NETWORK
CIDR notationPrefix lengths and address blocks
CIDR notation writes an IP address followed by a slash and a prefix length, for example 192.168.0.0/24. The prefix length is the number of leading bits that identify the network; the remaining bits identify hosts. /24 covers 256 addresses, /16 covers 65,536, and each step of the prefix halves or doubles the block.
Why CIDR exists
The original IPv4 design divided addresses into classes by their first bits: class A networks with 16 million hosts, class B with 65,534, class C with 254. Organisations that needed 1,000 addresses received a class B and wasted 64,000. By the early 1990s the address space and the routing tables were both running out. CIDR replaced classes with an explicit prefix length, so a block can be any power-of-two size and adjacent blocks can be advertised as one route.
Reading a CIDR block
203.0.113.0/26:
- Prefix length 26 → 32 − 26 = 6 host bits → 2^6 = 64 addresses.
- Blocks of 64 start at .0, .64, .128, .192.
- This block runs from
203.0.113.0to203.0.113.63. - Network address
.0, broadcast.63, usable.1–.62.
The address before the slash is normally the first address of the block. Writing 203.0.113.37/26 is allowed in configuration (it means "this host, in this block") and tools normalise it to the block start.
Quick reference
| Prefix | Addresses | Typical use |
|---|---|---|
| /8 | 16,777,216 | 10.0.0.0/8 private space |
| /12 | 1,048,576 | 172.16.0.0/12 private space |
| /16 | 65,536 | 192.168.0.0/16 private space, large campus |
| /20 | 4,096 | Cloud VPC or data-centre segment |
| /22 | 1,024 | Large office |
| /24 | 256 | Standard LAN |
| /27 | 32 | Small server segment |
| /29 | 8 | ISP customer hand-off |
| /30 | 4 | Point-to-point link (2 usable) |
| /31 | 2 | Point-to-point link (RFC 3021) |
| /32 | 1 | Single host |
Aggregation and longest-prefix match
Routers pick the route with the longest matching prefix. If a table contains 10.0.0.0/8 and 10.1.0.0/16, a packet to 10.1.2.3 follows the /16. This lets an ISP advertise one aggregate to the world while using specific routes internally.
Aggregation requires alignment: a /23 must start on an even /24 boundary, a /22 on a multiple of four, and so on. The CIDR Calculator checks alignment and produces the minimal set of blocks covering an arbitrary range.
CIDR in IPv6
IPv6 uses only prefix notation. A home or office LAN is a /64 (18 quintillion addresses, of which the interface identifier uses the lower 64 bits). ISPs typically delegate a /56 or /48 to a site; the global unicast space in use is 2000::/3.
Where it appears
- Firewall and cloud security-group rules (
allow 10.20.0.0/16). route printon Windows shows masks, whilenetshand PowerShell (New-NetRoute -DestinationPrefix 10.0.0.0/8) use CIDR.- PostgreSQL
pg_hba.conf, nginxallow, SSHMatch Addressand almost every access-control list.
Frequently asked questions
What does /24 mean?
The first 24 of the 32 address bits are the network prefix. That leaves 8 host bits, so the block contains 2^8 = 256 addresses. In mask form it is 255.255.255.0.
What is the difference between CIDR and a subnet mask?
They express the same thing. The mask is the 32-bit form (255.255.255.0); CIDR is the count of network bits (/24). CIDR is shorter, works for IPv6, and is what routing protocols and cloud consoles use.
What is supernetting or aggregation?
Combining adjacent blocks into one larger block with a shorter prefix. 192.168.0.0/24 and 192.168.1.0/24 together are 192.168.0.0/23. It only works when the blocks are aligned; 192.168.1.0/24 and 192.168.2.0/24 cannot be merged into a /23.