# CIDR

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/cidr

## Quick definition

CIDR stands for Classless Inter-Domain Routing. It is a way to assign IP addresses and route data on the internet that does not rely on fixed classes like Class A, B, or C. Instead, it uses a prefix length (like /24) to define how many bits belong to the network part of the address. This makes IP address usage much more efficient and flexible.

## Simple meaning

Imagine you have a giant mailbox system for an entire city. In the old way of doing things, mailboxes came in only three fixed sizes: tiny, medium, and huge. If you needed a medium-sized mailbox but only had a tiny one available, you were out of luck, or you had to waste a huge one. That was the problem with the old IP address system called "classful" addressing, it had fixed classes (A, B, C) that were often either too small or too big for what an organization actually needed. CIDR changed all that by letting you chop up the address space into custom-sized blocks, kind of like being able to order a mailbox that fits exactly what you need.

In the CIDR system, an IP address is written like a normal address but with a slash and a number at the end, for example 192.168.1.0/24. The number after the slash tells you how many bits of the address are used for the network part, and the remaining bits are for individual devices on that network. A /24 means the first 24 bits are the network, leaving 8 bits for hosts, which gives you 254 usable addresses. If you need more devices, you could use a /23, which gives you 510 addresses. If you need fewer, a /25 gives you 126. This flexibility is why CIDR is the backbone of modern IP addressing and routing on the internet.

CIDR also helps keep the internet's routing tables from growing out of control. Instead of having to list every tiny network individually, routers can group many smaller networks together using a single route, a technique called route aggregation or supernetting. This makes the internet faster and more stable, and it's why you can send an email across the world in a fraction of a second.

## Technical definition

CIDR, defined in RFC 1518 and RFC 1519 (with updates in RFC 4632), is a method for assigning IP addresses and performing IP routing that replaces the rigid classful addressing scheme (Class A, B, C, D, E). Under classful addressing, IP addresses were divided into fixed prefix lengths: 8 bits for Class A, 16 bits for Class B, and 24 bits for Class C. This fixed partitioning led to massive inefficiency, because a Class B network (65,534 hosts) was too large for most organizations, and a Class C network (254 hosts) was often too small, forcing organizations to request multiple Class C blocks, which fragmented the routing table.

CIDR introduced a variable-length subnet masking (VLSM) approach, where the boundary between the network prefix and the host identifier can be placed at any bit position. This boundary is indicated by the CIDR notation: an IP address followed by a slash and a decimal number representing the prefix length (the number of contiguous leftmost bits that belong to the network portion). For example, 10.0.0.0/8 has a network mask of 255.0.0.0, while 172.16.0.0/12 has a mask of 255.240.0.0. The prefix length can range from 0 to 32 for IPv4, and from 0 to 128 for IPv6 (though 0 is generally not used in practice).

CIDR enables route aggregation, also known as supernetting, which reduces the size of routing tables. Instead of a router storing individual routes for every /24 network, it can store one route for a larger block, such as a /16, that encompasses them all, as long as those networks are contiguous and the larger block is assigned to a single administrative entity. This aggregation is fundamental to the scalability of the global internet. Border Gateway Protocol (BGP) relies on CIDR to exchange aggregated routes between autonomous systems.

In practical IT implementation, engineers use CIDR when designing subnets within a corporate network. For example, an organization with a /16 allocation like 10.0.0.0/16 can subnet it into multiple /24 subnets for different departments, each supporting up to 254 hosts. CIDR is also critical for allocating public IP addresses from Regional Internet Registries (RIRs) like ARIN or RIPE, which assign blocks in CIDR notation. On exam objectives for CompTIA Network+, understanding CIDR notation, subnetting calculations (finding network ID, broadcast address, first/last usable host, and number of hosts per subnet) is a core skill. The formula for number of hosts is 2^(32 - prefix_length) - 2, where the subtraction accounts for the network address and broadcast address that cannot be assigned to hosts.

