What is CIDR
The notation that turned IP addressing from a rigid grid into a flexible ruler
TL;DR | An Analogy
CIDR (Classless Inter-Domain Routing) is a way to describe a block of IP addresses as one address plus a prefix length — like saying 'the first 24 bits are fixed, the rest are yours to use'.
The idea
Before CIDR, IP addresses were carved into fixed classes (A, B, C) that wasted enormous amounts of address space. CIDR replaced that with a slash notation — 192.168.1.0/24 — where the number after the slash says how many leading bits identify the network. Everything else is host space. This lets networks be any size that's a power of two, and lets routers aggregate many routes into one entry.
Where it shows up
- System design interviews: Every VPC, subnet, and firewall rule question involves CIDR. You'll be asked to split a /16 into subnets for different tiers.
- On-call: Misconfigured security group rules (wrong CIDR) are a leading cause of 'why can't service A reach service B' incidents.
- Real systems: AWS VPCs, GCP VPC networks, Kubernetes pod CIDR and service CIDR, BGP route advertisements, and iptables rules all express ranges in CIDR notation.
- Zero-trust / firewall rules: Allowing
0.0.0.0/0vs10.0.0.0/8is the difference between open to the internet and restricted to your private network.
Read the detailed breakdown›
The mechanics
Binary first
An IPv4 address is 32 bits. 192.168.1.0 in binary is:
11000000.10101000.00000001.00000000
The /24 prefix means the first 24 bits are the network identifier — fixed. The remaining 8 bits are the host part — variable. That gives 2⁸ = 256 addresses: 192.168.1.0 through 192.168.1.255.
The subnet mask equivalence
/24 is exactly equivalent to the subnet mask 255.255.255.0 (24 ones followed by 8 zeros). CIDR just says the same thing in fewer characters.
Calculating the block
Given 10.0.4.0/22:
- Network bits: 22. Host bits: 10.
- Block size: 2¹⁰ = 1024 addresses.
- Range:
10.0.4.0–10.0.7.255. - Usable hosts (subtract network and broadcast): 1022.
The fast mental shortcut: block size = 2^(32 − prefix). The block always starts on a multiple of that block size.
Supernetting and route aggregation
CIDR's second job is collapsing many specific routes into one. If a provider owns 203.0.112.0/24 through 203.0.115.0/24, they can advertise a single 203.0.112.0/22 to the rest of the internet instead of four separate entries. When CIDR was standardized in 1993 it helped slow the explosive growth of the global BGP routing table that was occurring at the time.
Longest prefix match
When a router receives a packet, it matches the destination IP against all known prefixes and picks the most specific (longest) match. 10.0.0.5 matches both 10.0.0.0/8 and 10.0.0.0/24; the router uses /24 because it's longer. This rule governs every routing decision, from your home router to tier-1 ISPs.
IPv6
The same notation applies. 2001:db8::/32 reserves a block for documentation. A typical home gets a /56 or /48 prefix from their ISP, giving them 256 or 65536 /64 subnets respectively. The math is identical; the numbers are just bigger.
Private ranges to memorise
| CIDR | Addresses | Common use |
|---|---|---|
10.0.0.0/8 |
~16 M | Large private networks, VPCs |
172.16.0.0/12 |
~1 M | Docker bridge networks (draws from this range), some VPNs |
192.168.0.0/16 |
65536 | Home routers (They may also use a /24 in this range) |
127.0.0.0/8 |
— | Loopback |