# CIDR notation

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/cidr-notation

## Quick definition

CIDR notation is a way to write IP addresses that tells you where the network part ends and the device part begins. Instead of using a separate subnet mask like 255.255.255.0, you simply add a slash and a number at the end, like 192.168.1.0/24. This makes it faster to describe networks and helps the internet route traffic more efficiently. It is used everywhere from home routers to large corporate networks.

## Simple meaning

Imagine you live in a large apartment complex. Your full address includes the building name and your apartment number. The building name is like the network part of an IP address, and your apartment number is like the device part. Without CIDR notation, you would have to write out the building name in full every time. With CIDR notation, you use a shorthand: you write just the building name and then say how many digits of your full address are the building name, like a code. So instead of writing 'Building A, Apartment 5' you might say 'Building A / 1' meaning the building name takes up one piece of information, and the rest is the apartment.

In computer terms, an IP address is a string of 32 bits (for IPv4). Some of those bits identify the network, and the rest identify the specific device (host) on that network. CIDR notation, which stands for Classless Inter-Domain Routing, tells you exactly how many of those bits are the network part. For example, 192.168.1.0/24 means the first 24 bits are the network, and the remaining 8 bits are for hosts. This gives you up to 254 usable devices. If you see /16, that means 16 bits for the network and 16 for hosts, which gives many more possible devices. The slash number is called the prefix length. This system replaced the older classful system (Class A, B, C) which was rigid and wasted a lot of IP addresses. CIDR allows networks to be split into exactly the size needed, whether that is a /30 for just two devices or a /27 for 30 devices. It is the foundation of modern IP addressing and routing.

## Technical definition

CIDR notation, formally defined in RFC 4632, is a method for representing an IP address and its associated routing prefix. It superseded the classful network architecture (Class A, B, C) in the mid-1990s to slow the exhaustion of IPv4 addresses and reduce the size of global routing tables. In CIDR notation, an IP address is followed by a slash (/) and a decimal number that indicates the length of the network prefix in bits. For IPv4, this prefix length ranges from 0 to 32. For IPv6, it ranges from 0 to 128.

When a router receives a packet, it examines the destination IP address and uses the prefix length to determine which bits constitute the network portion. The router then consults its routing table, which contains routes expressed in CIDR notation. This allows for route aggregation, also called supernetting, where multiple contiguous networks can be advertised as one larger network. For example, instead of advertising four separate /24 networks (192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24), an ISP can aggregate them into a single /22 network (192.168.0.0/22). This reduces the number of routes in the global routing table, improving internet performance.

CIDR notation also enables variable-length subnet masking (VLSM), which allows a network to be divided into subnets of different sizes. This is critical for efficient IP address allocation. For example, a /24 network can be subnetted into two /25 networks, each with 126 usable hosts, or one /26 and one /27, depending on need. The calculation of the network address, broadcast address, and usable host range is based on the prefix length. The network address is obtained by setting all host bits to 0, and the broadcast address by setting all host bits to 1. The number of usable hosts is 2^(32 - prefix length) minus 2 (one for the network address, one for the broadcast).

In real IT implementation, engineers use CIDR notation when configuring router interfaces, firewall rules, and DHCP scopes. For example, on a Cisco router, the command 'ip address 10.0.0.1 255.255.255.0' is equivalent to 'ip address 10.0.0.1/24'. Many modern systems prefer the slash notation because it is more compact and less error-prone than typing out a full subnet mask. CIDR is not a protocol in itself but a notation used by routing protocols like OSPF, EIGRP, and BGP to exchange routing information. It is also fundamental to how the internet's Domain Name System (DNS) and IP address management (IPAM) tools function. Understanding CIDR notation is essential for any network professional because it appears in every aspect of IP network design, troubleshooting, and configuration.

## Real-life example

Think of a large library with many sections. The library has a system of call numbers on the spines of books. An old system might have only three sizes of sections: small (100 books), medium (1,000 books), and large (10,000 books). If a section needs 250 books, you have to put them in the medium section, wasting 750 book slots. This is like the old classful IP addressing (Class A, B, C) which forced networks to be one of three fixed sizes, wasting millions of IP addresses.

