The problem CIDR solves

Every device on an IP network needs an address. In IPv4, that address is 32 bits, usually written as four numbers from 0 to 255 separated by dots, like 192.168.1.10. The hard question is never "what is one address" but "how do I describe a range of addresses that belong together", a single office, a subnet, a customer allocation. (Classless Inter-Domain Routing) notation is the compact way to write that range.

The "classless" part is the history. IPv4 started with three fixed sizes of network, classes A, B and C, and by the early 1990s they were failing in three ways at once. The CIDR specification lists them: "Exhaustion of the Class B network address space", because "Class C, with a maximum of 254 host addresses, is too small, whereas Class B, which allows up to 65534 host addresses, is too large for most organizations"; "Growth of routing tables in Internet routers beyond the ability of current software, hardware, and people to effectively manage"; and "Eventual exhaustion of the 32-bit IPv4 address space". The first two were expected to "become critical sometime between 1993 and 1995" (RFC 4632, section 2).

CIDR was published in September 1993 as 1518 and RFC 1519, and restated in 2006 as RFC 4632, after "more than twelve years" of deployment. Its aim was modest and exact: "to slow the growth of global routing tables and to reduce the rate of consumption of IPv4 address space". It "did not and does not attempt to solve the third problem", the exhaustion of IPv4 itself, for which it meant only to buy time "while progress is made on a longer-term solution" (RFC 4632, sections 1 and 2).

From classes to prefixes

The change is one idea: say explicitly how many bits are the network, instead of letting the first bits of the address imply it. As the specification defines it, "In CIDR notation, a prefix is shown as a 4-octet quantity, just like a traditional IPv4 address or network number, followed by the '/' (slash) character, followed by a decimal value between 0 and 32 that describes the number of significant bits" (RFC 4632, section 3.1). The old classes fit into it as special cases: "the legacy 'Class B' network 172.16.0.0, with an implied network mask of 255.255.0.0, is defined as the prefix 172.16.0.0/16" (as above).

What the slash buys is freedom of size: "Where formerly only three network sizes were available, prefixes may be defined to describe any power of two-sized block of between one and 2^32 end system addresses" (as above).

Reading the slash

A CIDR block looks like 192.168.1.0/24. The part after the slash, the prefix length, is the single most important number. It says: the first N bits of the address are fixed, and the rest are free to vary.

  • /24 means the first 24 bits are the fixed network part. The remaining 8 bits (32 − 24) identify individual hosts.
  • 8 free bits give 2⁸ = 256 possible combinations, so 192.168.1.0/24 describes the 256 addresses from 192.168.1.0 to 192.168.1.255.

Change the prefix and the block size changes with it. A smaller prefix means more free bits and a larger block:

  • /16 fixes 16 bits, leaves 16 free → 65,536 addresses.
  • /25 fixes 25 bits, leaves 7 free → 128 addresses.
  • /30 fixes 30 bits, leaves 2 free → 4 addresses.

Each step of one in the prefix length halves or doubles the block. That single rule is the whole intuition.

Every common prefix, with its mask

The prefix length and the dotted subnet mask say the same thing: a mask has as many leading 1 bits as the prefix length, then zeros. Devices still ask for one or the other, so both are worth reading at sight.

PrefixMaskAddressesUsable hosts
/8255.0.0.016,777,21616,777,214
/16255.255.0.065,53665,534
/20255.255.240.04,0964,094
/22255.255.252.01,0241,022
/23255.255.254.0512510
/24255.255.255.0256254
/25255.255.255.128128126
/26255.255.255.1926462
/27255.255.255.2243230
/28255.255.255.2401614
/29255.255.255.24886
/30255.255.255.25242
/31255.255.255.25422, on a point-to-point link
/32255.255.255.25511, a single host

Every octet of a mask can only take nine values (0, 128, 192, 224, 240, 248, 252, 254, 255), because the 1 bits must be contiguous. A mask such as 255.255.255.200 is not a valid CIDR mask at all.

Network, broadcast, and usable hosts

Within most blocks, two addresses are special and not assignable to a host:

  • The network address is the first address in the block, all host bits set to 0 (192.168.1.0 for a /24). It names the block itself.
  • The broadcast address is the last address, all host bits set to 1 (192.168.1.255). Traffic sent here reaches every host in the block.

So a /24 has 256 total addresses but 254 usable for actual hosts. The "usable hosts" figure is simply total minus those two reserved addresses.

Two edge cases break this pattern, both deliberately:

  • A /31 is used for point-to-point links between two routers. RFC 3021 introduced it "to halve the amount of address space assigned to point-to-point links", and on such a link "the two addresses above MUST be interpreted as host addresses" (RFC 3021): there is no room for a separate network and broadcast address, and none is needed for a link with exactly two ends.
  • A /32 is a single address, a host route. It describes exactly one machine.

Why aggregation was the point

The notation is the visible half of CIDR; aggregation is the reason for it. Because a prefix can be any power-of-two size, one short prefix can stand for many longer ones, and a router that once needed a route per network needs one route per block. RFC 4632 puts it bluntly: "The only commonly understood method for reducing routing state on a packet-switched network is through aggregation of information." For a customer of a single provider it is simple: "No explicit route is needed for the end site; the service provider advertises a single aggregate route for the larger block" (RFC 4632, section 4.1).

That is the same arithmetic as subnetting run in the other direction: shorten the prefix and the block covers its neighbours. Supernetting and aggregation and route summarisation work through it, and the article on longest prefix match shows how a router chooses when a short aggregate and a longer, more specific route both match.

The same slash in IPv6

IPv6 kept the notation. "The text representation of IPv6 address prefixes is similar to the way IPv4 address prefixes are written in Classless Inter-Domain Routing (CIDR) notation", written ipv6-address/prefix-length, where the prefix length "is a decimal value specifying how many of the leftmost contiguous bits of the address comprise the prefix" (RFC 4291, section 2.3). Only the scale changes: 128 bits instead of 32, and since most unicast "Interface IDs are required to be 64 bits long" (RFC 4291, section 2.5.1), an ordinary IPv6 subnet is a /64. IPv6 subnetting covers it.

Why this is worth understanding

Prefix length governs how networks are designed, how routes are summarised, and how address space is handed out. When you see 10.0.0.0/8 in a routing table or 0.0.0.0/0 as a default route, you are reading the same notation: a base address plus a prefix length that says how much of it is fixed. The arithmetic never changes, only the numbers.

You can try any block in the CIDR calculator to see its network address, broadcast address, mask, and usable host count computed instantly, entirely in your browser.

What to remember

  • A CIDR prefix is an address plus the number of leading bits that are fixed; the rest number the hosts.
  • CIDR replaced the three classes in 1993 to slow routing-table growth and address consumption, not to end IPv4 exhaustion.
  • Each step in prefix length halves or doubles the block; a mask has as many leading 1 bits as the prefix length.
  • An ordinary block loses two addresses to network and broadcast; a /31 link keeps both, a /32 is one host.
  • Aggregation, one short prefix standing for many long ones, is what CIDR was for; IPv6 writes prefixes the same way.

Sources