IPv4 Subnet Masks and CIDR Prefixes Explained

An IPv4 address contains 32 bits. The address by itself does not tell a modern host where the network portion ends and the host portion begins; that boundary comes from the prefix length or an equivalent subnet mask. RFC 4632 defines CIDR notation as an IPv4 address or network followed by a slash and a decimal prefix length from 0 through 32.

A /24 prefix means the first 24 bits are the network prefix and the remaining 8 bits are available inside that address block. The equivalent dotted-decimal mask is 255.255.255.0 because those first 24 mask bits are ones and the final 8 are zeros. Microsoft documents the same bitwise relationship when explaining how Windows separates network and host portions of an IPv4 address.

A conventional IPv4 subnet mask is a contiguous run of one bits followed by zero bits. Each full 255 octet contributes eight prefix bits. Partial octets represent boundaries inside an octet: 128 is one leading one bit, 192 is two, 224 is three, 240 is four, 248 is five, 252 is six, and 254 is seven.

That is why 255.255.255.192 corresponds to /26: three complete 255 octets contribute 24 one bits and 192 contributes two more. CIDR notation is usually easier to compare because the slash value states the number of significant prefix bits directly instead of requiring the mask to be decoded octet by octet.

For an IPv4 prefix /p, the number of bits outside the prefix is 32 − p. The address block therefore contains 2^(32 − p) total addresses. RFC 4632 publishes the same progression: /24 contains 256 addresses, /25 contains 128, /30 contains four, /31 contains two, and /32 identifies one address.

This total-address count should not automatically be labeled a usable-host count. Traditional multi-access subnetting reserves special meanings for the all-zero and all-one host values, while /31 point-to-point links have explicit standards behavior that changes that familiar subtraction rule. Count the block first, then apply the rules for the actual link type.

To find the network prefix containing an address, the host applies the subnet mask to the address bits. Microsoft illustrates this with 192.168.123.132 and 255.255.255.0: retaining the bits selected by the mask yields the network address 192.168.123.0. With a different prefix length, the same IPv4 address can belong to a differently sized block.

Modern CIDR therefore does not infer a subnet boundary from historical Class A, B, or C labels. RFC 4632 explicitly requires prefix length or mask information to be carried because the old initial-bit-pattern classes no longer determine the routing prefix. Classful terminology can still appear in legacy explanations, but it should not replace the actual configured prefix.

On a conventional IPv4 subnet, the lowest address in the block is commonly described as the subnet or network address and the highest as the directed-broadcast address. That leads to the familiar rule of subtracting two addresses when estimating ordinary host addresses on prefixes such as /24 or /30.

Do not apply that rule blindly to every prefix. RFC 3021 specifically permits /31 prefixes on point-to-point links, where the two addresses are used as the endpoints and the historical all-zero/all-one host-number interpretation is adjusted for that link type. A /32 is a single-address prefix, commonly called a host route in RFC 4632, rather than a two-ended LAN subnet.

The prefix helps a host decide which IPv4 destinations are on the directly connected subnet and which require routing. Microsoft describes the subnet mask as the information TCP/IP uses to determine whether another host is local or on a remote network. The mask does not by itself provide a default gateway, DNS server, DHCP lease, Wi-Fi association, VLAN membership, firewall policy, or internet connectivity.

This distinction matters during troubleshooting. A PC can have a syntactically valid address and mask but still fail because the gateway is wrong, another device has the same address, DHCP supplied unexpected parameters, the switch or Wi-Fi path is on a different VLAN, or upstream routing is unavailable. Subnet arithmetic proves address relationships, not end-to-end connectivity.

A prefix length describes the size and boundary of an address block. It does not determine whether the addresses are private, globally routable, loopback, link-local, multicast, or another special-purpose range. For example, a /24 can be carved from private address space or from other IPv4 space; the slash notation has the same mathematical meaning in either case.

Likewise, choosing a smaller subnet does not create more public addresses, remove NAT, bypass carrier-grade NAT, or make a home internet connection faster. Those are separate addressing, routing, and service-provider questions. Use CIDR to describe the local prefix accurately, then evaluate NAT, routing, firewall, and ISP behavior independently.

First, validate the IPv4 address and prefix length. Second, translate the prefix into a mask only if a device or interface requires dotted-decimal notation. Third, calculate the block boundary and total address count from the prefix bits. Fourth, decide which addresses are assignable only after accounting for the actual link type and any platform or network policy.

That workflow avoids the two most common conceptual errors: guessing the subnet from historical address classes and assuming every block has exactly two unusable addresses. CIDR gives the bit boundary; operational rules determine how that block is used.