Overview
CIDR (Classless Inter-Domain Routing) is the modern notation for describing networks and how their addresses are divided. The little /24 you see after an IP address is CIDR. Understanding it unlocks subnetting, firewall rules, and reading network configurations.
Learning objectives
- Define CIDR notation.
- Interpret a prefix length (the
/n). - Understand why CIDR replaced older address classes.
Core concept
CIDR notation writes a network as an address plus a prefix length: 192.168.1.0/24. The number after the slash — the prefix — is how many bits (from the left) form the network portion of the address. The remaining bits are the host portion.
/24means the first 24 bits are network, leaving 8 bits (32 − 24) for hosts.- A larger prefix (
/26) means more network bits and fewer host bits → a smaller network. - A smaller prefix (
/16) means fewer network bits and more hosts → a larger network.
How it works
CIDR replaced the old rigid "classes" (A/B/C) that forced networks into fixed sizes and wasted addresses. With CIDR, you can size a network to what you actually need by choosing any prefix length. Routers use the prefix to know how much of an address to match when deciding where to send traffic, and CIDR lets many networks be summarized (aggregated) into a single route, keeping routing tables manageable.
Practical example
10.0.0.0/8 describes a huge network (only 8 network bits, 24 host bits — millions of hosts). 192.168.1.0/24 describes a typical small LAN (24 network bits, 8 host bits — up to 254 usable hosts). 192.168.1.0/26 slices that further into a smaller network of about 62 usable hosts. The single /n value instantly tells you the network's size.
Cybersecurity relevance
CIDR is everywhere in security: firewall rules, access-control lists, and allow/deny lists are written in CIDR (e.g. "allow 10.0.0.0/8"). Reconnaissance and scanning target CIDR ranges. Misreading a prefix can accidentally expose or block far more (or fewer) hosts than intended, so fluency in CIDR prevents dangerous mistakes.
Common mistakes
- Thinking a bigger
/nmeans a bigger network — it is the opposite: bigger prefix = more network bits = smaller network. - Ignoring the prefix when writing firewall rules, unintentionally covering the wrong range.
Key takeaways
- CIDR notation is
address/prefix, where the prefix is the number of network bits. - A larger prefix means fewer hosts (smaller network); a smaller prefix means more hosts (larger network).
- CIDR replaced fixed classes, enabling right-sized networks and route aggregation; it is the language of firewall and ACL rules.
Check your understanding
- In
172.16.0.0/20, how many bits are network and how many are host? - Which is the larger network,
/24or/16, and why?