Now imagine a modern library where you can decide exactly how many books go in each section. You write the call number like 'Fiction / 5', meaning the first 5 digits are the section name, and the rest of the digits identify the specific book. If you have a section for Science Fiction, you might use 'SciFi / 4', giving you more room for books in that section. Each section can be sized perfectly to hold the number of books it needs, no more, no less. This is CIDR notation. The number after the slash is the prefix length, telling you how many bits of the address are the network part (the section). The remaining bits are for the specific devices (books).

In this library, if you have a section 'Mystery' with a prefix length of 26, you know that section can hold 62 books (2^6 minus 2). If the library grows, you can expand the section by changing the prefix length to 25, doubling the capacity to 126 books. You can also combine two small sections into one larger section using route aggregation, just like an ISP combines multiple small customer networks into one large advertisement. The library analogy shows how CIDR notation brings flexibility and efficiency to IP address allocation, just like a flexible shelving system brings efficiency to a library.

## Why it matters

CIDR notation matters because it is the language of modern networking. Every device that connects to the internet uses an IP address, and every IP address is associated with a network prefix. Without CIDR notation, the internet would have run out of IPv4 addresses years ago and routing tables would be unmanageably huge. It allows Internet Service Providers (ISPs) to allocate address space in precise chunks that match their customer needs, rather than forcing customers to take entire Class C or Class B blocks. This efficiency has extended the life of IPv4 and is the reason we still have usable addresses today.

For IT professionals, reading and writing CIDR notation is as fundamental as understanding binary. When you configure a network, you need to decide the subnet mask for each VLAN or subnet. CIDR notation makes that decision clear: a /24 gives you 254 hosts, a /29 gives you 6, and a /30 gives you 2. If you misconfigure the prefix length, you can either overlap subnets or create a subnet too small for your needs, causing devices to be unable to communicate. Troubleshooting connectivity issues often begins with verifying that the subnet mask (or prefix length) is correct on both ends of a link.

CIDR notation also is key to security. Firewall rules and access control lists (ACLs) often specify allowed or denied traffic using CIDR blocks. For example, allowing traffic from 10.0.0.0/8 permits any device with an IP starting with 10.x.x.x. If you mistakenly use /16 instead, you might block legitimate traffic or leave a security gap. Network segmentation for reducing broadcast domains or isolating sensitive systems relies on proper subnetting with CIDR. In cloud computing, virtual private clouds (VPCs) are defined using CIDR blocks. A cloud engineer must choose the right CIDR size to accommodate all future resources without overlapping with other networks. CIDR notation is not just a theory topic; it is a daily tool used by network engineers, security analysts, and cloud architects. Mastering it is essential for any IT certification and for real-world network management.

## Why it matters in exams

CIDR notation is a core topic in the CCNA certification and appears in nearly every domain of the exam. The CCNA exam objectives include IP addressing, subnetting, routing concepts, and network configuration, all of which rely on CIDR. In the exam, you will be asked to calculate the number of usable hosts in a subnet, determine the network address and broadcast address, and identify the valid host range for a given CIDR prefix. You may also need to decide the best CIDR prefix to use when subnetting an address block to meet specific size requirements.

For CCNA, the most commonly tested prefix lengths are /24 through /30, but you should also be comfortable with /16 and /8. You will see CIDR notation in multiple-choice questions, drag-and-drop exercises, and simulation labs. For example, you might be given an IP address like 192.168.10.50/27 and asked which address is the network address, which is the broadcast address, and which IPs are valid for hosts. Another common question type presents a scenario where you have to expand a network to include more devices and you must choose the new subnet mask that provides enough host IPs.

In the CCNA exam, questions often require you to convert between dotted-decimal subnet masks (e.g., 255.255.255.0) and CIDR prefix length (/24). You need to fluently know the slash values for all standard masks: /32 (255.255.255.255), /30 (255.255.255.252), /29 (255.255.255.248), /28 (255.255.255.240), /27 (255.255.255.224), /26 (255.255.255.192), /25 (255.255.255.128), /24 (255.255.255.0), /16 (255.255.0.0), and /8 (255.0.0.0). Sometimes the exam tests your understanding of route summarization, where you need to find the smallest CIDR block that covers multiple subnets.

