CIDR subnets explained: read the slash, find the range, stop guessing

10.24.8.35/27 looks like an address with some punctuation attached. It is really two facts: the address, and the number of leading bits that name its network. Once you can turn that /27 into a mask and a block size, the network address, broadcast address, and usable range stop being a calculator ritual.

Short answer: in IPv4 CIDR, /n means the first n of 32 bits are the network prefix. A subnet contains 2^(32 - n) total addresses. Find where the prefix ends, round the relevant octet down to its block boundary, and the rest of the range follows.

What the slash actually says

CIDR replaced the old idea that an address's first octet tells you whether it is a Class A, B, or C network. The prefix length is explicit instead: 172.16.0.0/16 says the first 16 bits identify the network; 192.168.99.0/24 says the first 24 do. That explicit prefix length is what lets routers aggregate routes and use longest-prefix matching. RFC 4632 remains the useful reference here, even if nobody says “classful addressing” in a new design review.

For ordinary IPv4 LAN subnets, these are the numbers worth knowing:

“Usually” matters. The first address is the network identifier and the last is the directed broadcast on a conventional broadcast subnet. A /31 is different: on a point-to-point link, its two addresses can both be endpoint addresses under RFC 3021. A /32 is one exact address, commonly used for a host route or a loopback.

The /24 means 254 hosts mnemonic is fine until it convinces you that CIDR is a host-count lookup table. It is a prefix-length system first; host capacity is the consequence.

Work one without a calculator

Take 10.24.8.35/27.

/27 means 27 network bits and 5 host bits. The final octet therefore has a mask of 224 (11100000 in binary). The block size is 256 - 224 = 32, so valid /27 blocks in that octet begin at 0, 32, 64, 96, and so on.

The only bit of arithmetic is locating 35 in a sequence of 32-wide blocks. For an unfamiliar prefix, derive the block size from the mask rather than trying to remember a larger table.

Why routing cares about CIDR

CIDR is not just how DHCP screens display a network. A router can receive both 10.24.0.0/16 and 10.24.8.32/27; for 10.24.8.35, it picks the /27 route because it is the more specific match. That lets a broad route cover most traffic while a more specific route overrides a small part of it.

It also explains aggregation. These four contiguous networks:

10.24.8.0/24
10.24.9.0/24
10.24.10.0/24
10.24.11.0/24

can be summarized as 10.24.8.0/22. The four /24 prefixes share their first 22 bits, and a /22 covers 1,024 addresses. That reduction in route entries was CIDR's original point, not a side benefit.

Mistakes that turn into production tickets

Treating the address in the input as the network address

10.24.8.35/27 is a host address inside 10.24.8.32/27; it is not the name of the subnet. This bites firewall rules and IaC validation, where an API may silently normalize it or reject it.

Borrowing a mask from the wrong octet

For prefixes /25 through /30, the interesting math is in the fourth octet. For /20, it is in the third. If the prefix does not end on an octet boundary, find prefix mod 8 before you start subtracting from 256.

Assuming every cloud subnet has the conventional usable count

Cloud platforms can reserve extra addresses in every subnet. Do your CIDR math first, then read the provider's allocation rules before promising that 251 instances will fit.

Summarizing ranges that are merely adjacent

Aggregation must be aligned. 10.24.9.0/24 and 10.24.10.0/24 are adjacent but cannot become one /23; a /23 begins on an even third-octet boundary. Summarizing them as 10.24.8.0/22 would also include 10.24.8.0/24 and 10.24.11.0/24, which is an accidental route leak waiting to happen.

Assuming private ranges can't collide

"Private range" does not mean "safe to overlap." Two 10.0.0.0/8 deployments that never expected to talk to each other still collide the moment a VPN, a VPC peering connection, or an acquisition connects them — and renumbering a live network is far more painful than planning non-overlapping blocks with growth room before the second environment shows up.

Check it, then understand it

For a real address plan, use the IPv4 subnet calculator to check network, broadcast, range, and mask. The calculator is especially useful when the prefix crosses an octet boundary; the mental method is what tells you whether the result makes sense.

CIDR gets much less mysterious once the slash stops looking like metadata. It is the boundary that decides what a route can claim, what a subnet contains, and whether a “quick” summary accidentally sends traffic somewhere else.

Cover photo by Sergei Starostin on Pexels.