What CIDR notation actually means

10.0.0.0/8 is a compact way of writing a range of addresses. The slash number is the only part that varies.

Classless Inter-Domain Routing replaced the old class A, B and C system, where the size of a network was decided by its first octet. CIDR lets a network be any power-of-two size, which is why the prefix length is written explicitly.

Reading a prefix

The number after the slash counts the fixed leading bits. Everything after them varies, so the prefix covers 2^{(32 − length)} addresses for IPv4.

• /24 — 256 addresses, the size people think of as a subnet.
• /16 — 65,536 addresses.
• /8 — 16.7 million.
• /30 — four addresses, two usable.

Each step down the prefix length doubles the size. A /23 is exactly two /24s.

Prefixes start on their own boundary

A prefix must begin at an address that is a multiple of its own size. 10.0.1.0/24 is valid; 10.0.1.128/24 is not, because a /24 must start on a multiple of 256. This is why an arbitrary range of addresses often needs several prefixes to express exactly.

Containment and overlap are different

Contained means every address of one prefix lies inside another. 10.1.0.0/16 is contained in 10.0.0.0/8.

Overlapping means they share some addresses but neither holds the other. In a well-formed addressing plan this should not happen, and when it does it is a mistake worth finding — two subnets sharing addresses will produce intermittent, hard-to-diagnose faults.

The private ranges

Three IPv4 ranges are reserved for private use by RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Note the middle one carefully — it covers 172.16 through 172.31, so 172.32.0.1 is a public address that belongs to somebody else. Using it internally causes a failure that appears only when you try to reach the real owner.

Frequently asked questions

How many addresses are in a /22?

1,024. Each step down from /24 doubles the size, so /23 is 512 and /22 is 1,024.

Why can a prefix not start at any address?

Because the leading bits are fixed. A /24 must begin at a multiple of 256, which is what makes routing lookups efficient.

Is 172.20.0.0 private?

Yes. The private range is 172.16.0.0/12, covering 172.16 through 172.31. 172.32 onwards is public.

What is the difference between contained and overlapping?

Contained means one prefix sits entirely inside the other. Overlapping means they share addresses but neither holds the other, which almost always signals a planning error.