IP, Subnet Mask and CIDR

An IPv4 address has two parts

An IPv4 address is 32 bits long, split into 4 octets (e.g. 192.168.1.3). The first part is the NetID (which network), and the rest is the HostID (which machine on that network).

The subnet mask marks the boundary: the number of 1 bits in the mask is the number of NetID bits. So 192.168.1.3/24 means mask 255.255.255.0 — the first 24 bits are the network, the last 8 bits are the host.

Working out the network address

Network address = IP AND mask:

flowchart LR
  A["IP 192.168.1.3"] --> C{"AND"}
  B["Mask 255.255.255.0 (/24)"] --> C
  C --> D["Network 192.168.1.0/24"]
  %% step A: The IP address has 32 bits; the first bits name the network, the rest the host.
  %% step B: The /24 mask has 24 one-bits marking where the network part ends.
  %% step C: A bitwise AND keeps the network bits and zeroes the host bits.
  %% step D: The result is the network address, the first address of the range.

The bigger the /n, the smaller the network: a /24 has 2^8 = 256 addresses, a /26 has 64, and a /32 is just one address. At the other end, 0.0.0.0/0 means every address — you'll see it all the time in route tables ("go to the Internet").

Private ranges

Use these for internal networks and for your VPC CIDR:

• 10.0.0.0/8
• 172.16.0.0/12 (172.16.x.x → 172.31.x.x)
• 192.168.0.0/16

Public IPs are assigned by your ISP or AWS; a machine with a private IP has to go through a router/NAT to reach the Internet. Don't use a public range like 18.0.0.0/16 as your VPC CIDR.

AWS takes 5 IPs from every subnet

For the subnet 10.0.1.0/24, AWS reserves:

So a /24 leaves you only 251 IPs for instances, not 256 or 254.

Handy commands

Memory tip: /32 = one machine, /0 = the whole world. Adding 1 to /n splits the network in half.