Whether you are provisioning an AWS Virtual Private Cloud (VPC), configuring firewall rules in Cloudflare, assigning Pod CIDR blocks in a Kubernetes cluster, or debugging Docker network bridges, CIDR (Classless Inter-Domain Routing) and subnetting are fundamental networking concepts.
Yet for many software engineers, converting slash notation like 10.0.4.0/22 into usable host ranges, subnet masks, and broadcast boundaries feels error-prone and unintuitive.
This practical cheat sheet demystifies CIDR bitwise arithmetic, explains cloud provider IP reservation rules, and provides a quick-reference guide for system design.
1. What is CIDR Notation?
An IPv4 address consists of 32 binary bits divided into four 8-bit octets (e.g., 192.168.1.1).
CIDR notation appends a suffix /N (the prefix length) specifying how many contiguous leading bits represent the Network Prefix (the network address), leaving the remaining 32 - N bits for individual Host Addresses.
IPv4 Address: 192.168.1.0/24
Binary: 11000000 . 10101000 . 00000001 . 00000000
Mask bits: [--------- 24 Network Bits ---------] [ 8 Host Bits ]
Total Hosts: 2^(32 - 24) = 2^8 = 256 Total IP Addresses
Key Subnet Formulas:
- Total IP Addresses: $2^{(32 - \text{prefix})}$
- Standard Usable IP Addresses: $2^{(32 - \text{prefix})} - 2$ (Subtracting the Network Address and Broadcast Address)
- AWS / Cloud Usable IP Addresses: $2^{(32 - \text{prefix})} - 5$ (Cloud providers reserve 5 IPs per subnet)
2. Complete IPv4 CIDR Reference Cheat Sheet
| CIDR Prefix | Subnet Mask | Total IPs | Standard Usable IPs | Cloud Usable IPs (AWS) | Common Use Case |
|---|---|---|---|---|---|
| /32 | 255.255.255.255 |
1 | 1 | 0 | Single Host / Specific Firewall Rule |
| /31 | 255.255.255.254 |
2 | 2 (RFC 3021) | 0 | Point-to-point Router Links |
| /30 | 255.255.255.252 |
4 | 2 | 0 | Legacy Point-to-point Links |
| /29 | 255.255.255.248 |
8 | 6 | 3 | Tiny public IP block (bastion host) |
| /28 | 255.255.255.240 |
16 | 14 | 11 | Small service subnet |
| /27 | 255.255.255.224 |
32 | 30 | 27 | Microservice tier |
| /26 | 255.255.255.192 |
64 | 62 | 59 | Medium microservice cluster |
| /25 | 255.255.255.128 |
128 | 126 | 123 | Database / cache cluster |
| /24 | 255.255.255.0 |
256 | 254 | 251 | Standard application subnet |
| /23 | 255.255.254.0 |
512 | 510 | 507 | Mid-sized Kubernetes node pool |
| /22 | 255.255.252.0 |
1,024 | 1,022 | 1,019 | Large container cluster subnet |
| /20 | 255.255.240.0 |
4,096 | 4,094 | 4,091 | Production Availability Zone (AZ) |
| /16 | 255.255.0.0 |
65,536 | 65,534 | 65,531 | Standard VPC / Enterprise Network |
| /8 | 255.0.0.0 |
16,777,216 | 16,777,214 | 16,777,211 | RFC 1918 Class A Private Supernet |
3. RFC 1918 Private Address Ranges
Internet standards reserve three blocks of IPv4 address space for private corporate and cloud networks (non-routable on the public internet):
10.0.0.0/8(10.0.0.0–10.255.255.255): 16,777,216 IPs. Standard for large-scale enterprise infrastructure and multi-account cloud VPCs.172.16.0.0/12(172.16.0.0–172.31.255.255): 1,048,576 IPs. Default for Docker bridge networks (172.17.0.0/16).192.168.0.0/16(192.168.0.0–192.168.255.255): 65,536 IPs. Standard for home routers and office local area networks (LANs).
4. The 5 Reserved IPs in AWS VPC Subnets
When designing subnets in AWS (or GCP/Azure), remember that 5 IP addresses are automatically reserved in every subnet and cannot be assigned to EC2 instances, containers, or Load Balancers:
For an example subnet of 10.0.1.0/24:
10.0.1.0: Network address10.0.1.1: VPC Router address (Default gateway)10.0.1.2: Amazon-provided DNS Server (Base of VPC + 2)10.0.1.3: Reserved by AWS for future functionality10.0.1.255: Network Broadcast address (VPC does not support broadcast, but address remains reserved)
Result: A /28 subnet in AWS provides only $16 - 5 = 11$ usable IP addresses.
5. Step-by-Step Subnet Calculation Example
Let's calculate the network boundaries for 10.140.32.0/20:
- Calculate Host Bits: $32 - 20 = 12$ host bits.
- Total Addresses: $2^{12} = 4,096$ IP addresses.
- Octet Block Size: In the 3rd octet ($/20$ falls in the 3rd octet), each subnet spans $256 / 2^{(20 - 16)} = 256 / 16 = 16$ values.
- Network Range:
- Network ID:
10.140.32.0 - First Usable Host:
10.140.32.1 - Last Usable Host:
10.140.47.254 - Broadcast Address:
10.140.47.255
- Network ID:
Tip: Need to inspect public IP geographic details, ISP ASN metadata, or reverse DNS? Use the DevFlow IP Lookup Tool and DNS Lookup.
6. IPv6 CIDR Prefix Conventions
IPv6 uses 128-bit hexadecimal addresses, eliminating the need for complex host-conservation subnet calculations:
/128: A single IPv6 device (equivalent to IPv4/32)./64: The universal standard subnet size for a single network segment (providing $2^{64} \approx 1.84 \times 10^{19}$ addresses). SLAAC (Stateless Address Autoconfiguration) strictly requires a/64./48: The standard prefix allocation assigned by ISPs to an entire enterprise or multi-datacenter organization (allowing 65,536/64subnets).
Frequently Asked Questions
What happens if two VPCs or Kubernetes clusters have overlapping CIDRs?
If two networks share overlapping IP ranges (e.g., both use 10.0.0.0/16), they cannot be connected via VPC Peering, AWS Transit Gateway, or IPsec VPN tunnels without complex Private NAT (Network Address Translation) overlays. Always partition your organization's IP address space in advance.
Why does Kubernetes require so many IP addresses per node?
In standard Kubernetes CNI plugins (like AWS VPC CNI or Calico), every Pod is assigned its own dedicated IP address from the VPC subnet. A cluster with 50 nodes running 30 pods per node requires at least 1,500 distinct IP addresses.
How do I convert a dotted decimal subnet mask like 255.255.240.0 into CIDR?
Count the total number of binary 1s in the mask. 255.255.240.0 is 11111111.11111111.11110000.00000000, which contains $8 + 8 + 4 + 0 = 20$ bits, or /20.