## Real-life example

Think of a large apartment complex with a central mailroom. In the old classful system, every building on the street had to use one of three predetermined locker sizes. Some buildings got huge locker banks that wasted a lot of space, while others overflowed because their locker bank was too small. Then the building manager decided to switch to a CIDR-like system. Now, instead of being forced into fixed sizes, the manager can assign exactly the right number of mail slots to each building based on how many apartments it has.

For example, the manager writes the building's address as "100 Main Street /24" to tell the mail carrier that the first 24 parts of the building's identifier are used for the building itself, and the remaining parts are for individual apartment slots. If a building has 50 apartments, the manager might give it a /26 (which provides 62 slots, allowing a little room for growth). If another building has 200 apartments, a /24 (254 slots) is perfect. This way, no mail slots are wasted, and no building runs out of room.

Now, imagine the mail carrier (the router) has a route map. In the old system, the map had to list every single building individually because each had a fixed size that didn't align nicely. With CIDR, the carrier can group entire neighborhoods together. The carrier can say, "All mail for the 100 Main Street block, which includes every building starting with 100 Main, goes to the central hub." This single entry replaces dozens of individual entries, making the map much thinner and easier to read quickly. That is exactly how CIDR allows internet routers to reduce the size of their routing tables, making the internet faster and more efficient.

## Why it matters

CIDR matters because without it, the internet would have run out of usable IP addresses and collapsed under the weight of its own routing tables well before the year 2000. The old classful system wasted massive amounts of address space. For example, a company with 300 devices would have had to take a Class B network, which provided 65,534 addresses, more than 65,000 of which would go unused. CIDR fixed this by allowing organizations to receive exactly the size block they needed, such as a /23 (510 addresses) or a /24 (254 addresses). This conservation of address space is the primary reason IPv4 has lasted as long as it has.

In practical IT work, CIDR is essential for network design and management. When you set up a new office, you need to decide how many subnets you need and how large each one should be. Using CIDR, you can create subnets of varying sizes to match different department needs, a small subnet for a team of 10, a larger one for a floor of 150 employees, and a special one for servers. This kind of flexible design is not possible with the old classful system.

For IT professionals pursuing certifications, CIDR is one of the most heavily tested concepts. CompTIA Network+ expects candidates to be able to calculate subnet masks, determine the number of hosts per subnet, and identify the network and broadcast addresses. Beyond the exam, engineers use CIDR every day when configuring routers, setting up VPNs, allocating IP address pools for DHCP, and troubleshooting connectivity issues. If you do not understand CIDR, you will struggle to manage even a basic network. It is a foundational skill that underpins everything from local LANs to global internet routing.

## Why it matters in exams

CIDR is a core objective in the CompTIA Network+ (N10-008 or N10-009) exam, specifically under Domain 1.0: Networking Fundamentals. The exam expects candidates to understand subnetting and CIDR notation thoroughly, and you will likely see several questions that require you to perform subnet calculations. These questions are not optional, they are a significant part of the exam score, and many test-takers find them the most challenging section.

The exam objectives state that you must be able to "explain the concepts and characteristics of routing and switching" and "given a scenario, configure a subnet and use appropriate IP addressing schemes." This directly translates to CIDR. You will encounter questions that ask you to determine the correct subnet mask for a given number of hosts, find the network address from an IP and prefix, or identify the broadcast address. Some questions present a scenario where a company is given a block of IP addresses in CIDR notation, and you must decide how to subnet it to meet specific requirements for multiple locations.

Question types include multiple-choice, where you might be asked, "Which of the following is a valid host address on the 192.168.1.64/26 network?" The answer requires you to calculate the range: the network address is 192.168.1.64, broadcast is 192.168.1.127, and valid hosts are 192.168.1.65 through 192.168.1.126. Another common type is a drag-and-drop question where you match IP addresses to their CIDR notations or subnet masks.

