What is a /24? CIDR notation and subnet masks, finally clear

A ticket lands asking for a /24 for the new floor, and everyone in the thread nods like that obviously means something. Here's what it means: a /24 is a block of 256 IP addresses, 254 of them usable, because the number after the slash says how many of the 32 bits name the network instead of the host. That's the whole of subnetting. One line drawn through 32 bits. The mask 255.255.255.0 is the same fact spelled another way, and every other prefix follows the identical rule, from a tiny /30 link to a roomy /16. We'll walk the mask bit by bit with diagrams, show why two addresses always vanish, then get you sizing and splitting real networks in your head, no spreadsheet required.

The 32 bits that decide everything

An IPv4 address is just a 32 bit number wearing a costume. We write 192.168.1.57 because four small decimals are friendlier than 11000000101010000000000100111001, but the router sees the bits.

The slash number draws one line through those 32 bits. Left of the line: network bits, identical for every machine on the subnet. Right of the line: host bits, the part that varies. That’s it. That line answers the two questions networking actually runs on: which network does this address belong to, and can I reach that other address directly or does it have to go through the gateway?

When your laptop at 192.168.1.57/24 wants to talk to 192.168.1.80, it masks both addresses, sees the same 192.168.1 network, and ARPs for the destination directly. Same laptop, destination 8.8.8.8: the masked comparison fails, so the packet goes to the default gateway. Every subnet design decision you’ll ever make is downstream of that one comparison.

Why 254 and not 256

Two addresses in every ordinary subnet are spoken for. The all-zeros host part (192.168.1.0 here) names the subnet itself; you’ll see it in routing tables and firewall rules, never on a network card. The all-ones host part (192.168.1.255) is the broadcast address, the megaphone that reaches every host at once. DHCP discovery still depends on it.

So usable hosts = 2^(host bits) minus 2. A /24 gives 2^8 - 2 = 254. A /26 gives 2^6 - 2 = 62. The two exceptions are deliberate: a /31 keeps both addresses for the two ends of a point-to-point link (RFC 3021 blessed this in 2000, and router vendors followed), and a /32 is a single host by definition.

One mask, four costumes

The same /24 shows up in four notations depending on which config file we’re staring at that day. Identical information, four spellings:

The wildcard trips people because it’s the bitwise inverse: 0 means “must match”, 1 means “don’t care”. Type 255.255.255.0 where an ACL wanted 0.0.0.255 and you’ve written a rule that matches almost nothing. We’ve all committed that one exactly once.

The slash notation comes from CIDR, Classless Inter-Domain Routing, defined in RFC 1519 back in 1993 when the old class A/B/C system was visibly running the internet out of addresses. Classes have been dead in routing for three decades. They survive in certification exams and in the habit of calling a /24 a “class C”, which works right up until someone hands you a /22 and the vocabulary collapses.

Sizing real networks without regret

The job is matching host bits to device counts, with growth room. A /24 fits a floor or a small office with margin. The awkward moment arrives at device 255, because resizing a live subnet means touching DHCP scopes, static assignments, firewall rules and at least one printer nobody documented. Fun weekend.

My rule after years of moves and mergers: when in doubt, take the next size up inside RFC 1918 space. Private addresses cost nothing. Renumbering costs weekends. The 10.0.0.0/8 block alone holds 65,536 separate /24s, so scarcity is never the real constraint inside.

If you’d rather have the arithmetic done for you, bit map included, our subnet calculator does exactly this and splits blocks into child subnets with a click.

Splitting a block, the part everyone fears

Subnetting a larger block is the skill interviews test and daily work trivializes. Take 10.10.0.0/22, which spans 10.10.0.0 through 10.10.3.255. Borrow two host bits and you get four /24s: 10.10.0.0/24, 10.10.1.0/24, 10.10.2.0/24, 10.10.3.0/24. Each borrowed bit doubles the subnet count and halves their size, and the children always start at clean multiples of the block size.

That’s all VLSM is. Cutting where you choose instead of where a class once told you to. Carve that /22 into a /23 for WiFi and a /24 for wired users, then two /26s for servers and management, and you’ve reproduced the address plan of half the offices on earth.

The /24 keeps its crown anyway, because it’s the largest block where the human-readable boundary and the binary boundary coincide. Third octet is the network, fourth is the host, and a tired engineer at 3 a.m. can read an address without computing anything. Never underestimate a notation optimized for tired engineers.

IPv6 changes the habits, not the logic

Everything above transfers to IPv6 with one mental adjustment: stop counting hosts. The slash notation works identically (the prefix length counts network bits, now out of 128), but the standard subnet size is a /64, which holds 18 quintillion addresses. Nobody sizes an IPv6 segment to its device count. Every LAN gets a /64 because SLAAC, the stateless autoconfiguration mechanism from RFC 4862, expects exactly 64 host bits. Subnetting happens in the layer above: your site gets a /48 or a /56, and you carve it into /64s the way you’d deal cards from a deck you can never exhaust.

A few /24-era reflexes to unlearn. There’s no broadcast address in IPv6, so the subtract-two arithmetic dies; multicast groups took over that job. Subnet conservation, the instinct that made you fight for a /26 instead of a /24, becomes actively harmful: carving smaller than /64 breaks autoconfiguration for no benefit. The network-versus-host comparison your laptop performs still runs the same way though, just on 128 bits, with the on-link determination rules of RFC 5942 layered on top.

The bit logic you built reading this is the part that survives the transition untouched. Prefixes on the left, hosts on the right. One line through the address, in both protocols. That’s subnetting.

Frequently asked questions