CIDR Notation Calculator and Guide

CIDR stands for Classless Inter-Domain Routing. It is a method of representing IP addresses and their associated network boundaries using a compact two-part notation: an IP address followed by a forward slash and a prefix length. For example, `192.168.1.0/24` means the network starts at `192.168.1.0` and has a 24-bit network prefix — the first 24 bits identify the network, and the remaining 8 bits identify individual hosts within it.

CIDR was introduced in 1993 to replace the original class-based addressing system — Class A (/8), Class B (/16), and Class C (/24) — which wasted enormous amounts of address space. A company that needed 300 addresses would receive a full Class B block with 65,536 addresses. CIDR allows any prefix length from /0 (the entire internet) to /32 (a single host address), allocating exactly the size needed.

IPv4 vs IPv6 CIDR

IPv4 CIDR uses 32-bit addresses and prefix lengths from /0 to /32. IPv6 CIDR uses 128-bit addresses and prefix lengths from /0 to /128. The arithmetic works identically — 2^(address-bits - prefix) gives the block size — but IPv6 addresses are written in hexadecimal with colon separators, such as `2001:db8::/32`. This guide focuses on IPv4, which is the format encountered in most infrastructure configurations today.

• Prefix length: The number after the slash (e.g., /24). Specifies how many leading bits are the network portion.
• Network address: The first IP in the block — all host bits are zero (e.g., 192.168.1.0 for /24).
• Broadcast address: The last IP in the block — all host bits are one (e.g., 192.168.1.255 for /24).
• Usable hosts: All addresses between network and broadcast — (2^host-bits - 2) addresses.
• Subnet mask: The binary representation of the prefix — /24 = 255.255.255.0.

Reading a CIDR block means extracting four pieces of information: the network address, the broadcast address, the usable host range, and the total address count. All four are derived mathematically from the two components of the notation — the IP address and the prefix length.

The prefix length tells you the block size

The prefix length directly tells you how many bits are fixed (network) and how many bits vary (hosts). For `10.0.0.0/8`: 8 bits are fixed, 24 bits vary. Host addresses: 2^24 = 16,777,216 total. For `172.16.0.0/12`: 12 bits fixed, 20 bits vary. Host addresses: 2^20 = 1,048,576 total. Shortcut: each increment in prefix length cuts the block size in half.

The IP address anchors the block

The IP address in a CIDR block is always the network address — the first address in the range. The network address has all host bits set to zero. If you encounter a CIDR block where the IP is not the network address (e.g., `192.168.1.5/24`), the actual network address is found by applying the subnet mask to the IP address with a bitwise AND: `192.168.1.5 AND 255.255.255.0 = 192.168.1.0`. The IP CIDR Range Quick Calculator normalises the input automatically and returns the correct network address.

The interpretation of a prefix is that it is a value that is expressed with the leftmost bits of the address being the most significant.

Calculating a CIDR range by hand requires binary arithmetic — but the process is systematic and predictable once you have done it a few times. These four steps apply to any CIDR block.

A handful of CIDR blocks appear repeatedly in network configurations, firewall rules, and cloud VPC setups. Recognising them by sight speeds up infrastructure work significantly.

Private network ranges (RFC 1918)

• 10.0.0.0/8: 16.7 million addresses. Class A private range — used for large enterprise networks and cloud VPCs that need massive address space.
• 172.16.0.0/12: 1 million addresses. Docker's default network range is 172.17.0.0/16, carved from this block.
• 192.168.0.0/16: 65,536 addresses. The standard home and small office range — almost every home router defaults to 192.168.1.0/24 or 192.168.0.0/24.
• 169.254.0.0/16: Link-local range. Automatically assigned when DHCP fails — seeing a 169.254.x.x address usually means a DHCP connectivity problem.
• 127.0.0.0/8: Loopback range. 127.0.0.1 is the standard loopback address; the entire /8 is reserved and never routed.

Special-purpose CIDR blocks

• 0.0.0.0/0: The default route — matches every IP address. Used in routing tables to forward all unmatched traffic to a gateway.
• x.x.x.x/32: Single host — used in firewall rules and BGP advertisements to target one specific IP address.
• x.x.x.x/31: Two-address block — RFC 3021 allows these for point-to-point links where no network/broadcast is needed.
• x.x.x.x/30: Four-address block (2 usable) — traditional point-to-point WAN link size, still common in router-to-router connections.

Cloud platforms use CIDR blocks for every network segmentation decision — VPCs, subnets, security groups, route tables, and peering connections all reference CIDR notation. Understanding the constraints of each platform prevents configuration errors that are time-consuming to diagnose and fix.

