- What CIDR Is and Why It Was Introduced
- How CIDR Notation Represents Network Boundaries
- How CIDR Blocks Are Allocated Across the Internet
- CIDR Route Aggregation and Its Effect on Routing Tables
- How CIDR Longest-Prefix Matching Determines Routing Decisions
- CIDR in IPv6 Networks
- CIDR in Cloud Network Architecture
- CIDR in Security Policy Configuration
- Key Takeaways
- Frequently Asked Questions
CIDR (Classless Inter-Domain Routing) is a method for allocating IP addresses and routing internet traffic that replaced the rigid class-based system in 1993, allowing flexible network sizes and efficient route aggregation.
At the start of my networking career, I spent two hours trying to fix an issue caused by an IP address block error. I’d configured an entire /29 subnet as a single IP on a host. In my mind, host addresses were all pretty much the same anyway.
By making this error in a /24 subnet, I effectively reduced 242 usable host addresses down to just 26. This happened because I didn’t fully understand how the prefix length translates into usable hosts. Re-doing that task a second and third time taught me more about CIDR than any course material ever could.
These mistakes didn’t just clarify the problem for me; they also showed me that routing errors can escalate from an individual network engineer’s mistake into a full-blown outage on a massive scale.
What CIDR Is and Why It Was Introduced
CIDR (Classless Inter-Domain Routing) is a method used to allocate and route IP addresses. It replaced the old class-based addressing system in 1993. The Internet Engineering Task Force (IETF) introduced and standardized CIDR through RFC 1519 to address two major problems: the rapid shortage of IPv4 addresses and the growing size of routing tables on internet backbone routers.
CIDR eliminated the fixed class boundaries by allowing the division between the network and host portions of an IP address to be placed at any bit position. This made it possible to create address blocks that closely matched an organization’s actual requirements instead of forcing it to use the nearest available class.
Before CIDR, the classful addressing system divided IP addresses into three fixed classes. Class A provided more than 16 million host addresses, Class B provided 65,534, and Class C provided 254. There were no options between these fixed class sizes.
For example, an organization that needed addresses for 50 hosts couldn’t receive a block that closely matched its requirements. Instead, it had to use a Class C block, which provided 254 addresses and left many addresses unused. When this happened across thousands of organizations, a significant number of IP addresses were wasted, contributing to the rapid depletion of the available IPv4 address space.
How CIDR Notation Represents Network Boundaries
CIDR notation expresses a network address and its prefix length in a compact format: an IP address followed by a forward slash and a number. The address 192.168.1.0/24 represents a network where the first 24 bits identify the network and the remaining 8 bits are available for host addresses.
With 8 host bits, the block contains 256 total addresses. Two are reserved—one for the network address and one for the directed broadcast address—leaving 254 usable host addresses. The prefix length determines both the size of the network and the number of usable hosts.
A reduction of one in the prefix length doubles the address space. A /23 block contains twice as many addresses as a /24. An increase of one halves it—a /25 contains half as many addresses as a /24. Common prefix lengths and their corresponding usable host counts include:
- /24 — 254 usable hosts
- /25 — 126 usable hosts
- /26 — 62 usable hosts
- /27 — 30 usable hosts
- /28 — 14 usable hosts
- /29 — 6 usable hosts
- /30 — 2 usable hosts, used for point-to-point links
The equivalent subnet mask for any prefix can be derived by setting the first n bits to 1 and the remaining bits to 0, then converting to decimal. A /24 prefix corresponds to a subnet mask of 255.255.255.0. A /25 corresponds to 255.255.255.128. Both representations carry the same information; CIDR notation is more compact and is the current standard.
How CIDR Blocks Are Allocated Across the Internet
A CIDR block is a contiguous range of IP addresses that shares the same network prefix. The allocation of CIDR blocks follows a defined hierarchy, starting from the global authority and continuing down to individual organizations.
The Internet Assigned Numbers Authority (IANA) manages the global IPv4 and IPv6 address space and is responsible for allocating large address blocks to Regional Internet Registries (RIRs). There are five RIRs operating around the world: ARIN serves North America, RIPE NCC serves Europe and the Middle East, APNIC serves the Asia-Pacific region, LACNIC serves Latin America and the Caribbean, and AFRINIC serves Africa.
Each RIR allocates smaller address blocks to Local Internet Registries (LIRs). Internet Service Providers (ISPs) typically receive these blocks and further divide them before assigning addresses to businesses and individual customers.
