Subnetting and CIDR Cheat Sheet for Security Engineers
CIDR (Classless Inter-Domain Routing) notation is how security engineers write network ranges in firewall rules, cloud security groups, scan scopes and threat reports. This cheat sheet explains how to read it, gives a quick reference table for IPv4, and covers the IPv6 basics.
How CIDR notation works
A range such as 192.168.10.0/24 has two parts: the network address and a prefix length. The prefix length (the number after the slash) says how many of the 32 bits in an IPv4 address identify the network. The remaining bits identify hosts. A longer prefix means a smaller network, so a /28 is much smaller than a /16.
The number of addresses in a block is 2 raised to the number of host bits, which is 2(32 − prefix). On a traditional IPv4 subnet, the first address is the network address and the last is the broadcast address, so usable host addresses are the total minus two.
IPv4 quick reference
| CIDR | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 (point-to-point links, RFC 3021) |
| /32 | 255.255.255.255 | 1 | 1 (a single host) |
Private IPv4 ranges (RFC 1918)
10.0.0.0/8(10.0.0.0 to 10.255.255.255)172.16.0.0/12(172.16.0.0 to 172.31.255.255)192.168.0.0/16(192.168.0.0 to 192.168.255.255)
These ranges are not routed on the public internet, so they appear in internal networks and cloud virtual networks. Seeing them in an indicator list usually means the data is from inside an environment, not an attacker address.
Where subnetting matters in security work
- Segmentation: splitting user, server, management and guest networks into separate subnets so firewall rules can be precise.
- Firewall and ACL rules: allowing one
/32host or a small/28is safer than a broad/16. - Scan scoping: knowing exactly how many addresses a scan range covers before you run it.
- Blocklists and threat reports: advisories often list attacker infrastructure as CIDR ranges.
- Cloud networks: VPC and VNet designs need non-overlapping ranges so peering and VPNs work.
IPv6 basics
- IPv6 addresses are 128 bits long, written in hexadecimal groups.
- A
/64is the standard size for a single local network (LAN) subnet. - A
/48is commonly allocated to a site, which leaves 16 bits for subnetting into /64 networks. - A
/128is a single host. - IPv6 has no broadcast address, so there is no “minus two” rule.
Check your maths with our free tools
Use the subnet calculator for IPv4 ranges and the IPv6 subnet calculator for IPv6 prefixes. Browse all of our free security and network tools, or read the latest threat and malware coverage to see how network ranges show up in real advisories.