Beyond Network+, CIDR also appears in the CompTIA Security+ exam (under network security concepts), Cisco CCNA (where subnetting is even more intensive), and in any networking-related certification. Mastering CIDR early in your studies will pay dividends across multiple exams. The key is to practice until you can calculate subnets quickly without a calculator, because in the exam, time is your enemy. Use memory techniques like the "magic number" method (256 minus the interesting octet of the subnet mask) to speed up your calculations.

## How it appears in exam questions

CIDR appears in exam questions in several distinct patterns. The most common is a direct calculation question. You might be given an IP address and a CIDR notation, and asked to find the network ID, broadcast address, or the number of usable hosts. For example: "Given the address 172.16.5.0/23, what is the broadcast address?" To solve, you need to understand that /23 gives a subnet mask of 255.255.254.0. The increment in the third octet is 2, so the network address falls on even multiples of 2. 172.16.5.0 is not a valid network address for /23 because 5 is not an even multiple of 2. You must first find the network address, which is 172.16.4.0, then the broadcast is 172.16.5.255. This kind of question tests your ability to recognize when an address is not on a valid boundary.

Another pattern is multiple-choice selection from a list. You may be asked, "Which of the following IP addresses is a valid host address on the 10.10.10.64/26 network?" Options might include 10.10.10.63, 10.10.10.65, 10.10.10.127, and 10.10.10.128. You must know that /26 has a mask of 255.255.255.192, with an increment of 64 in the fourth octet. The network address is 10.10.10.64, broadcast is 10.10.10.127, so valid hosts are 10.10.10.65 through 10.10.10.126. Only 10.10.10.65 fits.

Scenario-based questions are also common. For example, "A company has been assigned the 192.168.1.0/24 block. They need 4 subnets with at least 50 hosts each. What subnet mask should they use?" You must calculate that /26 provides 62 hosts (enough) and yields 4 subnets, so the mask is 255.255.255.192. Troubleshooting questions might present a scenario where two devices cannot communicate because one is using the wrong subnet mask, and you must identify the issue. For instance, Device A has IP 10.10.10.1/24 and Device B has IP 10.10.11.1/24, without a router, they cannot communicate because they are on different networks (10.10.10.0 vs 10.10.11.0). Some questions mix CIDR with other concepts like VLANs or routing protocols, asking you to determine the correct CIDR notation for a summarized route.

## Example scenario

You are a network administrator for a small company called GreenLeaf Inc. The company has been assigned the IP block 192.168.50.0/24 from its ISP. The office has three departments: Sales (30 employees), Engineering (60 employees), and Management (10 employees). Each department needs its own subnet, and you want to leave room for future growth. You need to design the subnets using CIDR.

First, you determine the largest requirement: Engineering needs 60 hosts, so you need a subnet that can support at least 62 usable addresses (remembering you lose 2 for network and broadcast). A /26 provides 62 addresses, but that's exactly 62 usable. Better to use a /25 for Engineering, which gives 126 addresses, leaving room for growth. A /25 has a mask of 255.255.255.128, and the first subnet starting at 192.168.50.0/25 gives you a range from 192.168.50.1 to 192.168.50.126. Engineering gets that.

Now the Sales department needs at least 30 hosts. A /27 provides 30 usable addresses (32 total, minus 2). That is perfect for today, but tight for growth. You decide to give Sales a /26 (62 addresses) to be safe. The next available block after Engineering is 192.168.50.128/26, covering 192.168.50.129 to 192.168.50.190 (broadcast 192.168.50.191). Sales gets that.

Management needs only 10 hosts. A /28 gives 14 usable addresses, which is adequate. The next available block is 192.168.50.192/28, covering 192.168.50.193 to 192.168.50.206. Management gets that.

You still have leftover addresses. The block 192.168.50.208/28 is available, and you can reserve it for future use or for network equipment like printers and servers. Now you have successfully subnetted your /24 into three subnets of varying sizes using CIDR, with no wasted space and room to grow. This is exactly the kind of real-world scenario you might face on the job or on the exam, where you need to choose the right prefix lengths to match business requirements.

