1. The Problem with Legacy Classful Networking
In the 1980s, the original IPv4 address space was carved into rigid categories known as Classful Networks:
- Class A (/8): Allocated 16,777,216 addresses to massive telecom organizations.
- Class B (/16): Allocated 65,536 addresses to universities and mid-sized enterprises.
- Class C (/24): Allocated 256 addresses to small local offices.
This rigid division caused staggering address wastage. An organization requiring 400 IP addresses could not fit into a Class C network (256 addresses), forcing them to request a Class B network (65,536 addresses)—wasting more than 65,000 routable public IPv4 addresses.
In 1993, the Internet Engineering Task Force (IETF) introduced CIDR (Classless Inter-Domain Routing, RFC 4632), eliminating static classes and enabling arbitrary subnet prefix lengths between /0 and /32.
2. Anatomy of an IPv4 Address: The 32-Bit System
An IPv4 address consists of exactly 32 binary bits grouped into four 8-bit octets separated by dots (e.g. 192.168.1.1):
Every IP address is divided into two logical sections:
- Network Portion: Identifies which routing domain or subnet the device belongs to.
- Host Portion: Identifies the specific physical or virtual machine within that subnet.
3. Understanding Prefix Length (/X) and Subnet Masks
The number after the slash (e.g. /24) represents the prefix length: the exact number of contiguous leading bits that belong to the Network Portion. The remaining bits belong to the Host Portion:
Host Bits = 32 - Prefix Length
| CIDR Notation | Subnet Mask | Total IPs ($2^H$) | Standard Usable IPs ($2^H - 2$) | Typical Cloud Use Case |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 | Default AWS/GCP VPC Boundary |
| /20 | 255.255.240.0 | 4,096 | 4,094 | Regional App Tier Subnet |
| /24 | 255.255.255.0 | 256 | 254 | Database or Kubernetes Pod Subnet |
| /28 | 255.255.255.240 | 16 | 14 (11 in AWS) | Bastion Host or NAT Gateway Tier |
| /32 | 255.255.255.255 | 1 | 1 (Host Route) | Security Group Single IP Whitelist |
4. The Standard Usable Host Formula: Why "- 2"?
In standard RFC 1918 on-premise networking, every subnet sacrifices 2 addresses:
- Network Address (First IP, all host bits 0): Identifies the subnet itself to routing tables.
- Broadcast Address (Last IP, all host bits 1): Transmits packets to all hosts connected to the subnet simultaneously.
Therefore, the formula for usable hosts in any conventional subnet is:
Usable Hosts = 2^(32 - Prefix) - 2
5. The Cloud Gotcha: AWS VPC 5 Reserved IPs
Cloud engineers must note that major cloud providers (especially Amazon Web Services VPC) reserve 5 IP addresses in every subnet rather than 2:
Example for 10.0.0.0/24 in an AWS VPC:
10.0.0.0— Network address (reserved by standard).10.0.0.1— VPC Router / Default Gateway.10.0.0.2— Amazon Provided DNS (AmazonRoute53Resolver).10.0.0.3— Reserved by AWS for future internal networking use.10.0.0.255— Network broadcast address (AWS does not support broadcast, but reserves it).
Result: A /28 subnet in AWS gives you only 11 usable IP addresses (16 - 5 = 11), not 14!
6. Best Practices for Designing a Cloud VPC
When architecting production cloud environments:
- Never overlap CIDR ranges: If your on-premise datacenter uses
10.0.0.0/16, never allocate10.0.0.0/16to your AWS or GCP VPC, or VPN site-to-site peering will fail. - Size subnets generously for auto-scaling: Elastic Load Balancers, ECS tasks, and Kubernetes (EKS) pods consume IP addresses rapidly. Prefer
/22or/24for application subnets over/28.