What the prefix length means
A /24 means the first 24 bits identify the network and the remaining 8 identify hosts within it. That leaves 256 addresses, of which 254 are usable — the first is the network address and the last is the broadcast address.
Each bit removed from the prefix doubles the network. A /23 holds 510 usable hosts, a /22 holds 1,022, and so on.
Private address ranges
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private networks. These are not routable on the public internet, which is why home routers hand them out behind NAT.
The /31 and /32 prefixes are special cases: /31 is used for point-to-point links where no broadcast address is needed, and /32 identifies a single host.
Choosing a subnet size
Size for growth, but not excessively. A /24 giving 254 usable addresses suits most office floors and home networks. Point-to-point links between routers conventionally use a /30 or /31, because anything larger wastes addresses on a segment that will only ever hold two devices.
Smaller subnets also limit broadcast traffic, which is why large flat networks are usually split into several VLANs rather than run as a single oversized subnet.
CIDR replaced address classes
The original scheme divided addresses into fixed Class A, B and C blocks, offering only 16.7 million, 65,534 or 254 hosts with nothing in between. An organisation needing 500 addresses had to take a Class B and waste most of it.
Classless Inter-Domain Routing, introduced in 1993, allows any prefix length, so blocks can be sized to actual need. This slowed IPv4 exhaustion considerably and is why addresses are now always written with a prefix.
Frequently asked questions
Why are two addresses unusable? +
The all-zeros host portion identifies the network itself and the all-ones portion is the broadcast address. Neither can be assigned to a device on a normal subnet.
What is the difference between a subnet mask and CIDR notation? +
They express the same thing. 255.255.255.0 and /24 both mean the first 24 bits are the network portion; CIDR is simply shorter.
Can I use any private range I like? +
Technically yes, but 192.168.x.x is so common in home routers that VPN connections frequently collide with it. Picking an unusual 10.x.x.x range avoids that.