CIDR notation explained — what /24 actually means

The number after the slash counts network bits, and everything else about a subnet follows from it. How to read a prefix, count usable hosts, and dodge the off-by-one traps.

Published 2026-01-21

The one-sentence version

In 192.168.1.0/24 the /24 says the first 24 bits of the address identify the network and the remaining 8 identify a host inside it. That single number fixes the mask, the size of the block, the first and last address, and the broadcast address — nothing else is negotiable.

Why a mask is always a run of ones

The prefix length is the number of leading 1 bits in the netmask, and they are always contiguous. A /26 is 26 ones followed by 6 zeros, which is 11111111.11111111.11111111.11000000 — written in decimal, 255.255.255.192. That is the whole trick: converting the prefix to binary and back is the only arithmetic involved.

If seeing it in bits helps, run a mask through the Binary ↔ Text tool or the Base Converter — a prefix that does not translate to an unbroken run of ones is not a valid mask.

Counting the addresses

A prefix of /n leaves 32 − n host bits, so the block holds 2^(32−n) total addresses. Two of them are normally spoken for: the all-zeros host is the network address and the all-ones host is the broadcast address, leaving 2^(32−n) − 2 usable.

• /24 — 256 addresses, 254 usable
• /25 — 128 addresses, 126 usable
• /26 — 64 addresses, 62 usable
• /28 — 16 addresses, 14 usable
• /30 — 4 addresses, 2 usable — the classic point-to-point link

The two exceptions to “minus two”

A /31 has only two addresses and no room to give one up, so RFC 3021 allows both to be used as hosts on a point-to-point link. A /32 is a single address — one host, no network or broadcast to reserve. Subnet calculators that blindly subtract two report 0 and −1 usable hosts for these, which is a good way to spot a careless one.

The IP & CIDR tool special-cases both, and shows the network, netmask, wildcard, broadcast, usable count and total for any prefix from /0 to /32.

The trap: the address you typed is usually not the network

Feed 192.168.1.130/26 to a subnet calculator and the network comes back as 192.168.1.128/26, not .130. Host bits set in the address you wrote are simply masked off. This matters because 192.168.1.130/26 and 192.168.1.190/26 describe the same subnet — while 192.168.1.200/26 is a different one, since /26 blocks start at .0, .64, .128 and .192.

The related habit worth breaking is assuming subnets land on dotted-quad boundaries. Only /8, /16 and /24 do. Anything else splits an octet, which is exactly where hand arithmetic goes wrong.

The private ranges worth memorising

• 10.0.0.0/8 — one very large private block, 16.7 million addresses
• 172.16.0.0/12 — the one people misremember as 172.16.0.0/16; it spans 172.16 through 172.31
• 192.168.0.0/16 — home and small-office networks, usually carved into /24s
• 100.64.0.0/10 — carrier-grade NAT, which is why a router can report a “public” address that is not really yours
• 169.254.0.0/16 — link-local; seeing one means DHCP failed

Reading a prefix in your head

For anything longer than /24, subtract from 256: a /26 has 256 − 192 = 64 addresses, so the blocks begin at .0, .64, .128 and .192. Find the largest block start at or below your address and that is the network. It is the same calculation the tool does, and worth being able to sanity-check.

192.168.1.130/26

Network        192.168.1.128/26
Netmask        255.255.255.192
Wildcard       0.0.0.63
Broadcast      192.168.1.191
Usable hosts   62   (192.168.1.129 – 192.168.1.190)
Total          64

Tools used in this guide