Simulation labs in CCNA may ask you to configure a router interface with an IP address using CIDR notation. The Cisco IOS command syntax can accept either the slash format or the full subnet mask, but you must understand what the prefix length means to avoid misconfiguration. Understanding CIDR is vital for troubleshooting ACL misconfigurations and for interpreting routing table entries displayed with the 'show ip route' command. Because CIDR is fundamental to all these tasks, exam preparation must focus on both calculation speed and conceptual understanding. A solid grasp of CIDR notation can earn you many points across multiple sections of the CCNA exam.

## How it appears in exam questions

In the CCNA exam, questions about CIDR notation appear in several distinct patterns. The most common is the 'what is the valid host range' question. For example, the question might state: 'Given the IP address 172.16.30.50/20, what is the broadcast address?'. This requires you to calculate the subnet boundary by looking at the prefix length. You need to identify the octet where the boundary falls (the third octet for a /20) and then compute the network address (172.16.16.0) and the broadcast address (172.16.31.255). The answer choices will include plausible distractors like the network address or an invalid host address.

Another typical question pattern involves subnetting a given block to meet specific requirements. For instance: 'Your company has been allocated 192.168.1.0/24. You need 4 subnets, each with at least 50 usable hosts. What subnet mask should you use?' Here you need to calculate that 50 hosts require at least 6 host bits (2^6 = 64, minus 2 = 62), so the mask must be /26, which gives 4 subnets. The exam might also ask for the network address of the second subnet or the broadcast address of the third subnet.

Configuration-type questions also appear. You might see a router configuration snippet and be asked to identify the CIDR prefix that would be used to configure an interface. For example, 'Router(config-if)# ip address 10.0.0.1 255.255.255.128' is equivalent to /25. A question could ask you to convert that mask to slash notation. Troubleshooting scenarios often involve mismatched subnet masks. A typical question might describe two hosts that cannot ping each other, and the answer choices include CIDR prefixes that are inconsistent on the two interfaces.

Finally, there are route summarization questions. You may be given four networks: 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24. The question asks for the summary route that covers all four. The correct answer is 192.168.0.0/22. You must understand that with a /22 mask, the third octet increases by blocks of 4, so it covers 0–3. These patterns are repeated across the exam, but the numbers change. Practicing with many examples is the best way to prepare.

## Example scenario

You are a network administrator for a small company that just moved to a new office. The IT manager tells you that the ISP has given you the public IP range 203.0.113.0/24. That means you have 256 total addresses, but you need to use one for the network address (203.0.113.0) and one for the broadcast address (203.0.113.255), leaving 254 usable host addresses for devices like computers, printers, and servers.

Your office has three departments: Sales (45 devices), Engineering (60 devices), and Management (12 devices). You have a small server room with 2 servers that need their own isolated subnet. You cannot just use the whole /24 as one flat network because you want to keep broadcast traffic separated and improve security. You decide to subnet the /24 into smaller CIDR blocks.

First, you need to find the smallest prefix that can accommodate Engineering with 60 devices. 60 hosts require at least 6 host bits because 2^6 = 64, minus 2 = 62 usable addresses. So you choose a /26 mask (32 - 6 = 26). A /26 gives 4 subnets of 62 hosts each. You allocate the first /26 subnet (203.0.113.0/26) to Engineering. The network address is 203.0.113.0, the broadcast is 203.0.113.63, and the usable range is 203.0.113.1 through 203.0.113.62.

Next, Sales needs 45 devices. A /26 could work but would waste 17 addresses. A /27 (32 - 5 = 27) gives only 2^5 - 2 = 30 usable hosts, which is too small. So you must use another /26. You allocate the second /26 subnet (203.0.113.64/26) to Sales. The network is 203.0.113.64, broadcast is 203.0.113.127, usable range 203.0.113.65 to 203.0.113.126.

Management needs 12 devices. A /28 (2^4 - 2 = 14) is big enough. You allocate the third subnet (203.0.113.128/28) to Management. The network is 203.0.113.128, broadcast is 203.0.113.143, usable range 203.0.113.129 to 203.0.113.142. Finally, for the server room, you need only 2 servers, so you use a /30 (2^2 - 2 = 2). You allocate 203.0.113.144/30. The two usable IPs are 203.0.113.145 and 203.0.113.146.

