Understanding CIDR and Subnet Masks: A Developer-Friendly Guide

Every developer configuring a cloud VPC, writing a firewall rule, or debugging why two containers cannot reach each other eventually runs into CIDR notation — strings like 10.0.0.0/16 or 192.168.1.0/24. These compact expressions describe blocks of IP addresses, and while they look cryptic, the idea behind them is simple binary arithmetic. This guide explains CIDR from scratch: what the slash number means, how it becomes a subnet mask, how many addresses a block contains, and how to split blocks without overlap.

You can follow along with the free CIDR & Subnet Calculator, which computes network address, broadcast, usable range and host count for any IPv4 block instantly in your browser.

IP addresses are 32-bit numbers

An IPv4 address is a 32-bit number, conventionally written as four octets in dotted decimal — 192.168.1.10. Each octet is 8 bits, so every number runs from 0 to 255. The key insight for subnetting is that an address has two logical parts: the **network** prefix (which identifies the wire or segment) and the **host** part (which identifies a device on that segment). CIDR tells us where the split is.

192.168.1.0/24 means: the first **24 bits** are the network portion, and the remaining **8 bits** are available for hosts. Fix the first 24 bits at 192.168.1 and you can vary the last 8 bits freely, giving 2⁸ = 256 addresses from 192.168.1.0 through 192.168.1.255.

From prefix length to subnet mask

A subnet mask is the same split written in dotted decimal: it has a 1 bit for every network bit and a 0 bit for every host bit. A /24 mask is 24 ones followed by 8 zeros — 11111111.11111111.11111111.00000000 — which is 255.255.255.0. Other familiar values follow the same rule: a /16 is 255.255.0.0 (65,536 addresses) and a /8 is 255.0.0.0 (about 16.7 million).

Not every network lands on octet boundaries. A /22 has 22 network bits: the third octet is 11111100, so its mask is 255.255.252.0 and the block contains 2¹⁰ = 1,024 addresses, growing in steps of 4 in the third octet (e.g. 10.0.4.0/22 covers 10.0.4.0–10.0.7.255). This is exactly the kind of boundary that is painful to work out by hand and trivial to verify with a calculator.

Network address, broadcast, and usable hosts

Within every subnet, two addresses are reserved. The **network address** has all host bits set to zero — 192.168.1.0 in a /24 — and names the segment itself in routing tables. The **broadcast address** has all host bits set to one — 192.168.1.255 — and addresses every device on the link. Neither can be assigned to a host, which is why a /24 offers 254 usable addresses (256 − 2), and the general formula is 2^(32−prefix) − 2 for prefixes below /31.

The device that forwards traffic off the segment — your default gateway — is usually assigned the first usable address (192.168.1.1), and everything else from .2 to .254 is available for hosts. Two devices can talk directly without a router only when their addresses belong to the same network after applying the mask; if a "ping works from the host but not the container" bug appears, checking whether the addresses actually fall in the same subnet is the first diagnostic step.

CIDR in the cloud and Kubernetes

Classful networking (the old Class A/B/C scheme) is gone; modern infrastructure speaks pure CIDR. When you create an AWS VPC or Azure VNet you give it a primary CIDR — commonly 10.0.0.0/16 — and then carve it into per-availability-zone subnets like 10.0.1.0/24, 10.0.2.0/24 and 10.0.3.0/24. The golden rule: subnets must never overlap, and the VPC CIDR must be large enough for everything you will later build.

Kubernetes clusters consume addresses at a surprising rate. A cluster needs one CIDR for nodes (often from the VPC), one for pods (a large range such as /16, because every node gets a /24 slice by default), and one for services (commonly a /12 from the 172.20.0.0/16 style range). Under-provision the pod CIDR and the cluster stops scheduling once nodes run out of IPs — an outage that requires re-creating the cluster to fix. Firewall rules and security groups are likewise written in CIDR: 0.0.0.0/0 means "the entire IPv4 internet", while 10.0.5.0/24 means just that internal segment.

Subnetting without tears

Splitting a block — subnetting — follows one rule: every time you move the prefix one bit longer, the block count doubles and each block halves in size. A /24 splits into two /25s (128 addresses each), four /26s (64 each), eight /27s (32 each), and so on. Start each new subnet immediately after the previous one ends to avoid gaps and overlaps, keep gateway and reserved addresses in mind when sizing, and reserve generous headroom for growth — re-addressing a live network is nobody’s idea of fun.

When in doubt, let the machine do the binary math. Type your block into the CIDR & Subnet Calculator to see the network address, first and last usable host, broadcast, subnet and wildcard masks, and host counts — then copy the result straight into your Terraform, firewall ticket or network diagram. CIDR stops being intimidating the moment you see the address space laid out in front of you.