CIDR Notation
CIDR (Classless Inter-Domain Routing) is the modern method for specifying IP addresses and their associated routing prefix. It replaced the old "classful" addressing system (Class A, B, C) and allows for more flexible and efficient allocation of IP addresses. Understanding CIDR is essential for network design, subnetting, security configurations, and penetration testing.
What You'll Learn
- What CIDR notation is and why it was created
- How to read and write CIDR notation
- Converting between CIDR, subnet masks, and binary
- Calculating network ranges from CIDR blocks
- Practical CIDR applications in networking and security
- CIDR in cloud computing (AWS, Azure, GCP)
- Tools for working with CIDR
What Is CIDR?
CIDR (pronounced "cider" or "C-I-D-R") is a method for representing IP addresses along with their network prefix length.
Format:
IP_ADDRESS/PREFIX_LENGTH
Examples:
192.168.1.0/24
10.0.0.0/8
172.16.0.0/16
The Notation:
192.168.1.0/24
│ │
│ └─ Prefix length (network bits)
└──────────── Network address
/24 means "first 24 bits are the network"
Remaining 8 bits are for hosts
Why CIDR Was Created
The Old Way: Classful Addressing
Before CIDR (pre-1993):
Class A: 10.0.0.0 /8 (16 million addresses)
Class B: 172.16.0.0 /16 (65,536 addresses)
Class C: 192.168.1.0 /24 (256 addresses)
Problems:
- Wasteful: Need 500 addresses? Get 65,536 (Class B)
- Inflexible: Can't get exactly what you need
- IPv4 exhaustion accelerated
The New Way: CIDR (1993+)
/24 = 256 addresses
/25 = 128 addresses
/26 = 64 addresses
/27 = 32 addresses
...
/30 = 4 addresses
Flexible! Get exactly what you need.
Reading CIDR Notation
Breaking Down: 192.168.1.0/24
IP Address: 192.168.1.0
Prefix: /24
/24 means:
- First 24 bits = network portion
- Last 8 bits = host portion
- Subnet mask: 255.255.255.0
- Total addresses: 2^8 = 256
- Usable hosts: 254 (minus network and broadcast)
Binary View:
192.168.1.0/24
Binary:
11000000.10101000.00000001.00000000
└────────────24 bits ────┘└8 bits─┘
Network portion Host portion
CIDR to Subnet Mask Conversion
Common CIDR Notations:
CIDR Subnet Mask Binary (ones in mask)
──────────────────────────────────────────────────────────
/8 255.0.0.0 11111111.00000000.00000000.00000000
/16 255.255.0.0 11111111.11111111.00000000.00000000
/24 255.255.255.0 11111111.11111111.11111111.00000000
/25 255.255.255.128 11111111.11111111.11111111.10000000
/26 255.255.255.192 11111111.11111111.11111111.11000000
/27 255.255.255.224 11111111.11111111.11111111.11100000
/28 255.255.255.240 11111111.11111111.11111111.11110000
/29 255.255.255.248 11111111.11111111.11111111.11111000
/30 255.255.255.252 11111111.11111111.11111111.11111100
/31 255.255.255.254 11111111.11111111.11111111.11111110 (point-to-point)
/32 255.255.255.255 11111111.11111111.11111111.11111111 (single host)
Complete Reference Table:
/1 = 2,147,483,648 addresses /17 = 32,768 addresses
/2 = 1,073,741,824 /18 = 16,384
/3 = 536,870,912 /19 = 8,192
/4 = 268,435,456 /20 = 4,096
/5 = 134,217,728 /21 = 2,048
/6 = 67,108,864 /22 = 1,024
/7 = 33,554,432 /23 = 512
/8 = 16,777,216 /24 = 256
/9 = 8,388,608 /25 = 128
/10 = 4,194,304 /26 = 64
/11 = 2,097,152 /27 = 32
/12 = 1,048,576 /28 = 16
/13 = 524,288 /29 = 8
/14 = 262,144 /30 = 4
/15 = 131,072 /31 = 2 (point-to-point)
/16 = 65,536 /32 = 1 (single host)
Calculating Network Information from CIDR
Example 1: 192.168.1.0/24
CIDR: /24
Host bits: 32 - 24 = 8
Total addresses: 2^8 = 256
Network address: 192.168.1.0
First usable: 192.168.1.1
Last usable: 192.168.1.254
Broadcast address: 192.168.1.255
Subnet mask: 255.255.255.0
Usable hosts: 254
Example 2: 10.0.0.0/16
CIDR: /16
Host bits: 32 - 16 = 16
Total addresses: 2^16 = 65,536
Network address: 10.0.0.0
First usable: 10.0.0.1
Last usable: 10.0.255.254
Broadcast address: 10.0.255.255
Subnet mask: 255.255.0.0
Usable hosts: 65,534
Example 3: 172.16.5.64/26
