CIDR and Subnetting Explained: How to Read 10.0.0.0/24 Without Guessing

Every developer eventually meets a line like allow from 10.0.0.0/24 in a firewall rule, a VPC console asking for a CIDR block, or a security group rejecting traffic from an address that “looks like it should be in range.” Subnetting is one of those topics that’s easy to memorize for a certification exam and easy to forget a month later — because most explanations start with binary arithmetic instead of the underlying idea. This guide builds that idea first: what the slash number really counts, how to reason about network sizes in your head, and how to split a network without a calculator (though a good one helps).

An IP Address Is 32 Bits, and the Slash Counts the Fixed Ones

An IPv4 address like 192.168.1.10 looks like four numbers, but it’s really one 32-bit value; each of the four octets is 8 bits, 0–255. A network is a range of addresses that share a common prefix of bits. CIDR notation — Classless Inter-Domain Routing — writes that as an address followed by /n, where n is how many bits, counting from the left, are fixed. The remaining 32 − n bits are free to vary, and they define the hosts in the network.

So 10.0.0.0/24 means: the first 24 bits — 10.0.0 — are fixed, and the last 8 bits vary. That’s 2⁸ = 256 addresses, from 10.0.0.0 to 10.0.0.255. Once you see the slash as “number of fixed bits,” everything else in subnetting is arithmetic on one number.

A few reference points worth memorizing:

/32 — one single address (a host route)
/24 — 256 addresses, the classic “C class” size
/16 — 65,536 addresses, the old “B class”
/8 — 16.7 million addresses, the old “A class”

The Subnet Mask Is the Same Number in a Different Costume

Older documentation expresses the prefix length as a subnet mask: a 32-bit value whose first n bits are 1 and the rest 0, written in the same dotted notation as an IP. A /24 has 24 one-bits, which is 255.255.255.0. A /26 is 26 one-bits: 255.255.255.192.

The mask exists for one operation: bitwise AND it with an address and you get the network address — the fixed prefix with all host bits zeroed. 192.168.1.73 AND 255.255.255.192 = 192.168.1.64, so that address lives in the 192.168.1.64/26 network. Routers do exactly this to decide whether a destination is local or needs forwarding. When a Subnet Calculator shows you the network address, broadcast address, and host range for a CIDR block, this AND operation is what’s happening underneath.

Network Address and Broadcast Address: Why You Lose Two Hosts

Within any subnet, two addresses are reserved: the network address (all host bits 0) identifies the network itself, and the broadcast address (all host bits 1) addresses every host at once. Neither can be assigned to a machine.

That’s why the usable-host formula is 2^(32−n) − 2. A /24 has 256 addresses but 254 usable hosts. A /30 — common for point-to-point links between two routers — has 4 addresses and exactly 2 usable hosts, which is precisely what a link between two endpoints needs. (Pushing this further, /31 is a special case standardized for point-to-point links where both addresses are usable, and /32 names a single host.)

Reading Any /n in Your Head

You don’t need binary long division for day-to-day work — you need one observation: only the octet where the boundary falls is interesting. For a /24, the boundary sits exactly on the third octet, so nothing interesting happens. For a /26, the boundary falls 2 bits into the fourth octet, leaving 6 host bits: 2⁶ = 64 addresses per subnet. So within 10.0.0.0/24, the /26 subnets start at .0, .64, .128, .192 — the block size repeats through the octet.

The general recipe for prefixes between /24 and /32:

Host bits = 32 − n. For /27, that’s 5.
Block size = 2^(host bits). For /27, that’s 32.
Subnets start at multiples of the block size in the last octet: .0, .32, .64, …
Usable hosts per subnet = block size − 2.

For prefixes below /24 the same logic applies to the third octet: a /20 leaves 4 host bits in the third octet, block size 16, so 10.0.0.0/20 covers 10.0.0.0 through 10.0.15.255. If you’d rather skip the mental math mid-incident, paste the CIDR into the Subnet Calculator and read off the range directly.

Splitting a Network: Worked Example

Say your cloud VPC gives you 10.0.0.0/16 and you want four equal-sized subnets — production, staging, development, shared services. Each split in half costs one bit, so four subnets need 2 extra bits: /18. The four blocks are:

10.0.0.0/18 → 10.0.0.0 – 10.0.63.255
10.0.64.0/18 → 10.0.64.0 – 10.0.127.255
10.0.128.0/18 → 10.0.128.0 – 10.0.191.255
10.0.192.0/18 → 10.0.192.0 – 10.0.255.255

Each holds 16,384 addresses. The rule that makes all subnet plans work: every subnet’s size is a power of two, and its starting address must be a multiple of its size. You can’t carve a 500-address block out of arbitrary space — you’d round up to 512 (a /23 in the third-octet sense) and align it. This is also why real allocations are wasteful on paper: plan for growth, because renumbering a network later is far more painful than reserving space now.

Private Ranges, and Why 10.0.0.0/8 Follows You Everywhere

RFC 1918 reserves three ranges that are never routed on the public internet, free for anyone to use internally:

10.0.0.0/8 — 16.7 million addresses; the favorite for cloud VPCs and large organizations
172.16.0.0/12 — about 1 million addresses (172.16.x.x through 172.31.x.x — note it’s a /12, not /16)
192.168.0.0/16 — 65,536 addresses; what your home router hands out

Because these ranges overlap across every organization in the world, two frequent production headaches follow. First, VPN and VPC peering conflicts: if your office uses 10.0.0.0/16 and the VPC you peer with also claims 10.0.0.0/16, routing becomes ambiguous and someone has to renumber or do NAT gymnastics. Second, container networks: Docker defaults to 172.17.0.0/16 and Kubernetes clusters carve their own ranges — clashes with corporate VPNs are a classic “works at home, broken at the office” cause. When connectivity mysteriously fails only for people on a certain network, check whether both sides are squatting on the same private range. The IP Lookup tool won’t resolve private ranges (they have no public owner — that’s the point), but for any public address it shows you who actually owns the block you’re dealing with.

CIDR in the Wild: Firewall Rules and ACLs

Most places you’ll actually write CIDR are allow/deny lists: security groups, nginx allow directives, Kubernetes NetworkPolicies, API gateways. Two habits prevent most mistakes:

Be as specific as the intent. 0.0.0.0/0 means “the entire internet” (zero fixed bits — everything varies) and is almost never the right answer for an allow rule. Granting an office /24 is both safer and self-documenting.
Remember a CIDR is a range, not a pattern. 192.168.1.0/24 does not mean “starts with 192.168.1” by coincidence — it means exactly the 256 addresses whose first 24 bits match. If you allow 192.168.0.0/16 thinking it’s “the 192.168 family,” you’ve correctly allowed 65,536 addresses; if you write 192.168.1.0/16, many systems will silently normalize it to 192.168.0.0/16 — or reject it — because the host bits should be zero in the network address.

When a rule isn’t matching and you can’t see why, run both the address and the CIDR through a Subnet Calculator and compare the range boundaries against your address’s bits. Nine times out of ten the address is just outside the block — or the block is one bit wider or narrower than you assumed.

Quick Reference

/n = number of fixed bits; addresses in the network = 2^(32−n), usable hosts = that minus 2.
/24 = 256 addresses, /16 = 65,536, /8 = 16.7 million. Each +1 on the prefix halves the network.
Subnet mask and CIDR are the same thing: mask 255.255.255.0 ≡ /24.
Network address AND mask gives the network; broadcast is all host bits set to 1.
Subnets must be power-of-two sized and aligned to a multiple of their size.
Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. 0.0.0.0/0 matches everything.