CIDR Notation and Subnetting, Explained

CIDR notation — Classless Inter-Domain Routing — writes an IP address range as a base address plus a slash and a number, like 10.0.0.0/24. That number is the prefix length: how many leading bits of the address are fixed as the network portion, with the rest available for individual hosts. It replaced the older class-based system (Class A/B/C networks) with something far more flexible, and it’s the notation you’ll see in every VPC, firewall rule, and routing table today.

Reading a CIDR block

Take 192.168.1.0/24. The /24 means the first 24 bits of the 32-bit address are the fixed network prefix, leaving 8 bits for host addresses within that network — 2^8 = 256 addresses, from 192.168.1.0 to 192.168.1.255. Two of those are reserved (the network address itself and the broadcast address), leaving 254 usable host addresses in a typical IPv4 subnet.

A smaller prefix number means a larger range, because fewer bits are fixed. /16 fixes 16 bits and leaves 16 for hosts — 65,536 addresses. /8 leaves 24 bits — over 16 million addresses. This inverse relationship trips people up at first: /24 is a smaller network than /16, not a bigger one.

Prefix length and host count

Prefix	Fixed bits	Host bits	Usable IPv4 hosts
/8	8	24	~16.7 million
/16	16	16	65,534
/24	24	8	254
/28	28	4	14
/30	30	2	2
/32	32	0	1 (single host)

Each step of one bit halves or doubles the range — going from /24 to /25 cuts the address count in half, from 256 to 128.

Subnetting: splitting a network

Subnetting means taking one CIDR block and dividing it into smaller ones by extending the prefix. A /16 block like 10.0.0.0/16 can be split into four /18 blocks, or 256 /24 blocks, or any mix, as long as the resulting ranges don’t overlap. Cloud networking makes heavy use of this: a VPC is typically allocated a /16, and individual subnets within it — one per availability zone, or one for public-facing resources versus private ones — carve out /20 or /24 chunks from that space.

The reason to subnet rather than run everything as one flat range is isolation and control: a network segmentation strategy puts different tiers of an application in different subnets so a firewall or security group can apply different rules to each — public subnets that accept inbound internet traffic, private subnets that don’t.

CIDR in the cloud: VPCs and security groups

Security group and firewall rules are almost always written as CIDR blocks: “allow inbound TCP 443 from 0.0.0.0/0” means allow from any IPv4 address (the entire address space), while “allow SSH from 10.0.5.0/24” restricts it to one specific internal subnet. Getting the prefix length wrong here is a common source of security incidents — writing /16 when you meant /24 opens up 256 times more addresses than intended. A bastion host is often the one thing allowed a broader inbound CIDR, precisely so everything else can be locked down to a narrow range.

Route tables use the same notation the other direction: the most specific matching CIDR block wins when a router decides where to send a packet, which is why a /32 route (a single host) takes priority over a /24 route covering the same address.

Private ranges (RFC 1918)

Three IPv4 ranges are reserved for private networks and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Almost every VPC, home router, and internal corporate network draws its addresses from one of these blocks, relying on a NAT gateway or similar mechanism to translate to a public address when traffic actually needs to leave. If you’re designing address ranges for a multi-cloud or hybrid network, picking non-overlapping slices of these ranges up front avoids painful renumbering later, when two networks that need to peer turn out to use the same 10.0.0.0/16 block.

The takeaway

CIDR notation compresses an IP range and its size into one string: the prefix length says how many bits are fixed, and every bit you drop doubles the range. Subnetting is just applying more prefix bits to a block you already own, carving it into smaller, independently controllable ranges — which is exactly what VPC subnets, security groups, and route tables use CIDR for. Get the prefix length right and firewall rules, routing, and address planning all follow from it.