CIDR notation explained

Until 1993, the first bits of an IPv4 address determined its size. A first octet starting with 0 meant class A and 16,777,216 addresses; a first octet starting with 10 meant class B and 65,536 addresses; starting with 110 meant class C and 256 addresses. The boundaries were hard, and there was no way to ask for anything in between.

Two problems compounded. First, waste: an organisation that needed 2,000 addresses had to take a class B and leave 63,000 unused. Second, routing table growth: every class A, B or C allocation became a separate entry in the global routing table, regardless of its size.

CIDR removed the fixed boundaries and replaced them with an explicit prefix length. A network of 1,000 addresses is now a /22 — 1,024 addresses, 4% waste instead of 98%. Two consequences followed, and both were the point of the change.

• Efficient use of space. An allocation can be sized to the requirement rather than to the next class up, so the address space lasts far longer.
• Route aggregation. Because addresses are no longer tied to class boundaries, an ISP holding 203.0.112.0/21 can advertise one route for all eight of its /24s. Aggregation is what kept the global routing table manageable through the 1990s and is still what makes the internet scale today.

192.168.1.0/24
Prefix length    24
Subnet mask      255.255.255.0
Wildcard mask    0.0.0.255
Inverse form     192.168.1.0 0.0.0.255  (Cisco ACL syntax)

Counting bits from scratch is unnecessary once you know the last-octet sequence. Prefixes longer than /24 only ever involve the fourth octet, and the mask values follow a fixed progression.

The pattern is that each step adds one bit to the network portion, so the mask octet gains the next place value: 128, then 64, then 32, and so on. Reading /27 as 224 is a matter of recognising the sequence rather than doing arithmetic.

The reason a prefix length has to be a contiguous run of bits is that routers resolve ambiguity by choosing the longest matching prefix. Consider a router with three routes:

10.0.0.0/8        via 192.0.2.1
10.1.0.0/16       via 192.0.2.2
10.1.2.0/24       via 192.0.2.3

Destination 10.1.2.55 matches all three.
Longest match wins -> 10.1.2.0/24 via 192.0.2.3

This is what allows a specific exception to be carved out of a broad summary. The /8 carries most of the traffic; the /24 provides a more specific path for one subnet without needing to break the /8 into pieces. If masks could be non-contiguous, no single number would express specificity and the algorithm would fall apart.

• Routing tables. Every route is a prefix and a next hop. The default route is 0.0.0.0/0 and appears in every router's table.
• Firewall rules. Source and destination ranges are written as prefixes, and the choice of prefix directly determines how much traffic matches.
• Cloud networking. VPC and VNet address ranges are specified as CIDR blocks, and subnets are carved out of them — which means the prefix arithmetic determines whether your subnets fit at all.
• Vendor configuration. Interface addresses, OSPF network statements and route summarisation all use prefixes, and Cisco ACLs use the wildcard form of the same information.
• IPv6. The same notation applies with a range of /0 to /128, and a /64 — the standard subnet size — is so common that IPv6 subnetting is usually a question of how many /64s fit in an allocation rather than of masks.

• Writing an address that is not the network address. 192.168.1.5/24 is a valid notation but the network is 192.168.1.0/24. Most systems accept and normalise the first form, but it is misleading in documentation.
• Assuming a larger number means a larger network. /28 is smaller than /24. The number counts network bits, so more bits means fewer host addresses.
• Confusing the prefix with the mask. A /24 is not “24 hosts” — it is 24 network bits and 254 usable hosts. The two numbers are easy to transpose when reading quickly.
• Using a non-contiguous mask. 255.255.0.255 looks plausible but is invalid and cannot be expressed as a prefix length, so no router will accept it.