Subnet Masks Without Tears: CIDR Notation for Humans

You open a router, cloud or VPN form, it asks for a network in CIDR form, something like 192.168.1.0/24, and the task stalls on one small slash. Guess the number and you can lock devices out, overlap two networks, or leave too little room for the next printer or guest laptop. This post gives you a plain way to read that slash, a worked example of splitting one small network, and the checks that catch common mistakes before they become outages.

The slash is a boundary, not a code

An IPv4 address has 32 bits. CIDR notation, short for Classless Inter-Domain Routing, uses the number after the slash to say how many of those bits name the network. The rest name individual devices inside it. In 192.168.1.0/24, the first 24 bits are the network part and the last 8 bits are free for hosts. Written as a dotted subnet mask, that same boundary is 255.255.255.0.

That one boundary decides four things at once: the first address in the block, the last address, how many addresses exist in total, and how many you can actually give to devices. In a normal subnet the first address names the network itself and the last is the broadcast address, the one that means every device here. Neither is given to a laptop or a server. So a /24 has 256 addresses in total, from 192.168.1.0 to 192.168.1.255, and 254 usable ones, from 192.168.1.1 to 192.168.1.254.

If you are not sure which address a website sees for your connection, that is a different question. Our What's My IP tool shows your public address. Subnets here are mostly about private ranges inside homes, offices and cloud networks, such as 192.168.x.x and 10.x.x.x, where you choose the boundary yourself.

Learn one anchor, then halve or double

You do not need to memorise a chart. Anchor on /24, with 256 total and 254 usable, because most home and small office routers start there. Each step up in the prefix halves the block. A /25 has 128 total and 126 usable. A /26 has 64 total and 62 usable. A /27 has 32 total and 30 usable. A /28 has 16 total and 14 usable. Going the other way doubles it. A /23 has 512 total and 510 usable, and a /22 has 1,024 total and 1,022 usable.

The dotted mask follows the same pattern, even if you rarely need to type it. A /24 is 255.255.255.0, a /25 is 255.255.255.128, a /26 is 255.255.255.192, and a /30, with only 2 usable addresses, is 255.255.255.252. That /30 case is why tiny blocks still matter: a link between two routers needs exactly two addresses, and wasting a whole /24 on it helps nobody.

When a form accepts either form, use the one you can read back with confidence and then verify it. Paste the address and prefix into our Subnet Calculator and check that the network, broadcast and usable range match what you intended. It is the quick way to stop an arithmetic slip reaching a live network.

A worked scenario: split one office network

Imagine a small office on 192.168.1.0/24 that has outgrown one flat network. Staff laptops and phones need about 50 addresses. A guest network needs about 30 and should stay separate. A small set of printers, cameras and shared devices needs about 15. Nothing here needs a complicated design. It needs blocks that fit, with room to grow, and that do not overlap.

Split the /24 into /26 blocks and the boundaries fall in clean places: 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26 and 192.168.1.192/26. Each /26 has 62 usable addresses. The first block, usable from 192.168.1.1 to 192.168.1.62, fits staff today and leaves headroom. The second, usable from 192.168.1.65 to 192.168.1.126, is larger than guests need right now, but guest counts spike and renumbering later is worse than spare addresses now. The third block can hold the printers and shared devices, usable from 192.168.1.129 to 192.168.1.190. The fourth block stays unassigned, which is a feature, not waste. It is your future expansion space, already aligned and already free.

Notice the decision order. Count devices honestly, including phones, printers and guests. Add headroom instead of sizing exactly to today. Pick the smallest standard block that still fits, then write down the first and last usable addresses. If a segment had needed 70 devices, a /26 would have failed, and the right answer would have been a /25 for that segment.

Three mistakes that look like other problems

The first is a misaligned start address. A block must start at a multiple of its size. For a /26, the size is 64, so valid starts in the last part of the address are 0, 64, 128 and 192. If someone writes 192.168.1.50/26 as a new network, the mask still points back to 192.168.1.0/26. The typed address was a host inside an existing block, not the start of a new one, and the two networks overlap whether the form accepted the entry or not.

The second is a mask mismatch on one device. If most devices move to a new prefix and one server keeps the old mask, that server will treat some addresses as local when they are not, or the other way around. The symptom often gets reported as slowness or random unreachability, because part of the network works and part does not. When you change a prefix, change it everywhere in the same window and then recheck a few devices from each group.

The third is handing out a reserved address. Giving a device the network address or the broadcast address for its block creates failures that vary by system, which makes them look mysterious. Keep a simple written list for each block: network address, first usable, last usable, broadcast. If an address is not between first and last usable, do not assign it.

What to do first

Start with the network you already have. Write its address and prefix down, run it through the Subnet Calculator, and note the network address, broadcast address and usable range in plain figures. Then count the devices that must fit, add headroom, and check whether your current block still works or needs splitting. Do that on paper first, verify each new block starts at a clean boundary and does not overlap the others, and only then change router, cloud or VPN settings. CIDR stops being intimidating once you treat the slash as what it is: one boundary, with a size you can halve, double and check in seconds.