LFCE 9 🐧 CIDR Notation Explained
CIDR notation is the syntax that made classless routing operational. It compresses the essential information of an IP prefix—the network address and the length of the network portion—into a single compact string: 192.168.1.0/24. The slash is not decoration. It separates the address from the prefix length, and that prefix length is the number of leading bits that identify the network. Everything that follows from classless addressing—variable-length subnetting, route aggregation, longest-prefix match—depends on this notation being understood precisely. For the LFCE candidate, CIDR notation appears in every routing daemon configuration, every firewall rule, and every interface assignment. Misreading a prefix length is the difference between a working route and a silent blackhole.
This chapter explains the syntax of CIDR notation, the relationship between the prefix length and the dotted-decimal subnet mask, the arithmetic that produces network and broadcast addresses, and the practical tools Linux provides for verification. The goal is fluency: the ability to read /26 and immediately know that the mask is 255.255.255.192, that the block contains 64 addresses, and that 62 of them are usable hosts.
Key point: CIDR notation is address/prefix-length. The prefix length is the number of leading bits set to 1 in the subnet mask, and therefore the number of bits that identify the network. The remaining bits identify hosts within that network. The two notations—/24 and 255.255.255.0—are interchangeable, but the slash notation is the one routing protocols transmit and the one Linux expects in ip route commands.
Why CIDR notation exists
The ambiguity problem.
A bare IPv4 address like 192.168.1.5 does not tell you where the network ends and the host begins. Without a prefix length, a router cannot determine which routing table entry applies. In the classful era, the first octet supplied this information implicitly: 192 meant Class C, so the network was 24 bits. Once classful addressing was abandoned, the boundary became arbitrary. A network could be 22 bits, 26 bits, or 30 bits. The notation had to carry that information explicitly. CIDR notation attaches the prefix length to the address, making the boundary unambiguous in every context—configuration files, routing updates, documentation, and logs.
The aggregation problem.
CIDR was introduced in RFC 1519 as an address assignment and aggregation strategy . Aggregation requires expressing a range of addresses as a single prefix. A service provider holding 2,048 Class C networks could advertise one supernet route instead of 2,048 individual routes, but only if the notation could express the aggregated prefix length. The slash notation made this possible: 192.24.0.0/13 represents a block that would otherwise require thousands of entries . Without a compact, unambiguous way to state the prefix length, CIDR aggregation could not have been deployed.
The parsing problem.
Every piece of software that processes IP addresses must parse the network/host boundary. The slash notation provides a single delimiter that is trivial to parse: split on /, validate the address on the left, validate the integer on the right. The integer is the bit count. There is no ambiguity about which octet contains the boundary, no reliance on class rules, no inference from the address value. This simplicity is why /24 survived as the universal notation while dotted-decimal masks persist mainly in legacy interface configurations and human-readable documentation.
a. The syntax and the mask relationship
CIDR notation consists of an IPv4 address followed by a slash and an integer from 0 to 32. The integer is the prefix length—the number of leading bits in the 32-bit address that belong to the network portion .
# CIDR notation examples and their dotted-decimal masks
# /24 → 255.255.255.0 24 network bits, 8 host bits
# /26 → 255.255.255.192 26 network bits, 6 host bits
# /22 → 255.255.252.0 22 network bits, 10 host bits
# /30 → 255.255.255.252 30 network bits, 2 host bits
# The mask is constructed by setting the first N bits to 1
# /26: 11111111.11111111.11111111.11000000
# 255 .255 .255 .192The mask is not a separate piece of information. It is derived directly from the prefix length. A /26 means the first 26 bits of the mask are 1, and the remaining 6 bits are 0. In dotted decimal, that is 255.255.255.192. The address and the mask are always used together; the prefix length is the compact representation of the mask .
# Both forms are accepted by Linux networking tools
ip addr add 192.168.1.5/24 dev eth0 # CIDR notation
ip addr add 192.168.1.5/255.255.255.0 dev eth0 # Dotted-decimal mask (less common)Linux accepts both, but the CIDR form is the convention in routing tables and routing protocol configurations. When you read an OSPF or BGP advertisement, the prefix length is the syntax. When you write a firewall rule with iptables or nftables, the CIDR form is the one that matches multiple addresses compactly.
b. Address arithmetic from the prefix length
The prefix length determines three quantities: the network address, the broadcast address, and the usable host range. The network address is the address with all host bits set to 0. The broadcast address is the address with all host bits set to 1. The usable hosts lie between them.
# Calculate the network and broadcast for 192.168.1.70/26
# Prefix length 26 → 6 host bits
# Host bit mask: 63 (binary 00111111)
# Network address: 70 AND NOT 63 = 64 → 192.168.1.64
# Broadcast address: 64 OR 63 = 127 → 192.168.1.127
# Usable hosts: .65 through .126 (62 addresses)The bitwise AND with the inverted host mask produces the network address. The bitwise OR with the host mask produces the broadcast address. This is the arithmetic that ipcalc and subnetcalc perform internally . Doing it manually is possible but error-prone; the tools exist because the calculation must be exact.
# Using subnetcalc to verify the arithmetic
subnetcalc 192.168.1.70/26
# Output includes:
# Network: 192.168.1.64
# Broadcast: 192.168.1.127
# Host range: 192.168.1.65 - 192.168.1.126
# Max hosts: 62The host capacity formula is 2^h − 2, where h is the number of host bits (32 minus the prefix length). The subtraction accounts for the network and broadcast addresses, neither of which can be assigned to a host . A /26 has 6 host bits, so 64 total addresses and 62 usable hosts. A /30 has 2 host bits, so 4 total addresses and 2 usable hosts—the standard point-to-point link prefix.
c. Longest-prefix match and aggregation
CIDR notation enables the routing behavior that makes the modern internet scalable: longest-prefix match. When multiple routes match a destination, the router selects the one with the longest prefix length—the most specific route. This is how aggregation and specific advertisements coexist.
