NetEngToolkit

CIDR Notation Explained: Prefixes, Masks, Ranges, and Summarization

Addressing and subnetting · Last updated 12 October 2026 · 5 min read

Read and write CIDR notation confidently, convert between prefixes and masks, work out what a block covers, summarize routes, and turn address ranges into CIDR blocks.

What CIDR notation says

CIDR (Classless Inter-Domain Routing) notation writes a block of addresses as an address, a slash, and a prefix length: 203.0.113.0/24. The prefix length is the number of leading bits that are fixed and shared by every address in the block; the remaining bits vary. CIDR replaced the older class A/B/C system in the 1990s because fixed class sizes wasted addresses and bloated routing tables; with CIDR a block can be any power-of-two size.

Two forms mean exactly the same thing: /24 and the dotted mask 255.255.255.0. Tools and vendors differ in which they accept, so learn to convert quickly.

Prefixes, masks, and sizes

Prefix Subnet mask        Total addresses
/8    255.0.0.0          16777216
/16   255.255.0.0           65536
/20   255.255.240.0          4096
/22   255.255.252.0          1024
/23   255.255.254.0           512
/24   255.255.255.0           256
/25   255.255.255.128         128
/26   255.255.255.192          64
/27   255.255.255.224          32
/28   255.255.255.240          16
/29   255.255.255.248           8
/30   255.255.255.252           4

The key pattern: every time the prefix drops by one, the block doubles. A /23 is two /24s; a /22 is four /24s; a /16 is 256 of them. To convert a prefix to a mask, write that many 1s followed by 0s and read it in octets: /26 is 11111111.11111111.11111111.11000000, which is 255.255.255.192. The CIDR Calculator includes the full /0 to /32 table.

Reading a CIDR block

To see what 10.10.10.15/20 covers, find the block of size 212 = 4,096 addresses that contains it. In the third octet the mask is 11110000, so blocks start every 16: 0, 16, 32 ... The address's third octet is 10, which is in the block starting at 0, giving 10.10.0.0/20 through 10.10.15.255. If a rule contains host bits that are not zero, the real block is the network that address belongs to, not a single host. If you mean exactly one host, write /32 (for example 203.0.113.7/32). The special value 0.0.0.0/0 means "all IPv4 addresses", a notation that appears constantly in firewall and cloud security-group rules and deserves care.

Route summarization (aggregation)

Two adjacent blocks can be replaced by one larger block only if they are the same size, contiguous, and the first starts on the boundary of the larger block. Summarization keeps routing tables small and hides internal detail from the rest of the network.

Example that works: 192.168.0.0/24 and 192.168.1.0/24 combine into 192.168.0.0/23, which covers 192.168.0.0 through 192.168.1.255 (512 addresses). A /23's third octet must be even, and 0 is even.

Example that does not work: 192.168.1.0/24 and 192.168.2.0/24 are adjacent, but no single /23 covers both. The /23 that contains 192.168.1.0 is 192.168.0.0/23 (192.168.0.0 to 192.168.1.255), and the /23 that contains 192.168.2.0 is 192.168.2.0/23 (192.168.2.0 to 192.168.3.255). They fall in different aligned blocks. Announcing either one would also claim an extra /24 you may not own, and neither would cover both of your networks. You need two separate routes, or a larger summary such as a /22 that deliberately includes the spare space. Always verify that a summary covers only the addresses you intend.

Converting a mask to a prefix quickly

You do not need to write out the binary. A mask octet can only take nine values, and each corresponds to a number of 1 bits:

Octet  Ones   |  Octet  Ones
255    8      |  224     3
254    7      |  192     2
252    6      |  128     1
248    5      |  0       0
240    4      |

Add up the ones across the octets. 255.255.252.0 is 8 + 8 + 6 + 0 = /22. If an octet is not one of those nine values (for example 255.255.250.0) the mask is invalid, because a mask must be a run of 1s followed by a run of 0s. The same table works in reverse for a quick conversion from a prefix to a mask.

Where you will meet CIDR in practice

  • Firewall rules and cloud security groups: source and destination are CIDR blocks. A mistake in the prefix length changes how many addresses a rule permits by a factor of two for each bit.
  • Route tables and VPN configuration: each route is a destination prefix plus a next hop; the most specific (longest) matching prefix wins.
  • Allow-lists published by vendors, which are often long lists of CIDR blocks.
  • Container and cloud networking, where virtual networks, subnets, and pod ranges are all assigned from CIDR blocks that must not overlap.

Overlapping address space is a classic cause of failed VPNs and peering. If two sites both use 192.168.1.0/24, neither can tell which side a destination is on, so traffic never crosses. The fixes are to renumber one side or to translate one side's addresses with NAT. Check for overlap before connecting networks: compare the network and broadcast address of each block with the CIDR Calculator.

Converting an address range to CIDR blocks

Vendors often publish address space as "from A to B". A firewall needs CIDR blocks, and an arbitrary range usually needs several. The method: starting at the first address, take the biggest aligned block that does not run past the end, then continue from the next address. For 192.168.1.10 to 192.168.1.100 (91 addresses) the result is:

192.168.1.10/31    2 addresses
192.168.1.12/30    4 addresses
192.168.1.16/28    16 addresses
192.168.1.32/27    32 addresses
192.168.1.64/27    32 addresses
192.168.1.96/30    4 addresses
192.168.1.100/32   1 addresses

The IP Range Calculator does this instantly. If you would rather allow a few extra addresses, widening to a single prefix is simpler, but only do so when the extra addresses are acceptable to you.

Wildcard masks in access lists and routing

Cisco-style ACLs and OSPF network statements use wildcard masks, which invert the subnet mask: 0 means the bit must match and 1 means ignore it. The wildcard for a /28 (255.255.255.240) is 0.0.0.15, and for a /21 (255.255.248.0) it is 0.0.7.255. Writing a subnet mask where a wildcard is expected is one of the most common ACL mistakes; it silently matches the wrong set of addresses. Use the Wildcard Mask Calculator to convert and double-check.

A note on IPv6

IPv6 uses the same prefix-length notation, with 128-bit addresses (2001:db8::/32). The arithmetic is the same, but conventions differ: a typical LAN subnet is a /64, so there is no "number of hosts" planning at that level. The tools on this site are IPv4-only; the addressing architecture is defined in RFC 4291.

Common mistakes

  • Writing a rule with host bits set and assuming it covers one host.
  • Summarizing blocks that are adjacent but not aligned, which announces address space you do not control.
  • Reading /24 as "24 hosts"; it is 24 network bits (256 addresses).
  • Entering 0.0.0.0/0 in an allow rule without realizing it permits the whole internet.
  • Confusing prefix lengths between IPv4 (/24) and IPv6 (/64).

Tools used in this guide

  • CIDR Calculator — Break down a CIDR block into its network details, plus a full CIDR reference table.
  • IP Range Calculator — Find the total address count and the CIDR blocks that cover a start-to-end IP range.
  • Wildcard Mask Calculator — Convert between subnet masks and wildcard masks for ACLs and OSPF configuration.
  • IPv4 Subnet Calculator — Calculate network, broadcast, usable range, mask, and wildcard from an IP + CIDR or subnet mask.

References and further reading

References are primary sources (standards and official documentation). Commands and sample output are illustrative; behavior can vary by operating system and software version.

Keep reading