CIDR: /26
Host bits: 32 - 26 = 6
Total addresses: 2^6 = 64
Network address: 172.16.5.64
First usable: 172.16.5.65
Last usable: 172.16.5.126
Broadcast address: 172.16.5.127
Subnet mask: 255.255.255.192
Usable hosts: 62
Practical CIDR Examples
/32 - Single Host
192.168.1.50/32
Only ONE address: 192.168.1.50
No network, no broadcast
Used for:
- Host routes
- Firewall rules for specific IPs
- /etc/hosts entries
/31 - Point-to-Point Links
10.0.0.0/31
Two addresses:
10.0.0.0 (usable)
10.0.0.1 (usable)
No network or broadcast (special case)
Used for:
- Router-to-router links
- Saves IP addresses
/30 - Point-to-Point (Traditional)
192.168.1.0/30
Four addresses:
192.168.1.0 = Network
192.168.1.1 = First usable
192.168.1.2 = Second usable
192.168.1.3 = Broadcast
Used for:
- Router connections
- WAN links
- Minimal waste
/29 - Small Subnet
192.168.1.8/29
Eight addresses, 6 usable:
192.168.1.8 = Network
192.168.1.9 = Usable
192.168.1.10 = Usable
192.168.1.11 = Usable
192.168.1.12 = Usable
192.168.1.13 = Usable
192.168.1.14 = Usable
192.168.1.15 = Broadcast
Used for:
- Small office
- DMZ with few servers
/24 - Typical Small Network
192.168.1.0/24
256 addresses, 254 usable
Classic "Class C" equivalent
Used for:
- Home networks
- Small businesses
- Department networks
/16 - Medium Network
10.10.0.0/16
65,536 addresses, 65,534 usable
Classic "Class B" equivalent
Used for:
- Large campuses
- Enterprise departments
- Cloud VPCs (AWS, Azure)
/8 - Huge Network
10.0.0.0/8
16,777,216 addresses
Classic "Class A" equivalent
Used for:
- Entire corporate networks
- ISPs
- Large cloud providers
CIDR in Security and Pentesting
1. Firewall Rules
# Allow traffic from entire /24 network
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
# Block entire /16 network
iptables -A INPUT -s 10.20.0.0/16 -j DROP
# Allow specific /32 (single host)
iptables -A INPUT -s 192.168.1.100/32 -j ACCEPT
2. Nmap Scanning
# Scan entire /24 network
nmap 192.168.1.0/24
# Scan /16 (might take a while!)
nmap 10.0.0.0/16
# Scan smaller subnet
nmap 192.168.1.0/26
3. AWS Security Groups
# Allow SSH from specific CIDR block
Type: SSH
Protocol: TCP
Port: 22
Source: 192.168.1.0/24
# Allow HTTPS from anywhere
Type: HTTPS
Protocol: TCP
Port: 443
Source: 0.0.0.0/0
4. VPN and Network Access
# OpenVPN server config
server 10.8.0.0 255.255.255.0
# Same as: 10.8.0.0/24
push "route 192.168.1.0 255.255.255.0"
# Same as: push "route 192.168.1.0/24"
CIDR in Cloud Computing
AWS VPC:
VPC CIDR: 10.0.0.0/16 (65,536 addresses)
Subnets:
Public subnet: 10.0.1.0/24 (256 addresses)
Private subnet: 10.0.2.0/24 (256 addresses)
Database subnet: 10.0.3.0/24 (256 addresses)
Rules:
- Subnets must be within VPC CIDR
- Subnets cannot overlap
- /28 is smallest allowed subnet
Azure Virtual Network:
VNet: 10.1.0.0/16
Subnets:
Web tier: 10.1.1.0/24
App tier: 10.1.2.0/24
Data tier: 10.1.3.0/24
Google Cloud:
VPC: 10.128.0.0/9
Subnet (auto mode):
10.128.0.0/20 (us-central1)
10.132.0.0/20 (europe-west1)
10.140.0.0/20 (asia-east1)
Subnetting with CIDR
Example: Split /24 into /26 subnets
Start: 192.168.1.0/24 (256 addresses)
Goal: 4 subnets of 64 addresses each
/26 = 64 addresses per subnet
Subnet 1: 192.168.1.0/26 (192.168.1.0 - 192.168.1.63)
Subnet 2: 192.168.1.64/26 (192.168.1.64 - 192.168.1.127)
Subnet 3: 192.168.1.128/26 (192.168.1.128 - 192.168.1.191)
Subnet 4: 192.168.1.192/26 (192.168.1.192 - 192.168.1.255)
Example: Split /22 into /24 subnets
Start: 10.0.0.0/22 (1024 addresses)
Goal: 4 subnets of 256 addresses each
/24 = 256 addresses per subnet
Subnet 1: 10.0.0.0/24 (10.0.0.0 - 10.0.0.255)
Subnet 2: 10.0.1.0/24 (10.0.1.0 - 10.0.1.255)
Subnet 3: 10.0.2.0/24 (10.0.2.0 - 10.0.2.255)
Subnet 4: 10.0.3.0/24 (10.0.3.0 - 10.0.3.255)
Tools for Working with CIDR
ipcalc:
# Install
sudo apt install ipcalc # Debian/Ubuntu
brew install ipcalc # macOS