Now all departments have their own subnet with room for growth. The CIDR notation makes it easy to know exactly where each subnet starts and ends. In this scenario, you used different prefix lengths (VLSM) to avoid wasting IP addresses, which is exactly what CIDR notation enables.

## Common mistakes

- **Mistake:** Thinking the number after the slash is the subnet mask in decimal form.
  - Why it is wrong: The slash number is the count of network bits, not a decimal number. For example, /24 means 24 bits are network bits, which corresponds to 255.255.255.0. Learners sometimes mistakenly believe that /24 means 255.0.0.0 or some other decimal value.
  - Fix: Remember that the slash number is just a count of 1s in the binary subnet mask. A /24 has 24 one-bits followed by 8 zero-bits, which in decimal is 255.255.255.0.
- **Mistake:** Forgetting to subtract 2 from the total number of addresses when calculating usable hosts.
  - Why it is wrong: For any network, the first address is the network address itself and the last address is the broadcast address. These cannot be assigned to hosts. If you calculate 2^5 = 32 and think you have 32 usable hosts, you are wrong. You only have 30.
  - Fix: Always calculate usable hosts as 2^(number of host bits) minus 2. For a /27, host bits = 5, so usable = 2^5 - 2 = 30.
- **Mistake:** Mixing up network address and broadcast address.
  - Why it is wrong: The network address has all host bits set to 0, and the broadcast address has all host bits set to 1. Learners often confuse which is which, especially when subnetting in odd octets. For example, for 192.168.1.128/26, the network is 192.168.1.128 (binary 10000000) and the broadcast is 192.168.1.191 (binary 10111111). Some think the broadcast is 192.168.1.128.
  - Fix: Remember: network = all host bits off (0s), broadcast = all host bits on (1s). Write out the binary in the boundary octet to be sure.
- **Mistake:** Using a /31 or /32 mask for point-to-point links without understanding the implications.
  - Why it is wrong: A /31 mask provides only 2 total addresses, with 0 usable hosts if you subtract 2. However, RFC 3021 allows /31 for point-to-point links because you don't need a broadcast address. Many older exam questions assume /30 is the smallest. Learners blindly use /31 on any link without considering whether the exam context supports it.
  - Fix: On the CCNA exam, unless specifically stated, use /30 for point-to-point links. /31 is a valid modern practice but is less commonly tested at the CCNA level.
- **Mistake:** Incorrectly calculating the network address when the subnet boundary falls in the middle of an octet.
  - Why it is wrong: For a /20, the boundary is in the third octet. Learners sometimes ignore the third octet and treat the prefix as if it were a /16 or /24. For example, for 10.0.30.0/20, the network address is 10.0.16.0, not 10.0.30.0. They forget to round down to the nearest multiple of the block size.
  - Fix: Identify which octet contains the boundary. For /20, the third octet has 4 bits for the network (bits 17–20). The block size in that octet is 2^4 = 16. So the network address in that octet must be a multiple of 16.

## Exam trap

{"trap":"Given the IP 192.168.10.50/27, a question asks 'Which of the following is a valid host address?' and lists options like 192.168.10.32, 192.168.10.63, 192.168.10.48, and 192.168.10.62.","why_learners_choose_it":"Learners often choose 192.168.10.32 because they think it is within the range, not realizing it is the network address. Others pick 192.168.10.63, thinking it is the last usable host, but it is actually the broadcast address. 192.168.10.48 is a valid host because it falls in the range 192.168.10.33–192.168.10.62.","how_to_avoid_it":"Always compute the network and broadcast addresses first. For /27, the block size is 32 in the last octet. The network of 192.168.10.50/27 is the next lower multiple of 32, which is 192.168.10.32. The broadcast is the next network minus 1, which is 192.168.10.63. The valid hosts are everything between .33 and .62. So 192.168.10.48 is valid."}

