What does /24 mean in IP addressing and networking?

The short answer

/24 is a CIDR prefix length. Written after an address — 203.0.113.0/24 — it says that the first 24 bits of that 32-bit address identify the network and the remaining 8 bits identify hosts inside it. Eight free bits give 2⁸ = 256 addresses, from 203.0.113.0 to 203.0.113.255. On an ordinary subnet the lowest is the network address and the highest is the broadcast address, leaving 254 usable. The equivalent dotted mask is 255.255.255.0.

That is the whole definition. The rest of this page is why it is written that way, how to read the other prefix lengths, and why anyone buying proxies runs into the notation constantly.

Where the 24 comes from

An IPv4 address is four bytes, normally shown as four decimal numbers, but the machine sees 32 bits:

203.0.113.77  =  11001011 00000000 01110001 01001101
                 |------- 24 bits fixed -------|-8-|
mask /24      =  11111111 11111111 11111111 00000000
                 =  255      .255     .255     .0

The mask is simply a run of ones followed by a run of zeros, and the prefix length counts the ones. So the two ways of writing it carry identical information: /24 and 255.255.255.0 are the same statement. Any address whose first 24 bits match belongs to the same block, which is why 203.0.113.77 and 203.0.113.200 are neighbours and 203.0.114.1 is not.

Two consequences follow from the ones-then-zeros rule. A prefix boundary can only fall where the arithmetic allows, so 203.0.113.5/24 is not a network — it is a host inside the network 203.0.113.0/24, and tools will normalise it or reject it. And because each extra fixed bit halves the block, sizes only come in powers of two: you cannot have a range of exactly 300 addresses.

Reading /16, /22, /28 and the rest

The rule is that a smaller number after the slash means a bigger block, which trips people up at first. Fewer fixed bits leave more bits free to vary. Each step down doubles the size:

The general formula is 2^{(32 − prefix)} addresses, minus two for the network and broadcast addresses on a normal subnet. The bottom of the table is where that subtraction stops making sense: a /32 is one single address, used in firewall rules and routing entries to mean “exactly this host”, and a /31 is used on point-to-point links where the two reserved addresses would leave nothing behind. IPv6 uses the same notation with 128 bits instead of 32, which is why you see /64 for a single subnet and /48 for a site allocation.

If you would rather not do the arithmetic, every operating system ships something that will. Python's standard library is the quickest:

>>> import ipaddress
>>> net = ipaddress.ip_network("203.0.113.0/24")
>>> net.netmask, net.num_addresses
(IPv4Address('255.255.255.0'), 256)
>>> net.broadcast_address
IPv4Address('203.0.113.255')
>>> ipaddress.ip_address("203.0.113.77") in net
True
>>> ipaddress.ip_address("203.0.114.1") in net
False

Why the notation exists at all

Until 1993 IPv4 was classful: the leading bits of an address fixed its size, so you got a class A (16.7 million addresses), a class B (65,536) or a class C (256), and nothing in between. An organisation needing 2,000 addresses had to take a class B and waste sixty thousand of them, and the global routing table grew one entry per allocation.

CIDR — Classless Inter-Domain Routing — removed the classes and let the prefix be any length. That fixed both problems at once. Allocations could be sized to the need, and adjacent blocks could be aggregated: four consecutive /24s advertise as a single /22, so backbone routers carry one route where they used to carry four. This is why a /24 is often described as a class C. They are the same size, but the class was a rigid category and the prefix is just a number of bits.

The practical residue is that the internet is administered in blocks, not addresses. Regional registries hand networks a prefix, networks advertise prefixes, firewalls and reputation systems store prefixes. Nobody keeps per-address records when a prefix will do.

What this has to do with proxies

That last point is the reason this notation matters if you buy proxies rather than run a network. Pools, allocations and blocklists are all described in ranges, and the decisions that affect you are taken on ranges too.

A datacentre proxy provider buys address space in blocks — a /24, several /24s, sometimes a /22. Every address in that block shares one registry record, one autonomous system and one reputation. When a target site decides the block is a source of automated traffic, it does not ban 254 addresses one at a time; it writes a single rule:

deny 203.0.113.0/24

One line, and every proxy you had in that range is gone at the same instant. This is what people mean when they say datacentre proxies “die in batches”. It is also why buying more addresses from the same provider often does not help: if the new ones come from the neighbouring /24, the next rule catches them too. Checking whether your addresses are spread across different prefixes and different networks tells you more about their durability than the raw count does.

Residential and mobile addresses behave differently for exactly this structural reason. They sit inside consumer ISP and carrier allocations, alongside ordinary customers, and consecutive requests from a rotating pool typically come from unrelated prefixes belonging to different networks. There is no shared block to write a rule against — blocking the range would block the ISP's real subscribers. That is the difference the notation exposes: not that one type of address is inherently trusted and the other is not, but that one type shares a range and the other does not.

The same idea is worth applying to your own side of the connection. If a provider authenticates by IP whitelist, the entry you register is a prefix, and a /32 means one exact address while a /24 would authorise 256 of them. And when you are diagnosing why a target treats two exits differently, comparing their prefixes is usually the fastest route to an answer:

curl -x http://USERNAME-country-us:PASSWORD@gw.pyproxy.com:1111 https://httpbin.org/ip

Run that a few times, note the addresses that come back, and look at how far apart they are. Exits landing in the same /24 every time are one block; exits landing in unrelated prefixes are a pool.

Questions people ask