Subnet Mask and CIDR Notation Explained (With a Cheat Sheet)

Every IPv4 address is really two addresses packed into one: the network the device lives on, and the host number inside that network. The subnet mask (or its shorter form, CIDR notation like /24) is what tells a device where one ends and the other begins. This guide explains both from scratch, with a cheat sheet and a worked example you can check with the free subnet calculator on Show-IP.ir.

What is a subnet mask?

A subnet mask is a 32-bit number written like an IP address, for example 255.255.255.0. In binary it is a run of 1s followed by a run of 0s:

255.255.255.0  =  11111111.11111111.11111111.00000000

Every 1 marks a bit that belongs to the network part; every 0 marks a bit of the host part. To find the network a device is on, it performs a bitwise AND between its IP address and the mask. For 192.168.1.10 with mask 255.255.255.0 the result is 192.168.1.0 — the network address.

What is CIDR notation?

Writing the full mask every time is clumsy, so we count the 1s instead and write the number after a slash: 192.168.1.10/24 means "the first 24 bits are the network". CIDR (Classless Inter-Domain Routing) was introduced in 1993 to replace the old fixed Class A/B/C system (/8, /16, /24 only), which wasted huge numbers of addresses. With CIDR a network can be any size from /0 to /32.

CIDR cheat sheet

The more bits in the network part, the fewer remain for hosts. The number of addresses in a block is 2(32 − prefix); two of them (the network and broadcast addresses) are reserved, so usable hosts are two fewer.

Worked example: 192.168.10.77/26

Let's find everything about the network that contains 192.168.10.77/26.

1. Mask: /26 = 255.255.255.192.
2. Block size: in the interesting octet, 256 − 192 = 64. Subnets therefore start at 0, 64, 128 and 192.
3. Which block holds .77? The one starting at 64 (it covers 64–127).
4. Network address: 192.168.10.64.
5. Broadcast address: the last address of the block, 192.168.10.127.
6. Usable range: 192.168.10.65 to 192.168.10.126 — 62 hosts.

Type the same address and prefix into the calculator and you will get exactly these values, which is a good way to practise.

Network, broadcast and usable addresses

• The network address (all host bits 0) names the subnet itself and cannot be given to a device.
• The broadcast address (all host bits 1) reaches every host in the subnet and cannot be given to a device either.
• Everything in between is assignable. Two special cases: /31 is allowed on point-to-point links (RFC 3021) and has two usable addresses, and /32 is a single host.

Why it matters in real life

• Who can talk directly: two devices in the same subnet exchange traffic directly; anything outside the subnet goes through the default gateway (your router — see how to log in to it).
• Home networks are almost always 192.168.x.0/24, one of the private address ranges.
• Firewall and VPN rules use CIDR to allow or block whole ranges at once, e.g. "allow 10.0.0.0/8".
• Cloud networks (VPCs) require you to plan subnets up front; choosing a block that is too small is painful to fix later.
• Wildcard masks, used in some router ACLs, are just the mask inverted: /24 becomes 0.0.0.255.

Common mistakes

• A wrong mask on one device makes it think the gateway is "elsewhere", so it can reach some machines but not others.
• Overlapping subnets (for example 10.0.0.0/16 and 10.0.5.0/24 at two sites joined by VPN) cause routing that silently goes to the wrong place.
• Forgetting that two addresses are reserved when sizing a network: 30 devices need at least a /27 (30 usable), and a /27 leaves zero room to grow.

Try it yourself

Take the IP address Show-IP.ir shows for your own router or computer, pick a prefix such as /24 or /27, and run it through the subnet calculator. If you are still getting comfortable with the basics, read what an IP address is and IPv4 vs IPv6 first.

Key takeaways

• A subnet mask splits an IPv4 address into a network part (1s) and a host part (0s).
• CIDR (/24) simply counts the 1s; usable hosts = 2^{(32−prefix)} − 2.
• To find a subnet: compute the block size (256 minus the mask octet), find the block that holds the address, then the first address is the network and the last is the broadcast.
• Devices in the same subnet talk directly; everything else goes through the default gateway.