What Is a CIDR Block? Notation Explained
A CIDR block is a range of IP addresses written as a base address and a prefix length, such as 192.168.1.0/24, where the number after the slash says how many leading bits are fixed to identify the network. CIDR stands for Classless Inter-Domain Routing, and it is how networks are described in routing tables, firewall rules and cloud security groups.
How to read CIDR notation
An IPv4 address has 32 bits. In 192.168.1.0/24, the /24 means the first 24 bits are the network part and the remaining 8 bits are free to identify hosts inside it. Those 8 free bits give 2^8 = 256 addresses, running from 192.168.1.0 to 192.168.1.255. The rule works for any prefix: the block size is 2 raised to (32 minus the prefix length).
/8fixes one octet and holds 16,777,216 addresses, for example10.0.0.0/8./16fixes two octets and holds 65,536 addresses, for example172.16.0.0/16./24holds 256 addresses, and/32is exactly one address./0is every address, which you will see as0.0.0.0/0meaning "anywhere" in firewall rules.
The older subnet mask form says the same thing. A /24 equals 255.255.255.0, a /16 equals 255.255.0.0, and /20 equals 255.255.240.0. For IPv6 the same idea applies to 128 bits, so 2001:db8::/32 fixes the first 32 bits.
Why CIDR replaced classful addressing
Before CIDR, addresses were divided into fixed classes: A, B and C, with prefixes of /8, /16 and /24. An organization needing 2,000 addresses had to take a class B with 65,536, wasting most of it, or several class Cs, bloating routing tables. CIDR allows any prefix length, so a /21 (2,048 addresses) can be allocated precisely. It also lets neighbouring blocks be summarized: two adjacent /24s that align on a boundary can be announced as one /23, which keeps global routing tables smaller.
Alignment and usable addresses
A block must start on a boundary that fits its size. A /24 must begin at an address whose last octet is 0; a /22 must begin at a multiple of 4 in the third octet, such as 10.0.4.0/22. That is why 10.0.3.0/22 is not valid: it is not aligned and the tools will reject it or silently normalize it to the real boundary. In ordinary subnets the first address identifies the network and the last is the broadcast address, so a /24 offers 254 usable host addresses. Cloud providers often reserve several more per subnet, so check their rules before sizing.
Where you meet CIDR in practice
Firewalls and allow lists are the most common case. Allowing 203.0.113.0/24 permits 256 addresses with a single entry. The danger is being too broad: a /16 where a /24 was meant can permit tens of thousands of unrelated hosts. When you only know a single IP, finding the surrounding block is a research step, and some of it can be done with ipto. The IP range directory lets you browse the address space by /8 and /16 block, with a country and ASN breakdown for each. The ASN lookup shows the ranges attributed to a network, and the IP whois lookup returns the registered block through RDAP, which tells you the exact range an organization holds.
Reserved ranges are also expressed in CIDR. Private space such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, loopback 127.0.0.0/8 and link-local 169.254.0.0/16 should never appear as public sources. The bogon IP checker tells you whether an address falls in one of them, and the ipto IP lookup returns bogon and bogon_type fields for the same purpose.
Summarizing works in reverse too: to see whether two ranges can merge, check that they are the same size, adjacent, and that the first one starts on a boundary of the combined block. If either condition fails, you need two entries rather than one.
Common mistakes
- Confusing the base address with a host.
192.168.1.0/24describes the network, not a device. - Blocking a whole range because of one address. A single abusive host in a shared hosting block does not make the surrounding /24 hostile, and blocking it can hit innocent customers.
- Forgetting IPv6. A rule written only for IPv4 ranges leaves IPv6 traffic unfiltered.
For a quick sanity check, count the host bits, raise 2 to that power, and compare with what you expected. The API documentation shows how to fetch range data programmatically.