NETWORK

CIDR notationPrefix lengths and address blocks

CIDR notation writes an IP address followed by a slash and a prefix length, for example 192.168.0.0/24. The prefix length is the number of leading bits that identify the network; the remaining bits identify hosts. /24 covers 256 addresses, /16 covers 65,536, and each step of the prefix halves or doubles the block.

BlackhawkHub Editorial · Updated

Why CIDR exists

The original IPv4 design divided addresses into classes by their first bits: class A networks with 16 million hosts, class B with 65,534, class C with 254. Organisations that needed 1,000 addresses received a class B and wasted 64,000. By the early 1990s the address space and the routing tables were both running out. CIDR replaced classes with an explicit prefix length, so a block can be any power-of-two size and adjacent blocks can be advertised as one route.

Reading a CIDR block

203.0.113.0/26:

  • Prefix length 26 → 32 − 26 = 6 host bits → 2^6 = 64 addresses.
  • Blocks of 64 start at .0, .64, .128, .192.
  • This block runs from 203.0.113.0 to 203.0.113.63.
  • Network address .0, broadcast .63, usable .1.62.

The address before the slash is normally the first address of the block. Writing 203.0.113.37/26 is allowed in configuration (it means "this host, in this block") and tools normalise it to the block start.

Quick reference

PrefixAddressesTypical use
/816,777,21610.0.0.0/8 private space
/121,048,576172.16.0.0/12 private space
/1665,536192.168.0.0/16 private space, large campus
/204,096Cloud VPC or data-centre segment
/221,024Large office
/24256Standard LAN
/2732Small server segment
/298ISP customer hand-off
/304Point-to-point link (2 usable)
/312Point-to-point link (RFC 3021)
/321Single host

Aggregation and longest-prefix match

Routers pick the route with the longest matching prefix. If a table contains 10.0.0.0/8 and 10.1.0.0/16, a packet to 10.1.2.3 follows the /16. This lets an ISP advertise one aggregate to the world while using specific routes internally.

Aggregation requires alignment: a /23 must start on an even /24 boundary, a /22 on a multiple of four, and so on. The CIDR Calculator checks alignment and produces the minimal set of blocks covering an arbitrary range.

CIDR in IPv6

IPv6 uses only prefix notation. A home or office LAN is a /64 (18 quintillion addresses, of which the interface identifier uses the lower 64 bits). ISPs typically delegate a /56 or /48 to a site; the global unicast space in use is 2000::/3.

Where it appears

  • Firewall and cloud security-group rules (allow 10.20.0.0/16).
  • route print on Windows shows masks, while netsh and PowerShell (New-NetRoute -DestinationPrefix 10.0.0.0/8) use CIDR.
  • PostgreSQL pg_hba.conf, nginx allow, SSH Match Address and almost every access-control list.

Frequently asked questions

What does /24 mean?

The first 24 of the 32 address bits are the network prefix. That leaves 8 host bits, so the block contains 2^8 = 256 addresses. In mask form it is 255.255.255.0.

What is the difference between CIDR and a subnet mask?

They express the same thing. The mask is the 32-bit form (255.255.255.0); CIDR is the count of network bits (/24). CIDR is shorter, works for IPv6, and is what routing protocols and cloud consoles use.

What is supernetting or aggregation?

Combining adjacent blocks into one larger block with a shorter prefix. 192.168.0.0/24 and 192.168.1.0/24 together are 192.168.0.0/23. It only works when the blocks are aligned; 192.168.1.0/24 and 192.168.2.0/24 cannot be merged into a /23.

Sources