## Commonly confused with

- **CIDR notation vs Subnet mask:** A subnet mask is a 32-bit number that separates the network and host portions of an IP address, often written in dotted decimal like 255.255.255.0. CIDR notation is simply a shorthand way to write the same information by specifying the number of 1-bits in the subnet mask. They represent the same thing but in different formats. (Example: Subnet mask 255.255.255.0 is the same as /24 in CIDR notation.)
- **CIDR notation vs VLSM (Variable Length Subnet Mask):** VLSM is the technique of using different subnet masks on different subnets within the same network to optimize address usage. CIDR notation is the method of writing those subnet masks. VLSM is what you do; CIDR is how you write it. You need CIDR to implement VLSM. (Example: Using /26 for one subnet and /28 for another within the same /24 is VLSM. Each subnet is described with CIDR notation.)
- **CIDR notation vs Route summarization:** Route summarization (also called supernetting) is the process of combining multiple contiguous network prefixes into a single larger prefix. CIDR notation is the format used to express that larger prefix. Summarization is an action, CIDR is the representation. (Example: Combining 192.168.0.0/24 and 192.168.1.0/24 into 192.168.0.0/23 is route summarization. The result is expressed in CIDR notation.)
- **CIDR notation vs IP address class (Class A, B, C):** Classful addressing assumed fixed network boundaries based on the first few bits (Class A /8, Class B /16, Class C /24). CIDR notation allows any prefix length, not just these three, making it much more flexible. Classful is obsolete; CIDR is the modern standard. (Example: Under classful rules, 10.0.0.0 is always a Class A with /8. With CIDR, you can use 10.0.0.0/16 if you want a smaller network.)

## Step-by-step breakdown

1. **Identify the prefix length** — Read the number after the slash. For example, in 172.16.5.0/20, the prefix length is 20. This tells you that the first 20 bits of the IP address are the network portion. The remaining 12 bits are for hosts.
2. **Determine the octet boundary** — Since each octet has 8 bits, a /20 means the network bits end in the third octet (bits 17–20 are in that octet). Specifically, 20 bits covers the first two octets (16 bits) plus 4 bits of the third octet. So the boundary is within the third octet.
3. **Calculate the block size in the boundary octet** — The number of host bits in the boundary octet is 8 minus the number of network bits in that octet. For /20, there are 4 network bits in the third octet, so 4 host bits remain in that octet. The block size is 2^4 = 16. This means the network addresses in the third octet are multiples of 16.
4. **Find the network address** — Take the original IP's third octet value and round it down to the nearest multiple of the block size. For 172.16.5.0/20, the third octet is 5. The multiples of 16 are 0, 16, 32, etc. The nearest multiple less than or equal to 5 is 0. So the network address is 172.16.0.0.
5. **Find the broadcast address** — Add the block size to the network address in the boundary octet, then subtract 1. For 172.16.0.0/20, the next network is 172.16.16.0. Subtraction gives 172.16.15.255. This is the broadcast address for the subnet.
6. **Determine the usable host range** — The first usable host is the network address plus 1. The last usable host is the broadcast address minus 1. For our example, the usable range is 172.16.0.1 to 172.16.15.254.
7. **Calculate the number of usable hosts** — The total number of addresses in the subnet is 2^(32 - prefix length) = 2^12 = 4096. Subtract 2 (network and broadcast) to get 4094 usable hosts.

## Practical mini-lesson

CIDR notation is not just a theory topic; it is a daily tool for network engineers, cloud architects, and security professionals. When you design a network, the first step is to plan your IP address scheme using CIDR blocks. You need to consider current device counts and future growth. The most common mistake in practice is underestimating growth, leading to a subnet that is too small. For example, you might assign a /28 (14 usable hosts) to a department that currently has 10 devices, but next year they add 10 more and you have to re-IP everyone. Always leave at least 20-30% overhead.

In cloud environments like AWS or Azure, when you create a VPC (Virtual Private Cloud), you must specify a CIDR block. For example, you might choose 10.0.0.0/16. Then within that VPC, you create subnets with smaller CIDR blocks, like 10.0.1.0/24 for the web tier, 10.0.2.0/24 for the application tier, and 10.0.3.0/24 for the database tier. If you choose a VPC CIDR that is too small, you cannot expand it later. This is a common pitfall for beginners.

When configuring a router, you might enter commands like 'ip route 0.0.0.0 0.0.0.0 192.168.1.1' for a default route, but more commonly you will see 'ip route 0.0.0.0/0 192.168.1.1' in modern CLI environments. Understanding CIDR allows you to read routing tables efficiently. The 'show ip route' command on a Cisco device displays routes in CIDR format: '10.0.0.0/16 is subnetted, 4 subnets'. You need to interpret the prefix length to know the subnet mask applied.

