CIDR, IPv4 subnet and IPv6: what the mask does in binary

What the CIDR prefix means

CIDR (Classless Inter-Domain Routing) describes, with a single number after the slash, how many of the address bits belong to the network. An IPv4 address is 32 bits total. A /24 reserves the first 24 bits for the network and leaves the last 8 for hosts; a /26 reserves 26 and leaves 6. The word classless is the heart of the idea: before CIDR, network size was dictated by the first octet (Classes A, B and C); with CIDR, you pick the cut point freely, bit by bit. That is what "classless" means.

From the prefix, and from it alone, the calculator derives every field you see. Each one has a precise meaning:

Network address

The first address of the block (all host bits at 0). It identifies the subnet and is not assigned to any host.

Broadcast

The last address (all host bits at 1). It sends to every host of the subnet at once, it exists only in IPv4.

Mask

The decimal form of the prefix: n bits set to 1 followed by 32 − n bits set to 0. A /24 is 255.255.255.0.

Wildcard

The inverse of the mask (each 0 becomes 1 and vice versa). It marks the host bits, handy in ACLs and for finding the broadcast.

Host range

From the first to the last usable address, between the network and the broadcast.

The mask is a binary operation, not a table

Here is what most tutorials hide behind the memorized table. To find the network address, the device performs a logical AND, bit by bit, between the address and the mask. The AND rule is simple: the result is 1 only when both bits are 1. Where the mask has a 1 (network bits), the IP bit passes through untouched; where the mask has a 0 (host bits), the result is always 0. That is why the network address has all host bits zeroed, not by convention, but because the AND erases them. See it with 192.168.10.77/26:

  IP     192.168.10.77   11000000.10101000.00001010.01001101
AND
  máscara /26           11111111.11111111.11111111.11000000   (255.255.255.192)
  mask    /26
= ------------------------------------------------------------
  rede    192.168.10.64  11000000.10101000.00001010.01000000
  network

// Só o último octeto muda: 01001101 (77) AND 11000000 = 01000000 (64).
// Only the last octet changes: 01001101 (77) AND 11000000 = 01000000 (64).

The broadcast follows the same reasoning, inverted: take the logical OR between the network and the wildcard (the inverted mask). Where the wildcard has a 1, the bit becomes 1; the result fills every host bit with 1. For our example, 192.168.10.64 OR 0.0.0.63 gives 192.168.10.127. Everything else, first host, last host, count, is just walking between those two boundaries. A mask never mixes 1s and 0s out of order: it is always a run of 1s followed by a run of 0s. That is what makes the prefix (the count of 1s) enough to describe it.

How many addresses each prefix holds

The total number of addresses in an IPv4 prefix is 2 raised to the number of host bits. Since two of those addresses cannot be handed to a host (the first is the network, the last is the broadcast), usable hosts equal the total minus 2. This is the formula the calculator applies to every row:

Notice the pattern: each bit added to the prefix halves the block, 256, 128, 64, 32…, because it steals a bit from the host. It is an exponential decay, not linear. A /30, with just 2 hosts, is the smallest block that still honors the minus-two rule; it is the classic choice for point-to-point links before /31 caught on.

Why CIDR existed: the end of classes

The original IPv4 (RFC 791, from 1981) split the space into fixed classes by the value of the first octet: Class A (1–126) reserved 8 network bits and gave 16 million hosts; Class B (128–191), 16 bits and 65 thousand hosts; Class C (192–223), 24 bits and only 254 hosts. The problem was grotesque. A company with 300 machines did not fit in a /24 (Class C, 254 hosts) and got a /16 (Class B), wasting over 65 thousand addresses. There was no middle ground between 254 and 65 thousand. At the same time, every network became a line in the global routing table, which grew far too fast.

CIDR (RFC 1519, from 1993, now updated by RFC 4632, from 2006) solved both problems at once. By allowing any prefix, it delivered the /23, the /22, the /20, the in-between sizes that were missing. And by allocating blocks hierarchically per provider, it enabled route aggregation: a provider advertises one large prefix instead of thousands of small networks. RFC 6890 later consolidated the special-purpose blocks (loopback, documentation, private) into a single registry. And before that, RFC 1918 reserved the private ranges, 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, that eased the pressure by letting addresses be reused behind NAT. Which ranges reach the internet and which stay on the LAN is the topic of the public vs private IP guide.

