CIDR Binary Calculation

What Is CIDR?

Classless Inter-Domain Routing (CIDR) is the way we describe IP address blocks today. Before CIDR, we had classful addressing — Class A, B, and C networks — where you were stuck with fixed-size blocks of 16 million, 65,536, or 256 addresses. It was wasteful. CIDR replaced that in the mid-1990s, and every router since has been using CIDR to figure out where packets go.

At its core, CIDR is a compact notation: an IP address followed by a slash and a number, like 192.168.1.0/24. The number after the slash — the prefix length — tells you how many of the leftmost bits are the network prefix. Everything after those bits is the host portion. That /24 is the key to everything: it tells a router exactly how many bits to compare when deciding if a destination is on the same network.

I have used CIDR binary calculations extensively when designing VPC architectures on AWS. A /20 subnet is 4096 addresses, and knowing that the binary mask has 20 leading ones helped me spot a route table misconfiguration before deploying to production.

CIDR in Binary — The Breakdown

Here is where the bitwise logic comes in. An IPv4 address is 32 bits long, period. CIDR notation tells you how to split those 32 bits. Take 192.168.1.0/24 — I hear that one more than any other because it is the default subnet on almost every consumer router on the planet.

192.168.1.0 in Binary (32 bits)

The /24 Split

Now add the /24. That means: the first 24 bits belong to the network, and the remaining 8 bits are for hosts. Visually, the 32-bit address splits like this:

The bitwise operation happening here is straightforward: the router applies the subnet mask (which is also 32 bits of 1s and 0s) to the destination IP using a bitwise AND. If the result matches the network address, the destination is local. Otherwise, the packet goes upstream.

Network Bits vs Host Bits

Every CIDR prefix length is a simple arithmetic relationship:

Network bits + Host bits = 32

/24: 24 network bits + 8 host bits   2^8 = 256 total addresses
/16: 16 network bits + 16 host bits  2^16 = 65,536 total addresses
/8:   8 network bits + 24 host bits   2^24 = 16,777,216 total addresses
/30: 30 network bits + 2 host bits    2^2 = 4 total addresses
/32: 32 network bits + 0 host bits    1 address (a single host)

The number of usable host addresses is always total addresses minus 2 — the network address (all host bits 0) and the broadcast address (all host bits 1) are reserved. In binary, these two special addresses are the only ones where all host bits are identical, making them trivially detectable in hardware.

Let me show you a different prefix to make this concrete. A /26, which I use frequently when segmenting office VLANs:

The Subnet Mask in Binary

The subnet mask is the unsung hero of CIDR. It is a 32-bit value where every bit in the network portion is set to 1 and every bit in the host portion is set to 0. The router uses it in a bitwise AND with the destination IP to extract the network address.

Common Subnet Masks in Binary

Notice the pattern: each /24 increment adds 8 ones to the binary mask. Each /1 increment within an octet doubles the number of network bits. When I am working with network ACLs or firewall rules, I often write out the subnet mask in binary to verify my logic — especially when dealing with non-octet-aligned prefixes like /23 or /21 where the boundary falls in the middle of an octet.

Calculating Network and Broadcast Addresses

Here is the bitwise logic that runs in every router for every packet. Given an IP and a subnet mask, the router calculates three things: the network address, the broadcast address, and the host range.

Network Address

The network address is the bitwise AND of the IP and the subnet mask. Every bit in the host portion gets zeroed out.

Broadcast Address

The broadcast address sets all host bits to 1. It is the network address plus the bitwise complement of the subnet mask within the host portion. Every device on the subnet listens to this address — it is how ARP requests and DHCP offers find their way.

Variable Length Subnet Masking (VLSM)

One of the practical realities I deal with regularly is that not every subnet needs the same number of hosts. Your data center VLAN needs 500 addresses. Your printer VLAN needs 10. Wasting a whole /24 on the printer VLAN is pointless. This is where Variable Length Subnet Masking (VLSM) comes in — using different prefix lengths within the same major network.

VLSM is just CIDR applied hierarchically. You take a larger block and carve it into smaller blocks of different sizes, each aligned to a power-of-two boundary. The bitwise constraint is that subnets cannot overlap — their network addresses must be multiples of their block size.

Notice that subnets must align to their block size boundaries. A /27 has a block size of 32, so its network address must be a multiple of 32. This is why 10.0.0.128 works for /27 (128 is evenly divisible by 32) but 10.0.0.140 would not. In binary, this constraint is trivially visible: the last 5 bits of a /27 network address must be 0.