What can go wrong? The most frequent issue is overlapping subnets. If you have a subnet 10.0.1.0/25 and another subnet 10.0.1.128/25, they do not overlap. But if you accidentally assign 10.0.1.0/24 and 10.0.1.128/25, the second subnet is fully contained within the first, causing routing confusion. Always verify that your CIDR blocks are non-overlapping. Another common issue is using the wrong prefix length on a point-to-point link. Using a /24 on a serial link between two routers wastes 252 IP addresses. The correct and standard practice is to use /30 or /31.

Professionals also use CIDR notation in security groups and firewall rules. For example, in AWS, a security group rule might allow inbound traffic from 10.0.0.0/16. If you mistakenly write 10.0.0.0/24, you block traffic from 10.0.1.0 and later subnets, breaking your application. CIDR notation is also used in BGP routing policies where ISPs announce prefixes to the global internet. If you announce a /24 instead of a /23, you might attract traffic for addresses you do not own, causing blackholing. Thus, precision in CIDR notation is critical in production environments.

## Memory tip

The slash number is the number of 1s in the subnet mask. For a /24, think of 24 bits of network, like 24 hours in a day, it covers the whole day (the whole network). For more bits, the network is bigger; for fewer bits, it is smaller.

## FAQ

**What does the slash number mean in CIDR notation?**

The slash number, also called the prefix length, indicates how many bits of the IP address are used for the network portion. For example, /24 means the first 24 bits identify the network, and the remaining 8 bits identify hosts on that network.

**Is CIDR notation the same as a subnet mask?**

CIDR notation is a shorthand way of writing a subnet mask. For example, /24 corresponds to the subnet mask 255.255.255.0. They represent the same thing but in different formats.

**Why was CIDR introduced?**

CIDR was introduced to slow the exhaustion of IPv4 addresses and reduce the size of internet routing tables. It replaced the inefficient classful system that wasted many addresses.

**How do I calculate the number of usable hosts in a /28 network?**

A /28 has 32 total bits, with 28 network bits and 4 host bits. The number of usable hosts is 2^4 minus 2, which is 16 minus 2 equals 14 usable hosts.

**Can CIDR notation be used for IPv6?**

Yes, CIDR notation is also used for IPv6 addresses. For IPv6, the prefix length ranges from 0 to 128, and it is written the same way, for example, 2001:db8::/32.

**What is the difference between /24 and /25?**

A /24 network has 24 network bits and 8 host bits, giving 256 total addresses (254 usable). A /25 network has 25 network bits and 7 host bits, giving 128 total addresses (126 usable). A /25 is half the size of a /24.

**How do I find the network address from an IP with CIDR notation?**

To find the network address, set all host bits to 0. The host bits are the bits after the prefix length. For example, for 192.168.1.100/26, the host bits are the last 6 bits. Set them to 0, giving 192.168.1.64 as the network address.

## Summary

CIDR notation is a compact and efficient way to represent an IP address and its associated network prefix, fundamentally changing how IP addresses are allocated and routed on the internet. It replaced the outdated classful system by allowing any prefix length, enabling precise allocation of address space and reducing waste. Understanding CIDR notation is essential for anyone working in IT, as it appears in network configuration, routing protocols, cloud computing, and security rules. The slash number (prefix length) tells you how many bits identify the network, and the rest are for hosts. From this, you can calculate network addresses, broadcast addresses, and usable host ranges.

For the CCNA certification, CIDR notation is a core topic that appears in multiple-choice questions, simulations, and troubleshooting scenarios. You must be comfortable converting between subnet masks and slash notation, calculating subnets of varying sizes, and applying VLSM. Common mistakes include forgetting to subtract 2 for usable hosts, confusing network and broadcast addresses, and misidentifying the boundary octet. The step-by-step process of determining the prefix length, finding the octet boundary, calculating the block size, and deriving the network and broadcast addresses will serve you well in both exams and real-world work. Mastering CIDR notation is not optional for network professionals; it is the language of modern IP networking.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/cidr-notation