CIDR Notation Explained: Prefix Lengths, Masks, and Host Counts
Published April 4, 2026
Article snapshot
Understand CIDR notation, how prefix lengths map to subnet masks, and how to estimate host capacity quickly.
- This article is structured as a practical step-by-step reference.
CIDR stands for Classless Inter-Domain Routing. In practice, it is the standard way to describe an IP network with an address and a prefix length, such as 10.0.0.0/16 or 192.168.1.0/24. The number after the slash tells you how many bits belong to the network portion of the address.
That single number replaces the older classful mindset where people relied on Class A, B, and C defaults. CIDR is more precise because it lets you define the boundary exactly where you need it. A /24 leaves 8 host bits. A /27 leaves 5 host bits. A /30 leaves only 2 host bits. The smaller the host portion, the fewer addresses each subnet contains.
CIDR prefix to subnet mask
The prefix length and subnet mask describe the same thing in two different forms. Prefix bits are binary ones in the mask. Host bits are binary zeros.
/8=255.0.0.0/16=255.255.0.0/24=255.255.255.0/25=255.255.255.128/26=255.255.255.192/27=255.255.255.224/28=255.255.255.240
If you know the prefix, you know where the network stops and the host portion begins. That boundary determines the network address, broadcast address, and usable host range.
How to estimate host counts
For standard IPv4 subnets, the total number of addresses is 2^(32 - prefix). Usable host count is usually that number minus two for the network and broadcast addresses.
Examples:
/24has2^8 = 256total addresses, usually254usable hosts/26has2^6 = 64total addresses, usually62usable hosts/30has2^2 = 4total addresses, usually2usable hosts
Two special cases matter:
/31is commonly used for point-to-point links and gives 2 usable addresses under RFC 3021/32represents a single host route
Why CIDR matters operationally
CIDR is not just exam notation. It is the language routing tables, ACLs, cloud VPCs, VPN definitions, and firewall policies all use. When you see 172.16.0.0/12, you should immediately read that as a large private block. When you see 192.168.50.64/27, you should know it is one small slice inside a larger /24.
The practical value is speed and consistency. Once you can map a prefix to a mask and host count, you can validate subnet plans, check ACL matches, and spot addressing mistakes quickly.