Organizations that rely on ISPs for connectivity can obtain provider-independent address blocks directly from their regional Internet registry. Provider-independent addressing means that an organization’s IP address space isn’t tied to a specific ISP, allowing it to maintain its routing through other ISPs if one provider fails. Managing provider-independent address space requires more administrative work, but the operational flexibility it provides can be important for organizations where reliable internet connectivity is critical.
CIDR Route Aggregation and Its Effect on Routing Tables
CIDR enables route aggregation, which combines multiple smaller networks into a single larger prefix for routing purposes. Along with address conservation, this capability is one of the key reasons CIDR was introduced.
Without route aggregation, every organization would require a separate entry in the routing tables of backbone routers. As the internet continued to grow, the number of routing entries would increase without limit. Eventually, the size of the routing tables could exceed the processing capacity of available routing hardware.
CIDR allows ISPs to advertise a single summary route covering multiple customers instead of maintaining a separate route for each customer. This keeps routing tables smaller and makes internet routing more scalable.
Consider an ISP that has the address blocks 192.168.0.0/24 and 192.168.1.0/24. Both blocks can be summarized as 192.168.0.0/23. Instead of advertising both /24 blocks separately, the ISP can advertise only 192.168.0.0/23 to its upstream provider. This single routing entry represents both /24 networks. The upstream router then forwards all traffic destined for the /23 range toward the ISP, which uses its own routing table to route the traffic to the appropriate /24 network.
The Border Gateway Protocol (BGP), which handles routing between autonomous systems across the internet, relies heavily on route aggregation. As a result, BGP routing tables are significantly smaller than they would be without aggregation, reducing the processing load on backbone routers.
How CIDR Longest-Prefix Matching Determines Routing Decisions
When a packet arrives at a router, the router compares the destination address with all the available routing prefixes in its routing table to determine where the packet should be forwarded.
In a CIDR-based routing table, a destination address can match multiple routing prefixes. For example, both a /16 summary route and a more specific /24 route may match the same destination. In such cases, the router uses the more specific /24 route.
Routers resolve this ambiguity through longest prefix matching. When multiple entries match, the entry with the longest prefix length is selected as the most specific match. A /24 entry is always preferred over a /16 entry when both match because a 24-bit network prefix provides a more accurate representation of the destination network than a 16-bit prefix.
This enables hierarchical routing. Upstream routers use summarized routes for address ranges, while downstream routers maintain more specific routes for individual subnets within those ranges. Traffic follows the summary route until it reaches a router with more specific routes. It then follows the specific route to its destination.
CIDR in IPv6 Networks
CIDR applies to IPv6 in the same way as it does to IPv4, with the difference that IPv6 addresses are 128 bits long instead of 32 bits. An IPv6 CIDR address such as 2001:db8::/32 indicates that the first 32 bits identify the network prefix.
The standard subnet mask for a typical IPv6 network segment is /64, leaving 64 bits for host addresses. A 64-bit host portion can accommodate approximately 18.4 quintillion addresses. At this scale, the address exhaustion problem that led to the creation of CIDR for IPv4 doesn’t apply to IPv6.
Route aggregation using CIDR principles remains relevant to IPv6. ISPs still combine customer address allocations into summary routes before advertising them to upstream providers. This helps limit the growth of BGP routing tables, while the longest prefix match principle continues to work in the same way across both protocols.
CIDR in Cloud Network Architecture
CIDR plays a major role in cloud network configuration. When creating a Virtual Private Cloud (VPC) in AWS, Azure, or Google Cloud, you need to specify a CIDR block to define the network’s address space. A commonly used choice is 10.0.0.0/16, which provides 65,536 addresses that can be further divided into smaller subnets.
Within a VPC, smaller CIDR blocks are assigned from the main range to create subnets. For example, from 10.0.0.0/16, one /24 subnet can be assigned to web resources, another /24 subnet to application resources, and a separate subnet to database infrastructure. Routing rules and security group policies reference these CIDR blocks to control which traffic can pass between the subnets.
I’ve personally seen problems arise from poor planning. During an initial setup, a team chose a /24 VPC because it seemed sufficient at the time. Eighteen months later, the project had grown and they ran out of available addresses. The only effective solution was to rebuild the VPC from scratch. Cloud providers generally don’t allow the primary CIDR block to be changed after creation without significant disruption. Planning the address space before deploying workloads—and keeping future growth in mind—can help avoid this situation entirely.
