When you first see a network written as 192.168.1.0/24, that little /24 at the end can feel arbitrary — until you realise it’s doing an enormous amount of work in three characters. CIDR notation is the modern way networks are described, and once you can read it fluently, subnet masks, host counts, wildcard masks and route summaries all fall out of it naturally.
This article covers what CIDR is, how to convert between CIDR and a subnet mask, and how to read any prefix at a glance. If you just need to do the conversion now, the CIDR Calculator & Subnet Mask Converter does it in one keystroke — but understanding the logic underneath makes you dangerous with subnets, not just fast.
What is CIDR?
CIDR stands for Classless Inter-Domain Routing. It replaced the old classful system (Class A, B, C) in the 1990s because classful addressing wasted enormous chunks of the IPv4 address space. A company that needed 500 addresses had to be given a full Class B (65,536 addresses), because the only smaller option was a Class C (254 addresses).
CIDR fixed this by letting the network/host boundary sit anywhere in the 32-bit address, not just at byte boundaries. The /N at the end of a CIDR string is called the prefix length, and it tells you how many of the leftmost bits are network bits — everything to the right is a host bit.
Anatomy of 192.168.1.0/24
Let’s decode this example piece by piece.
192.168.1.0is an IPv4 address — four bytes, 32 bits total./24says: the first 24 bits identify the network, the remaining 8 bits identify hosts inside that network.
In binary that IPv4 address is:
11000000.10101000.00000001. 00000000 └─────── network (24 bits) ──────┘└─ hosts (8 bits) ─┘
Because 8 bits are available for hosts, there are 2⁸ = 256 total addresses in this network, of which 254 are usable (the first is the network address and the last is the broadcast address — neither can be assigned to a device).
Converting CIDR to a subnet mask
A subnet mask is just the same idea written the old-fashioned way: a 32-bit value where the network bits are 1s and the host bits are 0s. To convert:
- Write out N ones followed by (32−N) zeros.
- Split into four groups of eight bits.
- Convert each group to decimal.
For /24:
11111111 11111111 11111111 00000000 255 255 255 0
So /26 = 255.255.255.192. That last byte, 192, is where CIDR earns its keep — the network/host split lives in the middle of a byte, which classful addressing simply couldn’t do.
How many hosts fit?
The general formula is:
Usable hosts = 2^(32 − N) − 2
You subtract 2 because the first address in every subnet is the network address and the last is the broadcast address. So:
/24= 2⁸ − 2 = 254 usable hosts/25= 2⁷ − 2 = 126 usable hosts/26= 2⁶ − 2 = 62 usable hosts/27= 2⁵ − 2 = 30 usable hosts/28= 2⁴ − 2 = 14 usable hosts/29= 2³ − 2 = 6 usable hosts/30= 2² − 2 = 2 usable hosts
Notice the pattern: each time N increases by 1, the number of hosts is roughly halved. Every extra bit given to the network is a bit taken from the hosts.
Practical examples
A small office LAN typically uses /24 (254 hosts). It’s a comfortable size — plenty of room for laptops, printers, phones and IoT devices without wasting large blocks of address space.
A department VLAN might use /26 (62 hosts) if the team is small and you want strict broadcast domain sizing.
A point-to-point WAN link between two routers uses /30. That gives you exactly 2 usable hosts — one per side — which is all a point-to-point needs. In modern networks, /31 (RFC 3021) is often used instead to save one address per link.
A single-host route — for example, a /32 in a routing table — represents exactly one address. This is common for loopback interfaces, service VIPs, and firewall rules where you want to match one host precisely.
A cloud VPC often uses /16 at the top level (65,534 hosts) and carves subnets out of it with /24 or /28 — a /28 gives you 14 hosts, which is a natural fit for AWS, Azure and GCP subnets that reserve their own addresses at the top and bottom of the range.
Wildcard masks — the inverse
Cisco ACLs and OSPF often use a wildcard mask, which is the bitwise inverse of a subnet mask. Where the subnet mask uses 1s for network bits, the wildcard mask uses 0s. Where the subnet mask uses 0s for host bits, the wildcard mask uses 1s.
- Subnet mask
255.255.255.0(/24) → wildcard0.0.0.255 - Subnet mask
255.255.255.192(/26) → wildcard0.0.0.63
The wildcard mask essentially says “match these bits exactly (the 0s), ignore these bits (the 1s)”. It’s a different way of expressing the same network/host split.
Special cases: /31 and /32
Two prefixes deserve a note because they break the normal “subtract 2 for network and broadcast” rule.
/32 represents a single host. It’s not really a subnet — it’s a host route. You’ll see these all the time in loopback addresses (Loopback0: 10.0.0.1/32), floating VIPs, and specific firewall rules.
/31 is unusual. Under the original rules, a /31 would give you zero usable hosts (2 total minus network and broadcast = 0). RFC 3021 fixed this specifically for point-to-point links: on a /31, there is no network or broadcast address — both of the two addresses are usable hosts. This is now the standard for router-to-router links because it saves half the address space compared to /30.
Reading a CIDR in your head
With practice, you’ll be able to look at 192.168.100.0/22 and know:
/22= 32 − 22 = 10 host bits = 2¹⁰ = 1,024 total addresses = 1,022 usable- Subnet mask =
255.255.252.0(because /22 flips the third byte to11111100= 252) - Address range =
192.168.100.0to192.168.103.255(four/24s worth)
That’s enough to size a network, spot a routing mistake, or write a firewall rule without pulling out a calculator. And when you do need one — the CIDR Calculator is one keystroke away, with a full CIDR-to-subnet-mask reference table below it.
In one sentence
CIDR notation is the number of leading 1-bits in the subnet mask — everything else, from host count to broadcast address to wildcard mask, falls out of that one number.!