Guides · Networking basics

CIDR and subnets explained: what does /24 mean?

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 4 min read

Firewall rules, cloud networks and router settings all write address ranges as something/number. Once you see what the number counts, you can read any of them, and check them, in your head.

Bits, not dots

An IPv4 address is 32 bits. The dots split it into four groups of 8 for readability, but the slash ignores them: /24 means “the first 24 bits are the network; the remaining 8 vary”. Eight free bits give 2⁸ = 256 combinations.

That's the whole idea of CIDR (Classless Inter-Domain Routing). Before it, networks came in three fixed sizes; CIDR lets a block be any power of two, so providers and companies can be given exactly what they need.

A worked example: /24, then a quarter of it

We put 192.0.2.0/24 into iplover's subnet calculator, then 192.0.2.64/26:

The binary row is the clearest picture of a prefix: ones for the fixed network bits, zeros for the free ones. /26 fixes two more bits than /24, which cuts the block into four quarters of 64: .0–.63, .64–.127, .128–.191, .192–.255. Our example is the second quarter.

The first address of a block names the network and the last is the broadcast address, so neither is given to a device; that's why 256 becomes 254 usable. Two exceptions: a /31 (two addresses) is used for point-to-point links where both are usable, and a /32 is a single address.

Work it out by hand

1. Block size = 2^{(32 − prefix)}. For /26: 2⁶ = 64.
2. Find the block an address is in: take the last group, divide by the block size, drop the remainder, multiply back. For 192.0.2.200/26: 200 ÷ 64 = 3.1 → 3 × 64 = 192. So the network is 192.0.2.192, the broadcast is 192.0.2.255, and devices use .193 to .254. (That's what the calculator gives too.)
3. Netmask: 256 minus the block size in the group where the prefix ends. 256 − 64 = 192, so 255.255.255.192.

For prefixes shorter than 24, do the same in the third group (a /22 is 4 blocks of 256 in the third group: 2¹⁰ = 1,024 addresses).

The sizes you'll meet

IPv6 uses the same idea, with bigger numbers

An IPv6 address has 128 bits. A single network segment, such as your home Wi-Fi, is almost always a /64: 64 bits for the network and 2⁶⁴ (about 18 quintillion) for devices. Providers hand customers a /56 or /48, which the router splits into /64s. The calculator shows the arithmetic: 2001:db8:1234::/48 contains 65,536 networks of /64, and 2001:db8:1234:5600::/56 contains 256. Nobody counts usable hosts in IPv6; the question is only how many /64s you have.

Pick a size

A common mistake

A rule written as 192.0.2.200/24 is legal in many tools, but it means the whole 192.0.2.0 block, not the one address. If you meant one address, write /32. Most tools quietly round the address down to the network; the calculator shows you which block you really wrote.