/24IP CIDR Calculator

What the prefix length means

An IPv4 address is 32 bits. /24 means the first 24 bits are the network portion and the remaining 8 are the host portion. Eight host bits give 2^8 = 256 addresses in the range, and since the first is reserved as the network address and the last as the broadcast address, 254 remain assignable to devices.

Each increment of the prefix removes one host bit and halves the size: /25 holds 128 addresses, /26 holds 64. Going the other way, /23 doubles it to 512.

How to use it

1. Enter a CIDR block, for example 10.0.0.0/16.
2. Read off the network address, broadcast address, usable IP range, and host count.
3. Where a configuration screen wants a subnet mask, use the computed mask value.
4. To check whether a specific IP falls inside the block, compare it against the range's first and last address.

Understanding it in bits

Note that the network for 192.168.1.130/26 starts at 192.168.1.128. A /26 has boundaries every 64 addresses, so networks can only begin at .0, .64, .128, or .192 — which is why you cannot start a subnet at an arbitrary number when designing an address plan.

Address: 11000000.10101000.00000001.10000010
Mask:    11111111.11111111.11111111.11000000  (/26)
                                     ↑ network ends here

Network address:  192.168.1.128  (host bits all zero)
Broadcast:        192.168.1.191  (host bits all one)
Usable range:     192.168.1.129 – 192.168.1.190  (62 addresses)

Private address ranges

RFC 1918 defines three ranges that are never routed on the public internet. Corporate networks and cloud VPCs draw their addresses from these.

Designing VPC subnets

• Cloud providers reserve addresses in every subnet. AWS takes 5 per subnet (the first four and the last), so a /28 has only 11 usable IPs — which really bites on small subnets.
• A VPC CIDR cannot be shrunk after creation. Allocate generously, around a /16, and carve subnets out of it.
• If you may ever connect to another network, plan non-overlapping ranges. Two VPCs with overlapping CIDRs cannot be peered, and the same problem appears when linking to a corporate network over VPN. Maintain an organization-wide allocation table.
• Avoid over-used ranges like 192.168.0.0/24 and 172.17.0.0/16 — the first collides with home routers and the second with Docker's default bridge, which locks remote workers out.
• When splitting per availability zone, cutting equal-sized subnets keeps the arithmetic simple later.

Notation you'll see in firewall rules

That last entry is worth memorizing for security reasons. AWS, GCP, and Azure all serve instance metadata from that address, and it can include temporary credentials. Any feature where your server fetches a user-supplied URL must block access to it.

Frequently Asked Questions

Why can I only use 254 addresses in a /24?

The first address identifies the network itself and the last is reserved for broadcast, so neither can be assigned to a device — 256 minus 2 leaves 254. In cloud environments the provider reserves additional addresses, leaving fewer still.

Why use /31 and /32 if they have no hosts?

/32 pins one exact host, which is how you reference a single IP in firewall rules and routing tables. /31 is defined by RFC 3021 for point-to-point links: when two routers connect directly, broadcast is unnecessary, so both addresses are usable.

Are a subnet mask and a CIDR prefix the same thing?

They're the same information written differently. 255.255.255.0 in binary is 24 consecutive ones, which is exactly /24. CIDR notation is shorter and now predominant, though some network equipment UIs still ask for dotted-decimal masks.

How do I tell whether two ranges overlap?

Compute each range's first and last address and check whether the intervals intersect. A shorter prefix means a wider range, so one block can fully contain another — 10.0.0.0/8 and 10.1.0.0/16, for instance — and that also counts as overlapping. Containment like that is usually why a VPC peering request is refused.

How do IPv6 prefixes differ?

IPv6 addresses are 128 bits, so prefixes run from /0 to /128. Convention allocates a /48 to a site and carves subnets as /64. A single /64 holds vastly more addresses than the entire IPv4 space, so the address-conservation habits from IPv4 simply don't apply.

Can I split a subnet further later?

Yes, if the range isn't in use — splitting a /24 into two /25s is arithmetically fine. Splitting a subnet that already has assigned, live addresses requires renumbering, and in cloud environments you can't resize a subnet at all: you create a new one and migrate the resources.