How CIDR Notation Works
CIDR (Classless Inter-Domain Routing) describes a block of IP addresses as a base address plus a prefix length: 10.42.8.0/22. The prefix length says how many of the 32 bits in an IPv4 address belong to the network. The visualization above colors those network bits; everything after them is host space you can assign to devices.
Change any octet or drag the prefix slider and the block updates live — the base IP snaps to the true network boundary, and the count, broadcast, and usable range recalculate.
Formula
The size of a CIDR block depends only on the prefix length p:
- Total addresses = 2(32 − p)
- Usable hosts = 2(32 − p) − 2 (for /30 and larger blocks; /31 has 2 usable per RFC 3021, /32 is a single host)
- Base IP = address AND netmask (host bits zeroed)
- Broadcast IP = base IP OR wildcard mask (host bits set to 1)
Worked example — 10.42.8.0/22: 32 − 22 = 10 host bits, so 210 = 1,024 addresses. The block runs from 10.42.8.0 (base) to 10.42.11.255 (broadcast), with 10.42.8.1 – 10.42.11.254 usable — 1,022 hosts.
CIDR Block Reference Table
| CIDR | Netmask | Addresses | Typical Use |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | Largest private range (10/8) |
| /12 | 255.240.0.0 | 1,048,576 | Private range (172.16/12) |
| /16 | 255.255.0.0 | 65,536 | Large VPC or campus network |
| /19 | 255.255.224.0 | 8,192 | Large ISP customer allocation |
| /20 | 255.255.240.0 | 4,096 | Cloud VPC subnet tier |
| /21 | 255.255.248.0 | 2,048 | Mid-size site network |
| /22 | 255.255.252.0 | 1,024 | Office or school network |
| /23 | 255.255.254.0 | 512 | Two joined /24 networks |
| /24 | 255.255.255.0 | 256 | Standard LAN subnet |
| /25 | 255.255.255.128 | 128 | Half a /24 |
| /26 | 255.255.255.192 | 64 | Small department subnet |
| /27 | 255.255.255.224 | 32 | Small office or VLAN |
| /28 | 255.255.255.240 | 16 | Server or DMZ segment |
| /29 | 255.255.255.248 | 8 | Tiny segment (6 hosts) |
| /30 | 255.255.255.252 | 4 | Traditional point-to-point link |
| /32 | 255.255.255.255 | 1 | Single host route |
Understanding the Terms
Prefix Length
The number after the slash — how many leading bits identify the network. A smaller prefix means a bigger block: each step down doubles the address count.
Netmask
The prefix expressed as dotted decimal: /20 becomes 255.255.240.0. Operating systems and routers use it to decide whether a destination is on the local subnet or must go through a gateway.
Wildcard Mask
The inverse of the netmask, used in Cisco access lists and OSPF configuration. For /20 the wildcard is 0.0.15.255.
Base IP (Network Address)
The first address of the block, host bits all zero. It identifies the network in routing tables and cannot be assigned to a device on standard subnets.
Broadcast IP
The last address of the block, host bits all one. Traffic sent here reaches every host on the subnet.
CIDR in Cloud Networking
CIDR planning is a day-one decision in every cloud deployment because VPC blocks are hard to change later:
- AWS: VPCs accept /16 to /28. The default VPC is 172.31.0.0/16 with /20 subnets per availability zone. Peered VPCs must not overlap.
- Azure: Virtual networks commonly use a /16 with /24 subnets; Azure reserves 5 addresses per subnet instead of 2, so a /24 yields 251 usable.
- Google Cloud: Subnets are regional; a /20 per region from a 10.x plan is a common pattern.
- Kubernetes: Pod and service ranges each need their own non-overlapping block — a /16 pod range supports roughly 65k pods.
Rule of thumb: allocate at least four times the addresses you think you need, and keep every environment (prod, staging, VPN, office) on non-overlapping blocks so they can be connected later.
Related Tools
- IP Subnet Calculator — full IPv4/IPv6 subnet details including IP class, wildcard mask, and an IPv6 prefix breakdown
- Hex Calculator — convert between binary, decimal, and hexadecimal, with bitwise operations