CIDR notation explained: what /24 actually means
August 9, 2026 · 9 min read
An IPv4 address is 32 bits, and CIDR notation - 192.168.1.0/24 - splits those 32 bits into a fixed "network" portion and a variable "host" portion. The number after the slash is how many bits, counted from the left, belong to the network - everything remaining is available for individual host addresses within that block.
What the /24 actually counts
A /24 means the first 24 bits (the first three octets, since each octet is 8 bits) are fixed as the network identifier, leaving the last 8 bits free - exactly 256 possible values (0-255) for the last octet. A smaller number after the slash means a bigger block: /16 fixes only the first 16 bits, leaving 16 bits (65,536 addresses) free instead of 8.
From prefix length to subnet mask
The prefix length is a more compact way of writing the same thing a subnet mask says with four full octets. A /24 is the mask 255.255.255.0 - 24 one-bits followed by 8 zero-bits. A /28 (a much smaller block, common for point-to-point links or small device groups) is 255.255.255.240 - only the last 4 bits are free, giving 16 total addresses.
/24 → 255.255.255.0 → 256 addresses
/28 → 255.255.255.240 → 16 addresses
/30 → 255.255.255.252 → 4 addressesNetwork and broadcast addresses
Within any block, the very first address (all host bits zero) is reserved as the network address - it identifies the subnet itself and isn't assignable to a device. The very last address (all host bits one) is the broadcast address, used to reach every host on that subnet at once. That leaves total addresses minus 2 as actually usable for hosts in the general case - a /24 has 256 total addresses but only 254 usable ones, which is the number that trips people up when they expect a clean 256.
Common block sizes at a glance
/32 is a single host (no room for network vs. host split at all - used for individual routes). /30 gives exactly 2 usable addresses, the smallest block that still has room for a network and broadcast address, historically common for router-to-router links. /29 through /27 are typical small office or device-group sizes (6 to 30 usable hosts). /24 is the classic "Class C"-sized LAN. Anything larger than /24 (like /16 or /8) is usually an entire organization's allocation, not a single local subnet.
Where this shows up in practice
Cloud VPC and subnet configuration, firewall rules scoped to a range instead of one IP, and Docker/Kubernetes network policies all use CIDR blocks directly - getting the prefix length wrong by even one bit either wastes a huge chunk of address space or, worse, doesn't actually cover all the hosts you meant to include in a rule.
FAQ
- Why does a /24 only have 254 usable addresses instead of 256?
- The first address in the block is reserved as the network address and the last as the broadcast address - neither can be assigned to a host, leaving 254 of the 256 total addresses usable.
- Does a smaller number after the slash mean a bigger or smaller network?
- Bigger. The number is how many bits are fixed for the network portion, so fewer fixed bits leaves more bits free for hosts - a /16 is much larger than a /24.
- Does CIDR notation work the same way for IPv6?
- IPv6 also uses a prefix-length notation, but with 128-bit addresses and very different subnetting conventions in practice - it deserves its own calculation, not the same rules of thumb as IPv4.