CIDR in Security Policy Configuration
CIDR notation is used in firewall rules, security groups, and access control lists to define the range of allowed or blocked traffic. A rule that allows traffic from 10.0.0.0/8 applies to any source address within that range, covering more than 16 million addresses. In contrast, a rule limited to 192.168.1.0/24 allows only the addresses within that specific subnet.
In CIDR notation, 0.0.0.0/0 represents every possible address. During an audit of a cloud infrastructure, we found three inbound security rules on a private service that were set to 0.0.0.0/0. Each of these rules was allowing connections from anywhere on the internet. None of them had been intentionally configured this way—they’d been set during testing and were never restricted afterward. Once we realized what was happening, it took only a few minutes to identify these rules and just seconds to correct them. The potential risk they created was very serious.
In security configuration, this notation makes it easy to identify the number and range of addresses covered by a specific CIDR prefix. From an access control perspective, there’s a major difference between allowing only 192.168.1.5/32 and allowing the entire 192.168.1.0/24 subnet. CIDR notation makes this difference clear.
For manufacturing environments, this matters even more. When I audit OT networks for cybersecurity compliance, I often find firewall rules that are far too permissive. A PLC network shouldn’t accept traffic from 0.0.0.0/0. Period.
Key Takeaways
- CIDR replaced classful addressing: It eliminated fixed Class A/B/C boundaries, allowing flexible network sizes that match actual organizational needs.
- Prefix length determines everything: The /n notation tells you exactly how many host addresses are available—subtract the prefix from 32, raise 2 to that power, then subtract 2.
- Route aggregation saves the internet: Summarizing multiple smaller prefixes into a single larger one keeps BGP routing tables manageable.
- Longest prefix match wins: When multiple routes match a destination, the most specific one (/24 beats /16) is always selected.
- Plan for growth in cloud VPCs: Choose a larger initial CIDR block than you think you need—rebuilding a VPC is painful.
- Security rules need tight CIDR ranges:
0.0.0.0/0in a firewall rule is a red flag, not a shortcut.
Frequently Asked Questions
What is the difference between a subnet mask and a CIDR prefix length?
Both represent the same boundary between network and host portions of an IP address, expressed in different formats. A CIDR prefix of /24 and a subnet mask of 255.255.255.0 convey identical information. CIDR notation is more compact and is the current standard format. Subnet masks remain in use in some older documentation and device interfaces. Any prefix length can be converted to its corresponding subnet mask by setting the first n bits to 1 and the remaining bits to 0, then converting each 8-bit group to its decimal equivalent.
How is the number of usable hosts in a CIDR block calculated?
Subtract the prefix length from 32 to determine the number of host bits. Raise 2 to that power to get the total number of addresses in the block, then subtract 2—one for the network address and one for the directed broadcast address. For a /26: 32 minus 26 equals 6 host bits; 2 to the 6th power is 64 total addresses; 64 minus 2 gives 62 usable hosts. For a /30: 2 host bits; 4 total addresses; 2 usable hosts. The /30 is the minimum usable subnet for a point-to-point link.
Why does CIDR use longest-prefix matching rather than first-match or best-match rules?
Longest-prefix matching selects the most specific applicable route, which is the route that most precisely identifies the destination network. This specificity enables hierarchical routing—summary routes covering large address ranges coexist with more specific routes for subnets within those ranges, and more specific routes are always selected over less specific ones. Without longest-prefix matching, more specific internal routes could not override summary routes, and traffic could not be delivered to specific subnets within a summarized range.
Is CIDR still relevant with IPv6 widely available?
Yes. CIDR notation is used to define IPv6 prefixes, and route aggregation using CIDR principles is essential to keeping global BGP routing tables manageable in IPv6 as well as IPv4. The /64 standard for individual network segments and ISP prefix aggregation before upstream advertisement both apply the same CIDR logic that was developed for IPv4. IPv6 eliminates the address scarcity problem that originally motivated CIDR, but it does not eliminate the need for hierarchical allocation and route aggregation.
Sarah Okafor is a manufacturing IT architect and industrial cybersecurity specialist with 10 years of experience in MES integration, digital twin deployment, and OT network security. She has led Industry 4.0 transformations at two Fortune 500 manufacturers and holds CISSP, AWS Industrial, and Siemens Opcenter certifications.
