What does the /24 in a CIDR mean?

The number after the slash is the prefix length - how many of the 32 bits are the network part. A /24 fixes the first 24 bits, leaving 8 bits for hosts, which is 256 addresses (254 usable after the network and broadcast addresses). Smaller numbers mean bigger blocks: a /16 is 65,536 addresses, a /30 is just 4.

Why are there two fewer usable hosts than total addresses?

In a normal subnet the first address is the network identifier and the last is the broadcast address, neither of which is assigned to a host - so usable hosts is total minus two. The exceptions are /31, used for point-to-point links where both addresses are usable (RFC 3021), and /32, a single host. This calculator accounts for those.

What is the wildcard mask for?

The wildcard mask is the bitwise inverse of the netmask - where the netmask has 1s the wildcard has 0s. It is what some access-control lists and routing tools (notably Cisco ACLs) expect instead of a netmask. Showing both saves a conversion step when you are writing firewall or routing rules.

Free tool · Runs in your browser

CIDR / subnet calculator.

Enter an IPv4 block like 10.0.0.0/24 and get the network and broadcast address, usable host range, host count, netmask, and wildcard mask — the numbers you need to write a firewall or routing rule.

Try:

Network address

Broadcast address

Usable host range

Total addresses

Usable hosts

Netmask

Wildcard mask

The block, fully spelled out

CIDR notation is compact, which is exactly why it is easy to get wrong — the difference between a /23 and a /24 is double the address space, and the network and broadcast addresses at the edges are not yours to assign. Whether you are sizing a VPC subnet, writing a firewall allow-rule, or planning an IP range, having the network, broadcast, usable range, and both masks laid out removes the mental arithmetic where mistakes hide.

Related free tools

UFW firewall generatorLock down your server SSH hardening generatorLock down sshd_config chmod calculatorFile permissions, both ways fail2ban config generatorAuto-ban brute-forcers

All free tools →

Free tools for the backend you run.

One of a set of free developer tools from Infraveil — the control plane for running, securing, and watching your backend on servers you own. Pairs well with the firewall and rate-limit generators.

See all free tools

Get the backend toolkit

Practical tools and guides for shipping and running a backend you own. No spam.