# Calculate network information
ipcalc 192.168.1.0/24
# Output:
Address: 192.168.1.0 11000000.10101000.00000001.00000000
Netmask: 255.255.255.0 = 24 11111111.11111111.11111111.00000000
Wildcard: 0.0.0.255 00000000.00000000.00000000.11111111
Network: 192.168.1.0/24 11000000.10101000.00000001.00000000
HostMin: 192.168.1.1 11000000.10101000.00000001.00000001
HostMax: 192.168.1.254 11000000.10101000.00000001.11111110
Broadcast: 192.168.1.255 11000000.10101000.00000001.11111111
Hosts/Net: 254
sipcalc:
# Install
sudo apt install sipcalc
# More detailed output
sipcalc 10.0.0.0/16
# Subnet splitting
sipcalc 192.168.1.0/24 -s 26
Python:
import ipaddress
# Create network object
network = ipaddress.ip_network('192.168.1.0/24')
print(f"Network: {network.network_address}")
print(f"Broadcast: {network.broadcast_address}")
print(f"Netmask: {network.netmask}")
print(f"Num addresses: {network.num_addresses}")
# List all hosts
for ip in network.hosts():
print(ip)
# Check if IP is in network
ip = ipaddress.ip_address('192.168.1.50')
print(ip in network) # True
Online Calculators:
CIDR Quick Reference
Powers of 2:
2^1 = 2 2^9 = 512 2^17 = 131,072
2^2 = 4 2^10 = 1,024 2^18 = 262,144
2^3 = 8 2^11 = 2,048 2^19 = 524,288
2^4 = 16 2^12 = 4,096 2^20 = 1,048,576
2^5 = 32 2^13 = 8,192 2^21 = 2,097,152
2^6 = 64 2^14 = 16,384 2^22 = 4,194,304
2^7 = 128 2^15 = 32,768 2^23 = 8,388,608
2^8 = 256 2^16 = 65,536 2^24 = 16,777,216
Subnet Cheat Sheet:
/30 = 4 addresses (2 usable) - Point-to-point
/29 = 8 addresses (6 usable) - Small office
/28 = 16 addresses (14 usable)
/27 = 32 addresses (30 usable)
/26 = 64 addresses (62 usable)
/25 = 128 addresses (126 usable)
/24 = 256 addresses (254 usable) - Common home/business
/23 = 512 addresses (510 usable)
/22 = 1024 addresses (1022 usable)
/21 = 2048 addresses (2046 usable)
/20 = 4096 addresses (4094 usable)
Try It Yourself
Exercise 1: Calculate Network Info
Given: 172.16.50.0/22
Find:
- Subnet mask
- Network address
- Broadcast address
- Usable host range
- Number of usable hosts
# Use ipcalc
ipcalc 172.16.50.0/22
Answer
Subnet mask: 255.255.252.0
Network: 172.16.48.0
Broadcast: 172.16.51.255
Usable range: 172.16.48.1 - 172.16.51.254
Usable hosts: 1022
Exercise 2: Split a Network
Given: 10.0.0.0/24
Task: Split into 4 equal subnets
Answer
Need /26 subnets (64 addresses each)
10.0.0.0/26 (10.0.0.0 - 10.0.0.63)
10.0.0.64/26 (10.0.0.64 - 10.0.0.127)
10.0.0.128/26 (10.0.0.128 - 10.0.0.191)
10.0.0.192/26 (10.0.0.192 - 10.0.0.255)
Exercise 3: CIDR Scanning
# Scan your home network
# Find your network:
ip addr show # Linux
ipconfig # Windows
# Example: 192.168.1.0/24
nmap -sn 192.168.1.0/24
# How many hosts are up?
Common Mistakes
1. Wrong Network Address
❌ Wrong: 192.168.1.10/24
✅ Correct: 192.168.1.0/24
The network address has all host bits set to 0
2. Overlapping Subnets
❌ Wrong:
Subnet 1: 10.0.0.0/24
Subnet 2: 10.0.0.128/25 (overlaps!)
✅ Correct:
Subnet 1: 10.0.0.0/25 (10.0.0.0 - 10.0.0.127)
Subnet 2: 10.0.0.128/25 (10.0.0.128 - 10.0.0.255)
3. Not Aligning to Boundaries
❌ Wrong: 192.168.1.5/26
✅ Correct: 192.168.1.0/26 or 192.168.1.64/26
/26 boundaries: 0, 64, 128, 192
Resources
Tools:
- ipcalc: CLI CIDR calculator
- sipcalc: Advanced subnet calculator
- Python ipaddress: Library for IP calculations
- netmask: Another CLI tool
Reading:
Practice:
- SubnettingPractice.com
- Calculate subnets daily
- Design network architectures using CIDR
Next Steps
- Master CIDR calculations without tools
- Practice subnetting various network sizes
- Use CIDR in firewall rules and security groups
- Design cloud networks with proper CIDR blocks
- Understand supernetting (route aggregation)
CIDR is fundamental to modern networking. Master it, and you'll be able to design efficient networks, write effective firewall rules, and understand network reconnaissance results!
"CIDR: Because /24 is better than saying '255.255.255.0'"