AWS VPC CIDR rules

AWS VPCs accept primary CIDR blocks between /16 (65,536 addresses) and /28 (16 addresses). AWS reserves 5 IP addresses per subnet — the network address, the VPC router (`x.x.x.1`), the DNS server (`x.x.x.2`), a future-use address (`x.x.x.3`), and the broadcast address. For a /28 subnet, only 11 of 16 addresses are usable. VPC CIDR blocks from different peered VPCs or on-premises networks must not overlap — CIDR range conflicts are the most common cause of VPC peering failures.

Kubernetes and container networking

Kubernetes uses CIDR blocks for three separate address spaces: the node network (physical or cloud subnet), the pod CIDR (each pod gets a unique IP), and the service CIDR (ClusterIP services). These three ranges must not overlap with each other or with any external network the cluster needs to communicate with. The default pod CIDR in many distributions is `10.244.0.0/16`; the default service CIDR is `10.96.0.0/12`. Docker uses `172.17.0.0/16` for its default bridge network.

Firewall and security group rules

Security groups and firewall rules use CIDR blocks to specify permitted source or destination ranges. `0.0.0.0/0` allows traffic from any IP — use this only for public-facing services. `10.0.0.0/8` restricts traffic to the private address range. `/32` entries target individual IPs for allowlisting specific servers or developer workstations. Use the DNS Record Validator alongside CIDR tools to verify that DNS resolution aligns with your intended IP ranges.

Subnetting is the process of dividing a larger CIDR block into smaller, non- overlapping blocks. This is how you create multiple subnets inside a VPC, assign separate ranges to different departments or availability zones, or carve out a dedicated block for management traffic.

The subnetting rule

Every time you increase the prefix length by 1, you split the block in half. A /24 block (256 addresses) becomes two /25 blocks (128 addresses each), or four /26 blocks (64 addresses each), or eight /27 blocks (32 addresses each). The subnets must be aligned — the starting address of each subnet must be a multiple of the block size. A /26 block contains 64 addresses, so valid /26 networks start at 0, 64, 128, or 192 in the last octet.

Worked subnetting example

Divide `10.0.0.0/24` into 4 equal subnets. Add 2 to the prefix: /26. Block size: 2^(32-26) = 64. The four /26 subnets are: `10.0.0.0/26` (addresses 0–63), `10.0.0.64/26` (addresses 64–127), `10.0.0.128/26` (addresses 128–191), and `10.0.0.192/26` (addresses 192–255). Each provides 62 usable host addresses. Verify each block with the IP CIDR Range Quick Calculator to confirm they are non-overlapping and correctly aligned.

• +1 prefix = ÷2 block size: /24 → two /25, /16 → two /17, /8 → two /9.
• +2 prefix = ÷4 block size: /24 → four /26, useful for dividing by availability zone.
• +3 prefix = ÷8 block size: /24 → eight /27, useful for tier separation (web, app, db, mgmt).
• Alignment requirement: Subnet start addresses must be multiples of the subnet block size.
• Summarisation (supernetting): Multiple contiguous subnets can be described by a shorter prefix — four /26 subnets summarise as one /24.

CIDR errors in infrastructure configurations are often silent — the network may appear to work until an edge case triggers the misconfiguration. These are the most common mistakes and how to catch them before deployment.

Overlapping ranges in peered networks

The most costly CIDR mistake is assigning overlapping blocks to networks that will later be connected. `10.0.0.0/16` in VPC A and `10.0.10.0/24` in VPC B overlap — the /24 is entirely contained within the /16. Peering will be rejected. Plan all CIDR allocations in a central spreadsheet or IP address management (IPAM) system before provisioning. Always check with the IP CIDR Range Quick Calculator whether two proposed ranges intersect.

Misaligned subnet boundaries

A subnet like `10.0.0.10/24` is syntactically valid but the network address is actually `10.0.0.0/24` — the `.10` is a host address within that network, not a network address. Many tools and cloud consoles silently normalise this, but some reject it or behave unexpectedly. Always verify that the IP address you enter is the network address for the given prefix length. The CIDR calculator flags this automatically.

Choosing prefix lengths without planning for growth

A /29 subnet (6 usable hosts) is sufficient for a VPN concentrator with 4 IP addresses — until you add two more devices six months later and run out of space. Expanding a subnet requires reconfiguration of routes, firewall rules, and possibly VPC peering. Choose prefix lengths with at least 50% headroom: if you need 20 hosts, use /27 (30 usable hosts) rather than /28 (14 usable hosts).