CIDR notation explained
One number after a slash, and the counterintuitive fact that a bigger number means a smaller network.
What the number counts
In 10.0.0.0/24, the 24 is how many of the address's 32 bits identify the network. The remaining 8 identify hosts inside it.
That is the whole definition, and two consequences follow immediately. First, a bigger prefix leaves fewer host bits, so a bigger number is a smaller network. Second, the block size is always a power of two, because it is determined by how many bits are left over.
Reading a prefix at a glance
Two quantities are worth being able to produce instantly.
addresses in the block = 2 ^ (32 - prefix) usable for hosts = 2 ^ (32 - prefix) - 2 /24 -> 2^8 = 256 addresses, 254 usable /26 -> 2^6 = 64 addresses, 62 usable /30 -> 2^2 = 4 addresses, 2 usable
The minus two is the network address at the bottom of the block and the broadcast address at the top, neither of which can go on a device. Network, broadcast and usable hosts covers why.
The other useful move is going the other way. Given a number of hosts you need, round up to the next power of two after adding two, and that tells you the prefix. Sixty machines needs 62 usable, which needs 64 addresses, which is a /26.
Why CIDR exists
Before 1993, address blocks came in exactly three sizes, decided by the first bits of the address itself.
| Class | Equivalent today | Hosts |
|---|---|---|
| A | /8 | 16,777,214 |
| B | /16 | 65,534 |
| C | /24 | 254 |
The gap between 254 and 65,534 is the problem. An organization with 300 machines was too large for a Class C and received a Class B, wasting roughly 65,000 addresses. There was nothing in between, and the address space drained at a rate driven by the rounding rather than by demand.
CIDR removed the classes and let a block be any prefix length. That same organization now takes a /23, gets 510 usable addresses, and wastes about 200. It is the single change that kept IPv4 viable long enough for anything else to be attempted.
The prefixes you will actually meet
| Prefix | Where you see it |
|---|---|
/8 | 10.0.0.0/8, the largest private range. Also historical Class A allocations |
/12 | 172.16.0.0/12, the middle private range |
/16 | 192.168.0.0/16, the home router range. A common corporate site size |
/24 | The default home network, and the unit most people picture |
/26, /27, /28 | Departments, VLANs, cloud subnets |
/30 | The classic link between two routers, two usable addresses |
/31 | The modern router link. Both addresses usable, no broadcast |
/32 | A single host. Loopbacks, firewall rules, single routes |
0.0.0.0/0 means "every address", since zero bits are fixed. You meet it as the default route in a routing table and as "allow from anywhere" in a firewall rule, where it deserves a second look.
Where blocks are allowed to start
A block cannot begin wherever you like. It must start on a multiple of its own size, which is what makes the arithmetic tractable.
/26 blocks are 64 addresses, so they start at: .0 .64 .128 .192 valid .32 .100 not valid, not multiples of 64
This is why the fast way to answer "which network does this address belong to" is to work out the block size and then find which multiple of it the address falls between. It is also why VLSM allocates the largest subnets first: put a small one down in the wrong place and the boundary a large one needs is no longer free.
CIDR in IPv6
Identical idea, larger numbers. An IPv6 address is 128 bits, so prefixes run to /128. The conventions differ from IPv4 in one way worth knowing: /64 is the standard size for a single network segment, and you are usually assigned a /56 or /48 for a whole site.
Host counting stops being meaningful. A single /64 holds 18 quintillion addresses, which is more than the entire IPv4 internet squared. Nobody subnets an IPv6 network to conserve addresses; they subnet it for structure.