The Complete Guide to IPv4 Subnetting & CIDR: From Binary Math to Cloud VPCs
Master IPv4 subnetting from first principles: learn binary calculation, network and broadcast addresses, usable host formulas, RFC 1918 private ranges, and real-world AWS VPC partitioning.
IPv4 Subnet Calculator & CIDR Visualizer
Calculate network boundaries, wildcard masks, and usable host ranges interactively.
Introduction to IPv4 Addressing
Every device connected to an Internet Protocol (IP) network requires an IP address to communicate with other nodes. In IPv4, an address is a 32-bit binary number, commonly formatted for human readability as four decimal octets separated by dots (e.g., 192.168.1.100).
Each octet represents 8 bits, meaning its value ranges from 0 (00000000) to 255 (11111111). This creates a total theoretical address space of:
$$\text{Total IPv4 Addresses} = 2^{32} = 4,294,967,296$$
As the internet expanded exponentially, allocating whole class-based networks (Class A, B, and C) quickly caused massive address exhaustion. In 1993, the Internet Engineering Task Force (IETF) introduced CIDR (Classless Inter-Domain Routing) via RFC 1519 to allow variable-length subnet masks (VLSM).
Anatomizing CIDR Notation
CIDR notation appends a slash followed by a prefix number to the IP address (e.g., 10.0.0.0/16). The number after the slash represents the count of contiguous leading binary 1s in the subnet mask.
| CIDR Prefix | Subnet Mask | Total Addresses | Usable Hosts (Standard) | Common Deployment |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Major ISP / Carrier Core |
| /16 | 255.255.0.0 | 65,536 | 65,534 | AWS VPC Default Block |
| /24 | 255.255.255.0 | 256 | 254 | Standard Office / Home LAN |
| /27 | 255.255.255.224 | 32 | 30 | Kubernetes Pod Subnet / DMZ |
| /30 | 255.255.255.252 | 4 | 2 | Legacy Point-to-Point Links |
| /31 | 255.255.255.254 | 2 | 2 (RFC 3021) | Modern Router-to-Router Links |
| /32 | 255.255.255.255 | 1 | 1 (Host Route) | Firewall Single Host Rule |
How Subnet Masks Partition an IP Address
A subnet mask acts as a bitwise filter dividing the 32-bit IP into two logical portions: 1. Network Portion (Prefix): Identifies the subnet boundary. Routers inspect this part to forward packets across networks. 2. Host Portion: Identifies the specific interface or device within that subnet.
The Bitwise Math Behind Network & Broadcast IDs
Given an IP address 192.168.1.130 and a prefix of /26 (255.255.255.192):
1. Calculate Network Address: Perform a bitwise AND between the IP and the Subnet Mask.
- IP (binary): 11000000.10101000.00000001.10000010
- Mask (binary): 11111111.11111111.11111111.11000000
- Result (IP & Mask): 11000000.10101000.00000001.10000000 = 192.168.1.128
2. Calculate Broadcast Address: Invert the mask to find the Wildcard Mask (~Mask), then perform a bitwise OR with the Network Address.
- Wildcard: 00000000.00000000.00000000.00111111 (0.0.0.63)
- Result (Network | Wildcard): 11000000.10101000.00000001.10111111 = 192.168.1.191
3. Usable Host Range:
- First usable host = Network + 1 = 192.168.1.129
- Last usable host = Broadcast - 1 = 192.168.1.190
- Total usable hosts = 2^(32 - 26) - 2 = 2^6 - 2 = 64 - 2 = 62 hosts.
RFC 1918: Private Address Allocations
Not all IPv4 addresses are routable on the global public internet. The Internet Assigned Numbers Authority (IANA) reserved three dedicated private blocks under RFC 1918:
10.0.0.0 to 10.255.255.255 (16.7 Million IPs). Typically used in large enterprise backbones, multi-region cloud infrastructures, and telecom internal routing.172.16.0.0 to 172.31.255.255 (1.04 Million IPs, encompassing 16 contiguous /16 blocks). Widely adopted as the default bridge network by Docker and enterprise Kubernetes clusters.192.168.0.0 to 192.168.255.255 (65,536 IPs, comprising 256 contiguous /24 subnets). The ubiquitous standard for consumer home Wi-Fi routers and small branch offices.Real-World Scenario: Designing an AWS VPC Architecture
When creating a new Virtual Private Cloud (VPC) in AWS, planning your CIDR blocks carefully avoids overlapping IP headaches down the road.
Suppose your company creates an AWS VPC with the primary CIDR 10.100.0.0/16 across two Availability Zones (us-east-1a and us-east-1b):
1. Public Subnet AZ1: 10.100.1.0/24 (251 usable AWS IPs) for ALBs and NAT Gateways.
2. Public Subnet AZ2: 10.100.2.0/24 (251 usable AWS IPs) for Multi-AZ redundancy.
3. Private App Subnet AZ1: 10.100.10.0/22 (1,019 usable AWS IPs) for autoscaling microservice containers.
4. Private App Subnet AZ2: 10.100.14.0/22 (1,019 usable AWS IPs) for failover containers.
5. Database Subnet AZ1: 10.100.20.0/24 for RDS PostgreSQL Primary.
6. Database Subnet AZ2: 10.100.21.0/24 for RDS Read Replica / Multi-AZ Standby.
> Note on Cloud Provider Reservations: AWS and Azure reserve 5 IP addresses in every subnet (Network ID, VPC Router, DNS Resolver, Future Use, and Broadcast ID). In a /24 subnet, standard networking gives 254 hosts, but AWS provides exactly 251 usable addresses.
Conclusion
Understanding CIDR, bitwise masks, and address reservation is the bedrock of modern systems architecture, firewall administration, and cloud infrastructure. Instead of doing tedious binary operations by hand during tight deployment deadlines, use our free IPv4 Subnet Calculator to instantly inspect bit allocations, wildcard masks, and partition matrices.
Editorial Integrity & Peer Review
All technical guides on MicroTools are independently authored and peer-reviewed by software and infrastructure professionals. Content is updated periodically to ensure compliance with the latest IETF RFC specifications, IEEE standards, and cloud provider architectural recommendations.