What it means
In IPv4, a subnet mask uses contiguous binary ones for the network prefix and zeros for host bits. CIDR expresses the same prefix length with a slash, such as /24. Longer prefixes represent smaller networks; shorter prefixes represent larger address ranges.
How it works
Devices compare destination addresses with routing and local-subnet prefixes to decide whether traffic is local or should be sent to a router. Firewalls, cloud security rules, route tables, access lists, and inventories also use CIDR ranges, so an incorrect prefix can expose too much or break connectivity.
The network 192.0.2.0/24 contains 256 IPv4 addresses from 192.0.2.0 through 192.0.2.255. Splitting it into two /25 networks creates two ranges of 128 addresses each, with one additional bit used for the network prefix.
Practical focus
- Understand prefix boundaries instead of memorizing isolated masks
- Validate CIDR ranges in firewall and cloud policies
- Use variable-length subnetting to fit real requirements
- Document reserved, routed, and overlapping ranges
Common mistakes
- Assuming /24 is the correct size for every network
- Creating overly broad allow rules such as /0 or a large private range
- Forgetting that IPv6 uses prefix lengths without IPv4-style dotted masks
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: