Whether you are designing a Kubernetes cluster, configuring AWS VPC security groups, or troubleshooting firewalls, understanding Classless Inter-Domain Routing (CIDR) and IP Subnetting is an essential engineering superpower.
This guide demystifies CIDR math, breaks down binary subnet masks, and provides practical blueprints for designing enterprise cloud networks.
What is CIDR Notation?
An IPv4 address consists of 32 bits divided into four 8-bit octets separated by dots (e.g. 192.168.1.1). In CIDR notation, a slash followed by a number (like /24) represents the prefix length—the number of leading bits dedicated to identifying the network.
The remaining bits (32 - prefix) are allocated for individual host addresses within that subnet.
The Mathematics of Subnetting
To calculate the total IP capacity of any CIDR block:
Total IPs = 2 ^ (32 - Prefix Length)
Usable Hosts = (2 ^ (32 - Prefix Length)) - 2Why Subtract 2?
- Network Address (First IP): Identifies the network itself (e.g.,
10.0.0.0in10.0.0.0/24). Cannot be assigned to a host. - Broadcast Address (Last IP): Sends packets to every host on the subnet (e.g.,
10.0.0.255in10.0.0.0/24).
Quick CIDR Reference Cheat Sheet
| CIDR | Subnet Mask | Total IPs | Usable Hosts | Common Use |
|---|---|---|---|---|
| /32 | 255.255.255.255 | 1 | 1 | Single Host (Host Route) |
| /30 | 255.255.255.252 | 4 | 2 | Point-to-Point Links |
| /28 | 255.255.255.240 | 16 | 14 | Small Microservice Subnets |
| /24 | 255.255.255.0 | 256 | 254 | Standard VPC Subnet / Office LAN |
| /20 | 255.255.240.0 | 4,096 | 4,094 | Large Kubernetes Clusters |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Standard Cloud VPC Root Block |
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Entire Private Class A Block |
Cloud VPC Subnet Architecture (AWS, GCP, Azure)
When provisioning a cloud Virtual Private Cloud (VPC), a standard best-practice pattern is allocating a /16 block and subdividing it across multiple Availability Zones (AZs):
VPC CIDR: 10.0.0.0/16 (65,536 addresses)
├── us-east-1a
│ ├── Public Subnet: 10.0.1.0/24 (ALBs, NAT Gateways)
│ ├── Private App: 10.0.10.0/24 (ECS / EKS Nodes)
│ └── Database Subnet: 10.0.20.0/24 (RDS Aurora / PostgreSQL)
├── us-east-1b
│ ├── Public Subnet: 10.0.2.0/24
│ ├── Private App: 10.0.11.0/24
│ └── Database Subnet: 10.0.21.0/24
└── us-east-1c
├── Public Subnet: 10.0.3.0/24
├── Private App: 10.0.12.0/24
└── Database Subnet: 10.0.22.0/24AWS VPC Gotcha: AWS reserves the first four IP addresses and the last IP address in each subnet (5 addresses total) for internal routing, DNS resolver, and network reservation.
Interactive Subnet Calculation
Need to calculate masks, broadcast addresses, or wildcards for any CIDR range on the fly? Use our instant Subnet Calculator or convert between IP formats with our IP Converter.