1. 1981IPv4 and the classes (RFC 791)

   Addressing is born classful: the first octet decides whether the network is A, B or C, fixed sizes, no flexibility.

2. 1993CIDR is born (RFC 1519)

   Free prefixes replace classes to contain exhaustion and slow the growth of the global routing table.

3. 1996Private addresses (RFC 1918)

   The 10/8, 172.16/12 and 192.168/16 ranges are reserved for internal use, behind NAT, easing the demand for public IPs.

4. 2006CIDR consolidated (RFC 4632) and IPv6

   RFC 4632 (BCP 122) becomes the current CIDR specification; in parallel, IPv6 matures with 128 bits to end scarcity for good.

5. 3 Feb 2011IANA exhausts the IPv4 pool

   IANA allocates the last five /8 blocks to the regional registries. IPv4 is spent; the move to IPv6 stops being optional.

IPv4 and IPv6 side by side

The difference starts with size and echoes through everything else. IPv4 has 32 bits: 2^32 = 4,294,967,296 addresses, about 4.3 billion, fewer than one per person on the planet. IPv6 has 128 bits: 2^128 ≈ 3.4 × 10^38, a number so large it slips past human intuition. A single IPv6 /64 already holds 2^64 ≈ 1.8 × 10^19 addresses, more than 4 billion times the entire IPv4 internet, in one subnet. Curiously, an IPv6 address is exactly 128 bits, the same size as a UUID: 128 bits are enough to give a unique identifier to practically anything.

Two IPv6 choices confuse people coming from IPv4. First: there is no broadcast. The "talk to everyone" role moved to multicast, with reserved addresses like ff02::1 (all nodes on the link) and ff02::2 (all routers). This avoids the broadcast storm and makes traffic more efficient. Second: the default subnet prefix is /64, and that is almost a law. The reason is SLAAC (stateless address autoconfiguration, RFC 4862): the host builds its own address by joining the /64 prefix advertised by the router to a 64-bit interface identifier. RFC 4291 requires a 64-bit interface identifier for most unicast addresses, which is why subnets smaller than /64 break autoconfiguration. Link-local addresses (fe80::/10) and the private ULA (fc00::/7, in practice fd00::/8, RFC 4193) round out the picture, each with its own role, as the private ranges do in IPv4.

Two worked examples

Example 1, IPv4. Given 192.168.10.77/26, find the network, broadcast, usable range and host count. A /26 has 6 host bits (32 − 26), so the block holds 2^6 = 64 addresses and the block size is 64. The address 192.168.10.77 lands in the block starting at .64 (a /26 has blocks at .0, .64, .128, .192, and 77 sits between 64 and 127). Doing the AND we saw in the binary section, the network address is 192.168.10.64. The broadcast is the top of the block, .64 + 64 − 1 = .127. The usable range runs from the first host to the last: .65 to .126. And usable hosts are 64 − 2 = 62.

Example 2, IPv6. Compress and expand 2001:0db8:0000:0000:0008:0800:200c:417a. Compression has two rules: drop the leading zeros of each group (0db8 becomes db8, 0008 becomes 8, 0800 becomes 800) and replace the longest run of all-zero groups with a double colon (::), which may appear only once in the address. Here groups 3 and 4 are 0000:0000 and collapse to ::. The compressed result is 2001:db8::8:800:200c:417a, exactly the canonical example from RFC 4291. To expand, do the reverse: the :: stands for however many zero groups are missing to reach 8 (here, two), and each group is padded back to 4 digits.

Expandido / Expanded:  2001:0db8:0000:0000:0008:0800:200c:417a
Comprimido / Compressed: 2001:db8::8:800:200c:417a

// Sub-rede / Subnet 2001:db8::/64
//   primeiro / first: 2001:db8::
//   último   / last : 2001:db8::ffff:ffff:ffff:ffff
//   total: 2^64 endereços de interface / interface addresses

• Confirm the host bit count: 32 − prefix (IPv4) or 128 − prefix (IPv6).
• Find the network with the AND between IP and mask; the broadcast is the top of the block.
• Remember the minus two in IPv4, except /31 and /32.
• When compressing IPv6, use :: only once, on the longest run of zeros.
• Keep host subnets at /64 in IPv6 so you do not break SLAAC.

With the binary foundation in place, the next step is splitting a real network of different sizes with no gaps and no overlap, exactly what subnetting with VLSM in practice shows, step by step. To find your own prefix and address right now, see My IP; to geolocate any address, IP Locator.