CIDR ranges:
what a /26 or /20 prefix really covers

What the number after the slash means

A CIDR range such as 192.168.1.0/26 is a starting address plus a prefix length. The prefix length says how many of the 32 bits in an IPv4 address are fixed and shared by every host in the block. The remaining bits are free to change, and they decide how many addresses the block contains.

For a /26, 26 bits are fixed and 6 are free, so the block holds 2^6 = 64 addresses. For a /20 the free part is 12 bits, giving 4,096 addresses. A bigger prefix number means a smaller block, which is the part that trips people up at first.

The same idea is written as a dotted mask. A /26 is 255.255.255.192, which is just the 26 fixed bits written as ones and the 6 free bits as zeros. Both forms describe the same range, and CIDR notation is the shorter one to type and to read in firewall rules and cloud consoles.

The slash notation replaced the older class A, B and C system, where a network was forced to be 256, 65,536 or 16,777,216 addresses. CIDR allows any power of two in between, which made it possible to hand out address space in sensible sizes.

The 2^(32 − n) rule and usable hosts

The first address in a block names the network itself and the last one is the broadcast address, so they are not handed to devices. That is why a /26 gives 62 hosts rather than 64. Two exceptions exist: a /31 is used for point-to-point links and a /32 identifies a single host or route.

Worked example for 192.168.1.0/26

The block size of 64 shows up in the last octet: blocks start at 0, 64, 128 and 192. Any address in the 192.168.1.x family belongs to whichever of those four blocks sits at or below it, which makes spot checks quick without any binary conversion.

Finding the block when the address is not on a boundary

Real addresses rarely land on the start of a block. Take 172.16.37.200/20. The prefix reaches into the third octet, so that octet is the one that changes in steps. Its step size is 256 − 240 = 16, because the third octet of a /20 mask is 240.

1. 1Find the octet where the mask is neither 255 nor 0. For /20 that is the third octet, with mask value 240.
2. 2Work out the block step: 256 − 240 = 16.
3. 3Round the address value down to a multiple of the step: 37 ÷ 16 = 2.31, so 2 × 16 = 32.
4. 4Network address is 172.16.32.0. The block runs for 16 values in that octet, so the broadcast address is 172.16.47.255.
5. 5Total addresses are 2^12 = 4,096, with 4,094 usable.

The same method works for any prefix that is not a multiple of 8. Only one octet is partly fixed, so only one subtraction and one rounding are needed.

Prefix reference from /24 to /32

Memorising the powers of two from 2 to 256 is enough. The mask value in the interesting octet is always 256 minus the block size, so 256 − 64 = 192 and 256 − 32 = 224.

Private ranges and combining blocks

Three IPv4 ranges are set aside for private networks, and almost every home, office and cloud network you meet is built from them. Knowing their prefixes tells you at once how much room you have to work with.

CIDR also lets adjacent blocks be summarised into one shorter prefix. The two /24 blocks 192.168.0.0/24 and 192.168.1.0/24 sit side by side and combine into 192.168.0.0/23, which is one entry in a routing table instead of two. The rule is that the blocks must be the same size and the combined block must start on a boundary for its new size.

Choosing a prefix for the hosts you need

Work backwards when you plan a subnet. Say a department needs 50 devices today and should have room to grow. Add 2 for the network and broadcast addresses to get 52, then find the smallest power of two that is at least 52. That is 64, which is 2^6, so six host bits and a prefix of 32 − 6 = /26.

A /27 holds only 30 hosts, which would fail on the first day. A /25 holds 126, which is generous but uses an address block twice as large as you need. Leave deliberate headroom rather than rounding up by accident, since renumbering a subnet later means touching every device and rule that mentions it.

Mistakes that cause overlaps and outages

• Treating a larger prefix number as a larger network. A /28 is much smaller than a /16.
• Forgetting to subtract the network and broadcast addresses when counting devices.
• Overlapping blocks, such as 10.0.0.0/16 and 10.0.4.0/22. The second sits inside the first, which breaks routing and VPN peering.
• Starting a subnet at an address that is not a multiple of its block size. 192.168.1.20/26 is not a valid network address; the block that contains it starts at 192.168.1.0.

A calculator is handy for checking a plan, especially for ranges like /19 or /21 where the boundary falls in the third octet. For routing tables and security groups, double-check the network address printed for each block before you save it.