CIDR & Subnetting for DevOps
A practical way to reason about prefixes, subnet masks, address ranges and subnet sizing without memorizing a networking textbook.
CIDR in one sentence
CIDR notation combines an IP address with a prefix length, such as 10.20.30.0/24. The prefix tells you how many leading bits identify the network; the remaining bits are available for addresses inside that network.
Why DevOps engineers care
CIDR appears everywhere: VPCs and subnets, Kubernetes pod/service networks, firewall rules, load balancers, VPNs, routing tables and allowlists. Misreading a prefix can expose a much larger range than intended or create overlapping networks that are painful to untangle later.
Useful prefixes to recognize
| Prefix | Addresses | Traditional usable hosts | Mask |
|---|---|---|---|
| /32 | 1 | 1 host route | 255.255.255.255 |
| /31 | 2 | 2 on point-to-point links | 255.255.255.254 |
| /30 | 4 | 2 | 255.255.255.252 |
| /28 | 16 | 14 | 255.255.255.240 |
| /24 | 256 | 254 | 255.255.255.0 |
| /20 | 4,096 | 4,094 | 255.255.240.0 |
| /16 | 65,536 | 65,534 | 255.255.0.0 |
Example: 192.168.1.42/24
A /24 leaves 8 host bits. That gives 2^8 = 256 addresses. The network is 192.168.1.0, the broadcast address is 192.168.1.255, and the traditional usable range is 192.168.1.1–192.168.1.254.
Subnet sizing
For conventional IPv4 subnets, choose enough host bits for the required address count, then derive the prefix as 32 - host bits. For example, 50 hosts need at least 6 host bits because 2^6 = 64; a /26 therefore provides 64 total addresses and traditionally 62 usable hosts.
/31 and /32 are special
A /32 represents one IPv4 address and is commonly used for host routes or single-address rules. A /31 is commonly usable on point-to-point links under RFC 3021, where the two addresses can represent the two endpoints. Treating every subnet as “total minus two” would therefore give misleading results for these cases.
Private IPv4 ranges
10.0.0.0/8172.16.0.0/12192.168.0.0/16
These RFC 1918 ranges are commonly used inside private networks. They are not globally routed on the public Internet.
A practical cloud warning
The mathematical address count is not always the same as the number of addresses a cloud platform makes available to workloads. Providers can reserve addresses within a subnet. When capacity planning, use the platform’s current subnet-reservation rules in addition to the raw CIDR calculation.
Check a subnet
Use the Runbookery IPv4 CIDR Calculator to verify network address, broadcast address, mask, wildcard and host range before applying a network rule or subnet plan.