## Common mistakes

- **Mistake:** Forgetting to subtract 2 for the network and broadcast addresses when calculating usable hosts.
  - Why it is wrong: The formula 2^(32 - prefix) gives the total number of addresses in the subnet, but the first address is reserved for the network ID and the last for the broadcast. These cannot be assigned to hosts. Using the total count instead of total minus 2 will overestimate the number of usable hosts.
  - Fix: Always apply the formula: usable hosts = (2^(32 - prefix)) - 2. For example, a /27 gives 2^5 = 32 addresses, minus 2 equals 30 usable hosts.
- **Mistake:** Not checking whether an IP address is on a valid subnet boundary for its prefix length.
  - Why it is wrong: For example, 192.168.1.5/30 is not a valid network address because /30 has an increment of 4 in the fourth octet, so network addresses must be multiples of 4 (0, 4, 8, 12...). Using 192.168.1.5 as a network address would be incorrect and would cause configuration errors.
  - Fix: Calculate the network's "interesting octet" increment: 256 minus the subnet mask value in that octet. The network address must be a multiple of that increment. For /30 (255.255.255.252), the increment is 4, so network addresses are 0, 4, 8, etc.
- **Mistake:** Mistaking the prefix length for a subnet mask, such as thinking /24 is the same as 255.255.255.0 (it is, but only for /24).
  - Why it is wrong: Many learners assume that only /8, /16, and /24 are valid because they match the old classful boundaries. CIDR allows any prefix length from 0 to 32, so /23, /25, /27, etc., are all valid and commonly used. Assuming only classful boundaries exist leads to incorrect subnetting.
  - Fix: Memorize that CIDR allows any prefix length. Practice subnetting with non-standard lengths like /23 (255.255.254.0) and /27 (255.255.255.224). The number of bits in the mask determines the network portion, not the class.
- **Mistake:** Using the subnet mask as the prefix length when converting between notations.
  - Why it is wrong: For example, if given a subnet mask of 255.255.255.240, some might think it is /28, but 240 in binary is 11110000, which has 4 ones in the last octet, so the total is 24 + 4 = 28. The mistake is not converting the last octet correctly. If the mask is 255.255.255.248, the last octet is 248 (11111000, 5 ones), so the prefix is /29.
  - Fix: Count the number of consecutive 1 bits in the binary representation of the subnet mask. For the last octet, memorize common values: 128=/25, 192=/26, 224=/27, 240=/28, 248=/29, 252=/30, 254=/31, 255=/32. Add 24 to the last octet's count for a class C-like address.
- **Mistake:** Confusing the network address with a usable host address.
  - Why it is wrong: In a /24 network (192.168.1.0/24), the network address is 192.168.1.0. This is the identifier for the subnet and cannot be assigned to a host. A common trap question will list the network address among valid hosts, and learners may select it.
  - Fix: Always identify the network address (all host bits zero) and the broadcast address (all host bits one) first. Any address that falls between them (but not including them) is a valid host. For /24, 192.168.1.0 is the network, so 192.168.1.1 is the first valid host.

