CIDR Basics: Prefixes, Blocks, and Route Summarization

CIDR notation — 192.168.1.0/24 — is everywhere: routing tables, cloud security groups, firewall rules. The slash number is not decoration; it defines the size and shape of the network. This article covers what a prefix length really means, how to get the usable range in one pass, how supernetting combines routes, and how CIDR translates into firewall wildcard masks. Every step can be checked with the CIDR calculator.

What a prefix length really means

An IPv4 address is 32 bits long. The prefix length counts the leading bits that identify the network; the rest identify hosts. So /24 means the first 24 bits are the network and the last 8 are hosts — the same thing as the subnet mask 255.255.255.0, twenty-four 1-bits followed by eight 0-bits. CIDR replaced classful addressing in 1993, so the slash form is what you meet in modern tooling.

Two consequences follow. A longer prefix means a smaller network: /16 covers 65,536 addresses, /24 covers 256. And the address count is always a power of two, because host bits come in groups — which is why "give me 100 addresses" resolves to 128, the next power up.

From CIDR to usable range in one pass

Turning a prefix into a usable range takes three steps. First, zero every host bit to find the network address — that is what "192.168.1.50/24" really means: the network is 192.168.1.0, not .50. Second, set every host bit to one for the broadcast address — 192.168.1.255 for a /24. Third, the usable range sits between them: 192.168.1.1 through 192.168.1.254, the total minus two reserved addresses.

Two edge cases matter. A /31 has no usable range under the classic rule, but RFC 3021 allows using both addresses for point-to-point links. A /32 is a single host route, common in firewall rules. If you would rather not do the arithmetic by hand, paste the address into the CIDR calculator for the network, broadcast, and host range.

Supernetting: combining routes

Supernetting — route summarization — merges contiguous prefixes that share leading bits into one shorter prefix. Take 10.0.0.0/24 through 10.0.3.0/24: in the third octet those are 0, 1, 2, 3 — binary 000000xx — so the first 22 bits are identical and the four routes collapse into one 10.0.0.0/22. Smaller routing tables mean faster lookups and simpler firewall policies.

The rule that trips people up is alignment: a summary block must start on a multiple of its own size. You cannot summarise 10.0.1.0/24 and 10.0.2.0/24 into a /23, because a /23 boundary requires an even third octet. The smallest prefix covering both is 10.0.0.0/22, which also swallows 10.0.0.0/24 and 10.0.3.0/24 — summarising too broadly blackholes traffic. For a start and end address instead of a clean prefix, the IP range to CIDR converter gives you the exact covering block.

CIDR in firewall rules (wildcard masks)

Cisco ACLs and several other firewall dialects do not take subnet masks; they take wildcard masks, where 0 means "this bit must match" and 1 means "do not care". A wildcard mask is the inverse of a subnet mask, so a /24 (255.255.255.0) becomes 0.0.0.255: the rule permit 192.168.1.0 0.0.0.255 allows the entire 192.168.1.0/24, and a single host uses 0.0.0.0.

Cloud security groups and most modern tools speak CIDR directly, so reserve wildcard masks for the platforms that demand them — mixing conventions is a reliable way to open a rule far wider than intended. Either way, confirm the boundaries with the CIDR calculator before the rule goes live.