Reading CIDR Notation: Prefixes, Hosts, and Range Checks

An IPv4 address is 32 bits. In 192.168.1.0/24 the /24 says the first 24 bits identify the network and the remaining 8 are free for hosts. A larger prefix number means a smaller network, which is the part that reads backwards at first: a /30 is tiny and a /8 is enormous. The address block size is 2 raised to the number of free bits, so a /24 spans 256 addresses, a /25 spans 128, and each additional bit halves the range.

The lowest address in a range identifies the network itself and the highest is the broadcast address, so neither can be assigned to a host. Usable hosts are therefore 2^(32−prefix) − 2. A /24 holds 256 addresses but only 254 hosts; a /30 holds 4 and only 2 are usable, which is exactly why /30 is the traditional choice for a point-to-point link between two routers. Capacity planning that forgets the minus two comes up short by one address at each end.

The minus-two rule breaks at the small end. A /32 is a single address and is how you express one specific host in a firewall rule or a route. A /31 has two addresses and no room for a network and broadcast pair, so RFC 3021 redefines it for point-to-point links where both addresses are usable. Modern router configurations often prefer /31 over /30 for exactly that reason: it halves the address consumption on links that only ever need two endpoints.

A subnet mask like 255.255.255.0 is the prefix written as a dotted quad: 24 one-bits followed by 8 zero-bits. The values that appear in a mask octet are limited, because the ones must be contiguous — 128, 192, 224, 240, 248, 252, 254, 255. Seeing 255.255.255.192 tells you 26 bits are fixed, so it is a /26 with 62 usable hosts. A mask octet that is not one of those values, such as 255.255.255.100, is malformed.

Apply the mask to both the address in question and the network address, and compare the results. If the masked values match, the address is inside. This is why the network address of a range always has zeros in the host bits: 192.168.1.0/24 is a valid network but 192.168.1.5/24 describes a host inside it, and tools that expect a clean network prefix will either normalise or reject the second form. When ranges appear to overlap, comparing the masked values is the quickest way to tell.

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use. The 172.16 range is the one most often misremembered — it covers 172.16.0.0 through 172.31.255.255, not 172.16 through 172.16 alone. Two more are worth knowing: 100.64.0.0/10 is carrier-grade NAT space that shows up on mobile networks and can be mistaken for a private range, and 169.254.0.0/16 is link-local, which usually means DHCP failed rather than that anything was configured.

Before applying a new prefix, write down the network address, the broadcast address, the first usable host, the last usable host, and the host count. Then pick one address from each edge and one from the middle and confirm the mask test includes them. If the change is a renumber, keep the old range reachable until every host and firewall rule has been moved, because overlapping temporary ranges are a common source of silent routing loops.