In one sentence
CIDR notation writes an IP range as an address plus a prefix length — 10.20.30.0/26 — where the number after the slash says how many leading bits are the network and therefore how many addresses the block contains.
Why it matters
Every firewall rule, cloud security group, SPF record, allow-list and threat-intel feed expresses ranges in CIDR. Read it wrong and a rule meant for one office subnet opens a quarter of the internet, or a block-list entry for one attacker IP silences a hosting provider's whole customer base. Being able to look at /22 and know "1,024 addresses, four consecutive /24s" is the difference between reviewing a change and rubber-stamping it.
It also matters for scoping: a pentest authorised for 203.0.113.0/28 covers sixteen addresses, .0 to .15, and nothing else. Scanning .16 is out of scope, and "I thought /28 was 32" is not a defence.
How it works
An IPv4 address is 32 bits. The prefix length is how many of them, from the left, identify the network; the rest identify hosts within it. /24 leaves 8 host bits, so 28 = 256 addresses; /26 leaves 6, so 64. The subnet mask is the same information as a dotted number: /24 is 255.255.255.0, /26 is 255.255.255.192.
In each block two addresses are conventionally unusable for hosts: the first (network address) and the last (broadcast). So a /26 has 62 usable hosts, a /24 has 254, a /30 has 2 — and a /31, per RFC 3021, has exactly 2 with no network/broadcast, which is why point-to-point links use it. A /32 is one host. Blocks must be aligned: 10.0.0.64/26 is valid; 10.0.0.100/26 is not a network address, and most tools will silently normalise it to 10.0.0.64/26 — which may not be what you meant.
Ranges you will meet constantly: the RFC 1918 private space 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback 127.0.0.0/8; link-local 169.254.0.0/16; carrier-grade NAT 100.64.0.0/10; and the documentation ranges used throughout this site, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 (RFC 5737). IPv6 works identically with 128 bits; a /64 is the standard LAN and a /48 a typical site allocation.
Try it yourself hands-on
A change request asks to allow 10.20.30.100/26 through the firewall to a database, "for the new VDI pool". Before approving:
- Put
10.20.30.100/26into the CIDR Calculator. It reports network 10.20.30.64, broadcast 10.20.30.127, mask 255.255.255.192, first/last usable .65–.126, 62 hosts. So the rule as written matches .64–.127, not "from .100 onwards" — and it includes .65–.99, whatever those are. - Ask what the VDI pool really is. If it is .100–.127, switch to the calculator's IP range mode and enter start
10.20.30.100, end10.20.30.127: it returns the exact CIDR blocks that cover it —10.20.30.100/30,10.20.30.104/29,10.20.30.112/28— three rules with zero extra addresses, or a single10.20.30.96/27(.96–.127) if four spare addresses are acceptable. Either is the rule to approve, with the request corrected. - Check for overlap with existing rules: calculate
10.20.30.0/24and read its range, .0–.255 — it already contains everything above. If a /24 rule to the database exists, this change adds nothing and should be closed. - Working from a scan instead? Load the Nmap output into the Nmap XML Parser to list the live hosts, then size the block from what actually answered rather than from the request form.
Common misreadings
- Bigger prefix number = smaller block. /8 is 16 million addresses; /30 is four. Newcomers reverse it.
- A /0 matches everything.
0.0.0.0/0in a security group means "the internet". Cloud consoles flag it for a reason. - Threat intel in /24s is a blunt instrument. Blocking a hosting provider's /24 because of one malicious IP blocks 253 neighbours; blocking a /32 is what the evidence supports.