## Exam trap

{"trap":"A question gives you an IP address like 192.168.1.64/27 and asks if it is a valid network address. Many learners think \"64\" looks like a network address because it is a multiple of 32 (the increment for /27), but they forget to check that the host bits are all zero. For /27, the subnet mask is 255.255.255.224, and the last octet in binary is 11100000. The network portion uses the first 3 bits of the last octet, and the host portion uses the last 5 bits. In 192.168.1.64, the last octet is 64 in decimal, which is 01000000 in binary. The host bits (the last 5 bits) are 00000, which is all zeros, so this IS a valid network address. But if the address were 192.168.1.96, which is 01100000, the host bits are 00000 again (because the last 5 bits of 01100000 are 00000), so 96 is also a valid network address. The trap is that the learner assumes 64 is the network because it is a multiple of 32, but 96 is also a multiple of 32 and is a valid network for /27. The correct network addresses for /27 are 0, 32, 64, 96, 128, 160, 192, and 224, all multiples of 32.","why_learners_choose_it":"Learners often memorize that the network address is the first address in the block, but they do not fully understand that the block size (increment) is determined by the subnet mask. They may see 64 and think it is the network because it is a common boundary, but they miss the fact that 96 is also a valid network. They may also incorrectly think that only even numbers can be network addresses, or they confuse the increment with the number of hosts.","how_to_avoid_it":"Always convert the last octet of the subnet mask to binary to find the incremental value. For /27, the mask is 255.255.255.224, and 224 in binary is 11100000. The block size (increment) is 256 - 224 = 32. The valid network addresses are 0, 32, 64, 96, 128, 160, 192, and 224. To check if any address is a valid network, verify that the host bits (the bits after the network portion) are all zero. You can also check if the address is a multiple of the block size. For /27, any multiple of 32 (0, 32, 64, 96, etc.) is a valid network address. For /28, the block size is 16, so multiples of 16 (0, 16, 32, 48, etc.) are valid."}

## Commonly confused with

- **CIDR vs Subnet mask:** CIDR notation is a shorthand way of writing a subnet mask. For example, /24 is shorthand for the subnet mask 255.255.255.0. The subnet mask is a dotted-decimal number that indicates the network and host portions of an IP address, while CIDR notation is a slash followed by the number of network bits. They describe the same thing, but CIDR is more compact and easier to use for routing and aggregation. (Example: The CIDR notation /24 means the subnet mask is 255.255.255.0. The /24 tells you that the first 24 bits are the network, while the subnet mask shows it explicitly as four numbers.)
- **CIDR vs Classful addressing:** Classful addressing divides IP addresses into fixed classes (A, B, C) based on the first few bits, with fixed prefix lengths (8, 16, 24). CIDR abandons these fixed boundaries and allows any prefix length, making address allocation much more flexible. For example, a classful Class C network is always /24, but CIDR allows a /23 or /25, which classful does not permit. (Example: Under classful, a company needing 300 hosts would have to get a Class B (/16) network, wasting thousands of addresses. With CIDR, the company can get a /23 (510 addresses) or /24 (254 addresses) plus a /24 for another subnet.)
- **CIDR vs VLSM (Variable Length Subnet Mask):** CIDR is the overarching standard for IP addressing and routing, while VLSM is the practice of using different subnet mask lengths within the same network. VLSM is a technique made possible by CIDR. For example, using a /26 for one department and a /28 for another within the same /24 block is VLSM. CIDR is the foundation that allows VLSM to work. (Example: In a company with a /24 block, using a /25 for Engineering and a /27 for Sales is VLSM. CIDR allows this by not restricting you to only one fixed subnet size.)
- **CIDR vs Supernetting:** Supernetting is the process of combining multiple smaller network prefixes into a single larger prefix to reduce the size of routing tables. CIDR notation enables supernetting. For example, combining four /24 networks into one /22 network is supernetting. CIDR is the notation and method, while supernetting is the action. (Example: If a company owns 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24, they can advertise a single route 192.168.0.0/22 instead of four separate /24 routes.)

