If you've ever set up a home router, configured a cloud VPC, or read a network diagram, you've run into an IP address followed by a slash and a number -- something like 192.168.1.0/24. That's CIDR notation, and the number after the slash isn't arbitrary. It tells you exactly how many addresses are in that network and which ones they are.
What the number after the slash means
An IPv4 address is 32 bits long. The CIDR number says how many of those bits are fixed as the "network" portion -- the rest are free to vary and identify individual hosts on that network. A /24 means the first 24 bits are fixed, leaving 8 bits (2^8 = 256 addresses) for hosts. A /16 fixes the first 16 bits, leaving 16 bits free -- 65,536 addresses. Smaller CIDR numbers mean bigger networks, which trips people up at first because it feels backwards.
Why you lose two addresses
Out of any subnet's address range, two are reserved and can't be assigned to a device. The very first address is the network address, which identifies the subnet itself rather than a host. The very last address is the broadcast address, used to send a packet to every host on that subnet at once. So a /24 gives you 256 total addresses but only 254 usable ones.
Subnet masks are the same thing in a different format
Before CIDR notation became standard, the same information was written as a subnet mask like 255.255.255.0. That mask is just another way of saying "the first 24 bits are the network portion" -- each 255 represents 8 bits fully set to 1. If you've seen both formats and wondered whether they mean different things, they don't; a /24 and a 255.255.255.0 mask describe the identical network size.
Why this matters even if you're not a network admin
CIDR ranges show up constantly outside of pure networking work: cloud provider security groups, firewall rules, VPN configs, and Docker network settings all use them. Knowing that 10.0.0.0/16 is a much larger range than 10.0.0.0/24 -- and being able to work out where one subnet ends and the next begins -- saves you from misconfiguring an allowlist or accidentally overlapping two networks that are supposed to be separate.
Working it out without doing the math by hand
The binary math behind subnetting is straightforward once you've done it a few times, but doing it correctly under time pressure (say, while setting a firewall rule) is where mistakes happen. The Subnet / CIDR Calculator takes an IP and CIDR prefix and returns the network address, broadcast address, subnet mask, and usable host range directly, so you can double-check a range before you commit it to a config file.