CIDR—Classless Inter-Domain Routing—is the notation used to describe an IP network and its size. When you see 192.168.1.0/24, the address identifies the block and /24 says that the first 24 bits are the network portion.
Why the slash number matters
IPv4 addresses contain 32 bits. A /24 leaves 8 bits for addresses inside the subnet, so the block contains 28 = 256 addresses. A /16 leaves 16 bits and contains 65,536 addresses. A /30 leaves only 2 host bits and contains four total addresses.
CIDR and subnet masks are two ways to write the same boundary
| CIDR | Subnet mask | Total IPv4 addresses |
|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 |
| /16 | 255.255.0.0 | 65,536 |
| /24 | 255.255.255.0 | 256 |
| /25 | 255.255.255.128 | 128 |
| /26 | 255.255.255.192 | 64 |
| /27 | 255.255.255.224 | 32 |
| /28 | 255.255.255.240 | 16 |
| /29 | 255.255.255.248 | 8 |
| /30 | 255.255.255.252 | 4 |
Network, broadcast, and host addresses
For a conventional IPv4 subnet such as 192.168.1.0/24, 192.168.1.0 identifies the network and 192.168.1.255 is the broadcast address. The addresses between them are normally usable by hosts. That is why a /24 is often described as having 254 usable host addresses rather than 256.
Private address space is larger than one /24
The private IPv4 ranges defined for internal networks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Individual home networks commonly carve a smaller subnet—often a /24—out of one of those ranges. For example, 192.168.1.0/24 is one subnet inside the broader private 192.168.0.0/16 block.
Why home users encounter CIDR
You will see it when configuring VPNs, firewall rules, VLANs, static routes, cloud networks, and DHCP scopes. It answers “which addresses belong to this network?” in a compact way.
Planning example
Suppose you want separate networks for normal devices and IoT equipment. You might use 192.168.10.0/24 for the main LAN and 192.168.20.0/24 for IoT. The different network portions make the separation clear, but routing and firewall rules still determine whether the two networks are allowed to communicate.
Use the Subnet Calculator when you want the exact network, broadcast, mask, and range for a prefix.
Subnetting without memorizing every mask
A /24 leaves 8 host bits (256 addresses), /25 leaves 7 (128), /26 leaves 6 (64), and each additional prefix bit halves the block. For practical planning, calculate the network/broadcast and then verify that DHCP/static ranges fit without overlap.
Route summarization and VLSM
CIDR also lets networks use variable prefix lengths and summarize contiguous routes. The same notation that describes a home /24 scales to provider and enterprise routing. A subnet calculator helps with arithmetic; routing design still requires topology and policy.
IPv6 note
IPv6 also uses prefix lengths, but there is no IPv4-style broadcast address and normal LANs commonly use /64. Do not transfer every IPv4 subnetting assumption directly to IPv6.
How to use this concept on a real network
Map the concept to one packet path: client → local switch/Wi-Fi → default gateway → WAN/ISP → destination. Identify which device performs each function rather than memorizing definitions in isolation. Packet captures, route tables, DHCP leases and router status pages are useful when available.
Common source of confusion
Home routers combine several roles in one box, so people use “router,” “Wi-Fi,” “DNS,” “DHCP” and “internet” interchangeably. Separating the roles makes troubleshooting faster and helps you understand what changes when another router, mesh system or VPN is added.
How to verify what you learned on a real network
Use observation before configuration. Record the active client address, prefix/subnet, gateway and DNS; identify the router/mesh/gateway that supplies those values; and compare LAN state with WAN state. This gives you a baseline without changing anything. When you do make a change, alter one logical variable and repeat the same test.
Common edge cases
Guest networks can block local management. VPNs can install routes that overlap private LAN ranges. Access-point/bridge mode can make a device receive a new management address. Double-router networks can create two different private gateways. Cellular failover can make a phone appear to work even when Wi-Fi has no internet. These are reasons to inspect the active path rather than rely on a memorized default.
Security and privacy boundary
Use administrative instructions only on systems you own or are authorized to manage. A private IP is not a secret password, but router credentials and configuration are sensitive. Keep management interfaces on trusted networks, use strong unique administrator passwords, update supported firmware and avoid exposing local admin pages directly to the internet.
Source hierarchy
For standards such as private addressing or protocol behavior, prefer the relevant standards/RFCs. For a router address, reset sequence, firmware or credential, prefer the current manufacturer/provider manual for the exact model and hardware revision. Community reports can help diagnose unusual cases but should be labeled and corroborated before becoming a factual default.
Subnet arithmetic worked example
For 192.168.10.70/26, a /26 has blocks of 64 addresses. The blocks begin at .0, .64, .128 and .192. Address .70 therefore belongs to network 192.168.10.64, with broadcast .127 and normal host range .65–.126. The calculation tells you whether two addresses are on-link and how large a DHCP/static range can be; it does not tell you which address a router administrator chose.
Route selection still matters
A host can have several routes. More-specific routes normally win over a default route, and VPN/virtual adapters can add private-network routes. Correct subnet arithmetic plus the route table explains many cases where the “right” gateway page is still unreachable.
Connect the concept to packet flow
Start with one client sending one request. The client has a link, an address and a routing table. It decides whether the destination is on-link or must go to a gateway. The local network transports the frame, the router applies routing/firewall/NAT policy as appropriate, and upstream networks carry it toward the destination. DNS can be needed before the first packet if the user supplied a hostname.
Observe instead of guessing
Useful evidence includes the client IP configuration, ARP/neighbor table, routing table, DHCP lease, DNS response, router WAN/LAN status, firewall logs and packet captures where appropriate. You rarely need every tool; choose the observation that tests the current hypothesis.
Home gateways combine roles
A single plastic box can be Ethernet switch, Wi-Fi access point, IPv4 router, IPv6 router, DHCP server, DNS forwarder, NAT device, firewall and VPN endpoint. Understanding which role is failing prevents category errors such as changing Wi-Fi channels to fix a DNS problem.
Topology changes behavior
Add a second router, mesh system, managed switch, VLAN, VPN or ISP gateway and the path changes. Double NAT, overlapping subnets and multiple DHCP servers are topology problems, not mysterious “bad internet.” Draw the path and mark which device owns each role.
Security is part of the model
Isolation and firewall rules can intentionally prevent reachability. A failed connection is not always a fault; it can be policy working correctly. Diagnose from an authorized network segment before disabling security controls.