## Step-by-step breakdown

1. **Understand the IP address and CIDR notation** — An IP address in CIDR notation looks like 192.168.1.0/24. The part before the slash is the IP address, and the number after the slash (the prefix length) tells you how many bits are used for the network portion. The remaining bits are for host addresses. The prefix length can be any number from 0 to 32 for IPv4.
2. **Determine the subnet mask** — Convert the prefix length into a subnet mask. For example, /24 means 24 bits are set to 1 in the subnet mask, giving 255.255.255.0. For /27, the subnet mask is 255.255.255.224 (because 27 bits = 8+8+8+3). You can calculate this by writing out the binary ones: for /27, the fourth octet has 3 ones, which is 11100000 in binary, or 224 in decimal.
3. **Calculate the block size (increment)** — The block size is the number of addresses in each subnet. It is determined by the subnet mask's value in the interesting octet (the octet where the boundary between network and host falls). The formula is 256 minus the subnet mask value in that octet. For example, with /27 (255.255.255.224), the fourth octet is 224, so the block size is 256 - 224 = 32. This means each subnet has 32 addresses.
4. **Identify the network address** — The network address is the first address in each subnet, and it is always a multiple of the block size. For /27 with block size 32, network addresses are 0, 32, 64, 96, 128, 160, 192, and 224. For the address 192.168.1.64/27, the network address is 192.168.1.64 because 64 is a multiple of 32.
5. **Calculate the broadcast address** — The broadcast address is the last address in the subnet and is always the network address plus the block size minus 1. For a /27 subnet with network address 192.168.1.64 and block size 32, the broadcast address is 192.168.1.64 + 31 = 192.168.1.95.
6. **Determine the usable host range** — Usable host addresses are all addresses between the network address and the broadcast address. For the /27 subnet with network 192.168.1.64 and broadcast 192.168.1.95, the usable hosts are 192.168.1.65 through 192.168.1.94. The number of usable hosts is block size minus 2.

## Practical mini-lesson

CIDR is not just a theoretical concept, it is something you will use constantly as a network professional. The most practical skill is being able to subnet quickly without a calculator, because in real-world scenarios, you often have to make decisions on the fly, such as when configuring a router or setting up a new VLAN.

To master CIDR in practice, start by memorizing the common subnet masks and their CIDR equivalents. Know that /24 is 255.255.255.0, /25 is 255.255.255.128, /26 is 255.255.255.192, /27 is 255.255.255.224, /28 is 255.255.255.240, /29 is 255.255.255.248, and /30 is 255.255.255.252. A /30 is particularly important because it is often used for point-to-point links between two routers, providing exactly 2 usable addresses (one for each interface). A /31 (255.255.255.254) is also used for point-to-point links but has no broadcast or network address (RFC 3021), yielding two usable host addresses with no waste.

When designing a network, think in terms of CIDR blocks. For example, if you are given a /24 by your ISP, you can divide it into smaller subnets. But you must plan carefully to avoid overlapping subnets. Always start with the largest subnet requirement and work down to the smallest. This is called the "largest-first" method. If you allocate a /26 for Engineering, then the next available block starts at 192.168.1.64 (since the first /26 is 0–63). Then allocate /27 from 64, and so on. This organized approach prevents address conflicts.

What can go wrong? The most common real-world problem is misconfigured subnet masks on devices. If a host has a /24 mask but the router expects a /25, the host will think some IP addresses are local when they actually require routing. This leads to intermittent connectivity issues that are hard to troubleshoot. Another issue is using overlapping subnets, for example, creating a 10.0.0.0/24 and a 10.0.0.0/25 at the same time, which will cause routing confusion. Always double-check that your subnets do not overlap.

In enterprise environments, CIDR is used with DHCP scopes. When you set up a DHCP server, you define a scope using a network address and subnet mask, and the server will only lease addresses within that range. If you set the scope to 192.168.1.0/28, the server will hand out addresses from 192.168.1.1 to 192.168.1.14. Misunderstanding the prefix can lead to exhausted scopes or IP conflicts. The professional approach is to map out your entire IP address plan using CIDR notation before touching any equipment.

## Commands

```
ipconfig /all (Windows) or ifconfig (Linux/macOS)
```


```
ping 192.168.1.1
```


```
tracert 8.8.8.8 (Windows) or traceroute 8.8.8.8 (Linux/macOS)
```


## Troubleshooting clues

- **undefined** — symptom: undefined. undefined
- **undefined** — symptom: undefined. undefined
- **undefined** — symptom: undefined. undefined

## Memory tip

To find the block size: subtract the interesting octet of the subnet mask from 256. For example, 256 - 224 = 32 (for /27). That 32 is your increment, the network addresses are 0, 32, 64, 96, etc.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/cidr