimal octets. CIDR notation appends a prefix length — 192.168.1.0/24 means the first 24 bits identify the network and the remaining 8 identify hosts within it.
The prefix length directly determines the size of the block:
total addresses = 2(32 − prefix)
A /24 gives 2⁸ = 256 addresses, of which 254 are usable. A /16 gives 65,536. A /8 gives over 16 million.
Why two addresses are unusable
In every ordinary subnet, two addresses are reserved.
The network address — all host bits zero — identifies the subnet itself and appears in routing tables. The broadcast address — all host bits one — addresses every host on the segment simultaneously.
So a /24 with 256 total addresses provides 254 usable ones. This matters when sizing: a team of 254 devices fits a /24 exactly, and 255 devices does not.
Two exceptions exist. A /31 has no network or broadcast address by convention, giving 2 usable addresses — designed specifically for point-to-point links. A /32 is a single host address, commonly used for loopbacks and specific firewall rules.
The subnet mask and how it works
The mask is the prefix expressed as a dotted-decimal number: /24 is 255.255.255.0, which in binary is 24 ones followed by 8 zeros.
A router determines whether two addresses are on the same subnet by performing a bitwise AND of each address with the mask. If the results match, they are local and communicate directly; if not, traffic goes to the gateway.
The wildcard mask is the bitwise inverse — 0.0.0.255 for a /24 — and appears in access control lists on Cisco equipment and in some firewall syntaxes.
Private address ranges
RFC 1918 reserves three ranges that are not routable on the public internet:
- 10.0.0.0/8 — 16,777,216 addresses. Common in large enterprises and cloud VPCs.
- 172.16.0.0/12 — 1,048,576 addresses, spanning 172.16 to 172.31.
- 192.168.0.0/16 — 65,536 addresses. The default for home routers.
Also worth recognising: 127.0.0.0/8 is loopback, 169.254.0.0/16 is link-local (the address a device self-assigns when DHCP fails), and 100.64.0.0/10 is carrier-grade NAT space used by some ISPs.
Practical subnetting advice
Leave room to grow. Resizing a subnet in production usually means renumbering devices, which is disruptive. Sizing generously costs nothing in private address space.
Avoid the most common defaults for anything that might connect over VPN. If your office uses 192.168.1.0/24 and a remote worker's home router uses the same range, the VPN cannot route between them. Choosing something unusual within 10.0.0.0/8 avoids this entirely.
Plan for summarisation. Allocating contiguous blocks lets routers advertise a single summary route instead of many specific ones, which keeps routing tables small.
Segment by function. Separate subnets for servers, workstations, guest wireless, and management traffic make firewall rules far simpler to write and audit than a single flat network.
Frequently asked questions
Why does a /24 have 254 usable addresses instead of 256?
Two are reserved: the network address with all host bits zero, and the broadcast address with all host bits one. That leaves 254 for hosts.
What is the difference between /24 and 255.255.255.0?
They are the same thing written differently. /24 is CIDR notation for a 24-bit network prefix; 255.255.255.0 is that prefix expressed as a dotted-decimal mask.
Which IP ranges are private?
10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, defined by RFC 1918. These are not routable on the public internet and are used for internal networks.
Why should I avoid 192.168.1.0/24 for an office network?
Because it is the most common home router default. If a remote worker's home network uses the same range, VPN traffic cannot route between the two.