IPv4 Subnetting: Work Out a CIDR Range

What a CIDR prefix means

An IPv4 address contains 32 bits. The CIDR number after the slash states how many leading bits belong to the network prefix. The remaining bits identify addresses within that block.

A /24 leaves eight address bits, giving 2⁸ or 256 total addresses. A /28 leaves four address bits, giving 16 total addresses.

Network, host range, and broadcast

The network address is the first address in a traditional subnet and identifies the block. The broadcast address is the last and reaches all hosts on that broadcast domain. Addresses between them form the traditional usable host range.

For 192.168.1.10/24, the network address is 192.168.1.0, the broadcast address is 192.168.1.255, and the traditional host range is 192.168.1.1 through 192.168.1.254.

How the mask finds the network

A bitwise AND operation between the IP address and subnet mask produces the network address. Combining that network with the inverted mask produces the broadcast address. A calculator performs these binary steps without hiding what each result means.

Worked example: 192.168.10.137/26

A /26 leaves 6 host bits, so the block contains 2⁶ = 64 addresses. Its mask is 255.255.255.192. In the last octet, blocks start at 0, 64, 128 and 192; 137 falls in the block starting at 128.

The next block starts at 192, so this block ends one address earlier at 191. Reserve the first and last addresses for network and broadcast, leaving 129 through 190 for traditional hosts.

• Check another IP address and CIDR prefix
• Look up other masks in the CIDR cheat sheet

What the wildcard mask means

For a contiguous subnet mask, subtract each octet from 255. The inverse of 255.255.255.192 is 0.0.0.63. In an ACL syntax that uses wildcard masks, a zero bit means match that bit and a one bit means ignore it.

The address-and-wildcard pair 192.168.10.128 with 0.0.0.63 matches this /26 block in that syntax. Do not enter the wildcard into a device’s subnet-mask field: it is a different kind of input. Some ACL systems also support non-contiguous wildcards that cannot be represented by one CIDR prefix.

Capacity includes gateways, not just client devices

A /26 provides 62 traditional usable addresses. If 60 client devices need addresses and the gateway uses another, just one remains. A printer, access point or additional reservation could exhaust that plan. A /25 provides 126 usable addresses, but the larger range still has to fit without overlapping another network.

For the worked /26, one possible gateway is 192.168.10.129, with DHCP serving .130 through .190 if no other addresses are reserved. That is 61 DHCP addresses, not 62. The first usable address is a convention for a gateway, not a protocol requirement.

Special cases: /31 and /32

A /31 contains two addresses and is commonly used on point-to-point links where traditional network and broadcast reservations are unnecessary. Both addresses can represent endpoints in that context.

A /32 identifies exactly one IPv4 address. It is commonly used as a host route or to refer to one specific endpoint.

Subnetting checks that prevent mistakes

Before applying a subnet, verify both the address count and the operational context.

• Count current and expected endpoints.
• Allow room for infrastructure addresses where required.
• Check that ranges do not overlap.
• Confirm gateway and DHCP boundaries.
• Document the CIDR prefix with every network address.