You meet CIDR notation everywhere on Linux: 192.168.1.50/24 in ip addr, 10.0.0.0/8 in firewall rules, fd00::/64 in a WireGuard config. This guide explains what the slash means and how to do the arithmetic. Our subnet calculator does the maths instantly, but understanding it helps you spot mistakes.

If IP addresses themselves are new, start with our IP addresses explainer.

Addresses are 32 bits

An IPv4 address is 32 bits, written as four 8-bit numbers (octets):

192      .168      .1        .50
11000000 .10101000 .00000001 .00110010

A prefix length says how many of those bits, from the left, identify the network. The rest identify a host on that network.

/24, step by step

192.168.1.50/24:

	Bits	Value
Network part	First 24 bits	192.168.1
Host part	Last 8 bits	.50
Netmask	24 ones, 8 zeros	255.255.255.0
Network address	Host bits all 0	192.168.1.0
Broadcast address	Host bits all 1	192.168.1.255
Usable hosts	2^8 minus 2	192.168.1.1 to .254, 254 hosts

The first address names the network itself and the last is the broadcast address, so neither is assigned to a device.

Common prefix sizes

Prefix	Netmask	Addresses	Usable hosts	Typical use
/32	255.255.255.255	1	1	A single host, firewall rules
/31	255.255.255.254	2	2	Point-to-point links (RFC 3021)
/30	255.255.255.252	4	2	Old-style point-to-point links
/29	255.255.255.248	8	6	Small public IP blocks
/28	255.255.255.240	16	14	Small subnets
/27	255.255.255.224	32	30
/26	255.255.255.192	64	62
/25	255.255.255.128	128	126
/24	255.255.255.0	256	254	Home and office LANs
/22	255.255.252.0	1,024	1,022	Larger networks
/16	255.255.0.0	65,536	65,534	Large private networks
/8	255.0.0.0	16.7 million		All of 10.x.x.x

The rule: each step down in prefix doubles the size.

Prefixes that do not end on an octet

A /26 is less intuitive. It has 6 host bits, so 64 addresses per subnet, and subnets start at multiples of 64:

Subnet	Network	Usable	Broadcast
1	192.168.1.0/26	.1 to .62	.63
2	192.168.1.64/26	.65 to .126	.127
3	192.168.1.128/26	.129 to .190	.191
4	192.168.1.192/26	.193 to .254	.255

Is 192.168.1.100/26 in the same subnet as 192.168.1.60/26? No: .100 is in the second block (64 to 127), .60 in the first. Two machines configured like that cannot talk without a router, a common source of “it pings one way” confusion.

Splitting a network

To divide a network, add bits to the prefix. Splitting 10.20.0.0/16 for VLANs into /24s gives 256 subnets: 10.20.0.0/24, 10.20.1.0/24, and so on. Each subnet must start on a multiple of its size, so 10.20.0.128/25 is valid but 10.20.0.100/25 is not a network address.

The subnet calculator’s split option lists the resulting networks for you.

Private and special ranges

Range	Purpose
10.0.0.0/8	Private (RFC 1918)
172.16.0.0/12	Private: 172.16.0.0 to 172.31.255.255
192.168.0.0/16	Private, the usual home range
100.64.0.0/10	Carrier-grade NAT, also used by Tailscale
169.254.0.0/16	Link-local, self-assigned when DHCP fails
127.0.0.0/8	Loopback

If a machine shows a 169.254 address, it asked for DHCP and got no answer.

IPv6 is simpler, in a way

IPv6 addresses are 128 bits, and the conventions are different:

• Every LAN is a /64. SLAAC, where devices generate their own addresses, needs 64 host bits. Do not subnet a LAN smaller than /64
• ISPs delegate a /48 or /56 to customers: 65,536 or 256 separate /64 networks
• There is no broadcast address and no “minus 2”
• fd00::/8 is the unique local range, the IPv6 equivalent of private addresses

Our IPv6 on Linux guide covers configuration.

Linux commands

ip -brief address                         # your addresses, in CIDR form
ip route                                  # which networks are reached how
ip route get 8.8.8.8                      # which route a destination uses
sudo ip addr add 192.168.1.50/24 dev eth0 # add an address (until reboot)

To make addresses permanent, use your network configuration tool: Netplan on Ubuntu or NetworkManager elsewhere. Firewall rules use the same notation; our ufw rule builder accepts CIDR ranges directly.

Frequently Asked Questions

What does /24 mean in an IP address?

It is the prefix length: the first 24 bits of the address identify the network and the remaining 8 bits identify hosts. 192.168.1.0/24 covers 192.168.1.0 to 192.168.1.255, 256 addresses in total.

How many usable hosts are in a subnet?

For IPv4, 2 to the power of the host bits, minus 2 for the network and broadcast addresses. A /24 has 8 host bits, so 256 minus 2 is 254 usable hosts. Exceptions: a /31 has 2 usable addresses on point-to-point links, and a /32 is a single host.

What is the difference between a netmask and a prefix?

They express the same thing. A /24 prefix is the netmask 255.255.255.0; a /16 is 255.255.0.0. Modern tools use prefixes, older configuration files and some network equipment use dotted netmasks.

Which IP ranges are private?

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are private under RFC 1918. 100.64.0.0/10 is carrier-grade NAT space, also used by Tailscale. 169.254.0.0/16 is link-local and 127.0.0.0/8 is loopback.

How do I split a /24 into smaller subnets?

Increase the prefix length. Each extra bit halves the size and doubles the number of subnets: a /24 splits into two /25s of 128 addresses, four /26s of 64, or eight /27s of 32. Each new subnet starts at a multiple of its size.

Why is every IPv6 LAN a /64?

Stateless address autoconfiguration (SLAAC), which lets devices create their own addresses, requires 64 host bits. ISPs typically delegate a /48 or /56 to a customer, which gives 65,536 or 256 separate /64 subnets.