networking

CIDR Notation Explained: Ranges, Masks and a /8 to /32 Cheat Sheet

CIDR notation explained with worked /24, /26, /15 and IPv6 /64 examples, a /8 to /32 mask and size cheat sheet, and free calculators to check your maths.

Published 31 October 2026

CIDR Notation Explained: Ranges, Masks and a /8 to /32 Cheat Sheet

CIDR notation is the compact way to write an IP range: an address, a slash and a number, such as 192.0.2.0/24. The number after the slash is the prefix length, the count of leading bits that identify the network. The bits that remain identify addresses inside it. Once you can turn a prefix length into a range by hand, firewall rules, route tables, Azure virtual networks and SPF records stop being guesswork.

CIDR stands for Classless Inter-Domain Routing. "Classless" means the network size is not tied to the old class A, B and C boundaries. Any prefix length from /0 to /32 is allowed for IPv4, and from /0 to /128 for IPv6.

How a prefix length becomes a range

An IPv4 address has 32 bits. A /24 fixes the first 24 bits, leaving 8 bits free, so the range holds 2^8 = 256 addresses. A /26 leaves 6 free bits, so 2^6 = 64 addresses. The general rule is 2 raised to the power of (32 minus the prefix length).

The subnet mask is the same idea written as four numbers: the first prefix-length bits set to 1, the rest 0. For /24 that is 255.255.255.0. For /26 it is 255.255.255.192.

The quickest manual method works one octet at a time:

Find the octet where the prefix ends. For /26 that is the fourth octet, because 26 is between 24 and 32.
Block size = 256 minus the mask value in that octet. For /26 the mask octet is 192, so the block size is 64.
The network address is the address rounded down to a multiple of the block size.
The last address is the network address plus the block size minus 1, counted in that octet.

Worked example: /24

192.0.2.0/24 (a range reserved for documentation) holds 256 addresses, from 192.0.2.0 to 192.0.2.255. Conventionally the first is the network address and the last is the broadcast address, leaving 254 usable host addresses. The mask is 255.255.255.0.

Worked example: /26

Take 198.51.100.77/26. The block size is 64, so the multiples are 0, 64, 128 and 192. The address ends in 77, which falls in the block starting at 64. The network is 198.51.100.64/26, the range is 198.51.100.64 to 198.51.100.127, and 62 addresses are usable (.65 to .126). A /24 splits cleanly into four /26 networks, starting at .0, .64, .128 and .192.

Worked example: /15

A /15 ends in the second octet. The mask is 255.254.0.0, so the block size in that octet is 256 minus 254 = 2. Take 10.5.1.1/15. Multiples of 2 in the second octet are 0, 2, 4 and so on; 5 rounds down to 4. The network is 10.4.0.0/15, and the range runs from 10.4.0.0 to 10.5.255.255. That is 2^17 = 131,072 addresses, or two adjacent /16 networks.

Notice that 10.5.0.0/15 is not a valid network address: a /15 must start on an even second octet. Cloud portals and routers will reject or silently correct such entries, which is a common source of confusion.

IPv6: /64 and /48

IPv6 addresses have 128 bits, so the same rule applies with a larger number. A /64 leaves 64 free bits, so it holds 2^64 addresses, which is 18,446,744,073,709,551,616. For example, 2001:db8:1:2::/64 (a documentation prefix) runs from 2001:db8:1:2:: to 2001:db8:1:2:ffff:ffff:ffff:ffff. A /64 is the standard size for a single IPv6 LAN segment, and features such as stateless address autoconfiguration expect it. Do not subnet below /64 on ordinary client networks. Azure goes further and requires IPv6 subnets to be exactly /64.

A /48 is a typical site allocation. IPv6 addresses are written as eight groups of 16 bits, so a /48 fixes the first three groups and leaves the fourth group as a 16-bit subnet ID. That gives 2^16 = 65,536 separate /64 networks. 2001:db8:abcd::/48 runs from 2001:db8:abcd:: to 2001:db8:abcd:ffff:ffff:ffff:ffff:ffff, and its first /64 is 2001:db8:abcd::/64.

Because IPv6 ranges are so large, planning is about hierarchy and readable boundaries, not conserving addresses. Prefix lengths that fall on a multiple of four bits (such as /48, /52 or /56) line up with hexadecimal digits, which makes them easy to read.

/8 to /32 cheat sheet

Total addresses are 2^(32 minus prefix). For ordinary subnets, subtract two for the network and broadcast addresses to get usable hosts. /31 (RFC 3021) is meant for point-to-point links and /32 is a single host.

/8   255.0.0.0         16,777,216
/9   255.128.0.0        8,388,608
/10  255.192.0.0        4,194,304
/11  255.224.0.0        2,097,152
/12  255.240.0.0        1,048,576
/13  255.248.0.0          524,288
/14  255.252.0.0          262,144
/15  255.254.0.0          131,072
/16  255.255.0.0           65,536
/17  255.255.128.0         32,768
/18  255.255.192.0         16,384
/19  255.255.224.0          8,192
/20  255.255.240.0          4,096
/21  255.255.248.0          2,048
/22  255.255.252.0          1,024
/23  255.255.254.0            512
/24  255.255.255.0            256
/25  255.255.255.128          128
/26  255.255.255.192           64
/27  255.255.255.224           32
/28  255.255.255.240           16
/29  255.255.255.248            8
/30  255.255.255.252            4
/31  255.255.255.254            2
/32  255.255.255.255            1

Each step down in prefix length doubles the range, and each step up halves it.

Cloud networks reserve addresses too

On top of the network and broadcast addresses, cloud platforms hold some back. Azure, for example, reserves the first four addresses and the last address in every subnet, five in total, and its smallest supported IPv4 subnet is a /29. A /29 therefore gives 8 minus 5 = 3 usable addresses. Always check your provider's documentation before sizing a subnet. See Microsoft's Azure Virtual Network FAQ for the current rules.

Common mistakes

Treating the number after the slash as the number of hosts. It is the number of network bits. A larger number means a smaller range.
Writing a host address with a prefix and assuming it is the network. 10.5.1.1/15 is a valid way to describe an interface, but the network it belongs to is 10.4.0.0/15.
Overlapping ranges. Two networks that overlap cannot be peered or routed reliably. Check proposed ranges against existing ones before you create anything.
Using a range that is too big or too small in an SPF record or firewall rule. A mistyped prefix can authorise far more addresses than intended.

Tools for the arithmetic

Doing a few conversions by hand builds intuition, but use a tool to confirm the result. These run in your browser:

The CIDR to IP range calculator turns a CIDR block into its first and last address and its size.
The subnet mask and prefix length chart is a lookup table like the one above, with both directions.
The IP range to CIDR converter takes a start and end address and returns the smallest list of CIDR blocks that covers it. A range that does not sit on a power-of-two boundary needs several blocks.

For a broader walk-through of planning subnets, see the subnet guide and our post on the IPv4 subnet calculator.