# Two routes for the same address space
ip route add 192.168.0.0/16 via 10.0.0.1 # Aggregate route
ip route add 192.168.5.0/24 via 10.0.0.2 # More specific route
# A packet to 192.168.5.10 matches both routes
# The /24 is longer than the /16, so the /24 route wins
ip route get 192.168.5.10
# Output: 192.168.5.10 via 10.0.0.2
# A packet to 192.168.6.10 matches only the /16
ip route get 192.168.6.10
# Output: 192.168.6.10 via 10.0.0.1Aggregation is the reverse operation: combining contiguous prefixes into a single shorter prefix. A /16 can represent 256 /24 networks. The service provider advertises the /16, and the internal routers carry the more specific /24 routes. External routers see only the aggregate, reducing the global routing table size . This only works because the notation allows a prefix length to be stated independently of the address value.
Complete Example Session
# ============================================
# PART 1: READING CIDR NOTATION
# ============================================
# 10.20.30.0/22
# The address is 10.20.30.0
# The prefix length is 22
# Network bits: 22 (first two octets plus 6 bits of the third)
# Host bits: 10 (2 bits of the third octet plus the fourth octet)
# ============================================
# PART 2: DERIVING THE SUBNET MASK
# ============================================
# /22 means 22 leading 1 bits
# Binary: 11111111.11111111.11111100.00000000
# Decimal: 255.255.252.0
# The third octet mask is 252 (binary 11111100)
# ============================================
# PART 3: CALCULATING THE NETWORK ADDRESS
# ============================================
# Address: 10.20.30.0
# Third octet: 30 (binary 00011110)
# Mask third octet: 252 (binary 11111100)
# 30 AND 252 = 28 (binary 00011100)
# Network address: 10.20.28.0/22
# The /22 covers 10.20.28.0 through 10.20.31.255
# ============================================
# PART 4: VERIFYING WITH SUBNETCALC
# ============================================
subnetcalc 10.20.30.0/22
# Confirms network 10.20.28.0, broadcast 10.20.31.255
# Usable hosts: 10.20.28.1 through 10.20.31.254 (1,022 hosts)
# ============================================
# PART 5: CONFIGURING AN INTERFACE WITH CIDR
# ============================================
# Assign the first usable address to a router interface
ip addr add 10.20.28.1/22 dev eth0
# The /22 tells the kernel the network boundary
# The kernel will consider 10.20.28.0 through 10.20.31.255 directly connected
# ============================================
# PART 6: ADDING A CIDR ROUTE
# ============================================
# Route to a remote /26 network
ip route add 192.168.100.64/26 via 10.20.28.254
# The /26 is explicit; the kernel does not infer it from the address
# ============================================
# PART 7: LONGEST-PREFIX MATCH IN ACTION
# ============================================
# Add both an aggregate and a specific route
ip route add 192.168.0.0/16 via 10.20.28.1
ip route add 192.168.100.0/24 via 10.20.28.2
# Traffic to 192.168.100.64/26:
ip route get 192.168.100.70
# Matches /24 (longer than /16), goes via 10.20.28.2
# ============================================
# PART 8: AGGREGATION WITH CIDR
# ============================================
# Four contiguous /24s: 192.168.4.0/24 through 192.168.7.0/24
# They share the first 22 bits: 192.168.4.0/22
# One aggregate route replaces four specific routes
ip route add 192.168.4.0/22 via 10.20.28.3
# Remote routers need only this single entry
# ============================================
# PART 9: THE /30 POINT-TO-POINT PREFIX
# ============================================
# A /30 provides exactly 2 usable addresses
ip addr add 10.0.0.1/30 dev eth1
# The peer address is 10.0.0.2; broadcast is 10.0.0.3
# CIDR notation makes this efficient allocation possible
# ============================================
# PART 10: THE DEFAULT ROUTE AS /0
# ============================================
# The default route is the ultimate aggregate: prefix length 0
ip route add default via 10.20.28.254
# Equivalent to:
ip route add 0.0.0.0/0 via 10.20.28.254
# /0 means zero network bits; every address matchesThe ten parts traced CIDR notation from its syntax through mask derivation, network address calculation, interface configuration, longest-prefix match, and aggregation. The notation is not merely a shorthand; it is the syntax that carries the network boundary through every layer of configuration and routing.
Quick Reference
CIDR to Mask Conversion
| Prefix | Mask (dotted decimal) | Host Bits | Usable Hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 8 | 254 |
| /25 | 255.255.255.128 | 7 | 126 |
| /26 | 255.255.255.192 | 6 | 62 |
| /27 | 255.255.255.224 | 5 | 30 |
| /28 | 255.255.255.240 | 4 | 14 |
| /29 | 255.255.255.248 | 3 | 6 |
| /30 | 255.255.255.252 | 2 | 2 |
| /22 | 255.255.252.0 | 10 | 1,022 |
| /16 | 255.255.0.0 | 16 | 65,534 |
| /0 | 0.0.0.0 | 32 | 4,294,967,294 |
CIDR Operations
| Operation | Formula | Example |
|---|---|---|
| Network address | Address AND mask | 192.168.1.70/26 → .64 |
| Broadcast address | Network OR inverted host mask | .64 → .127 |
| Usable hosts | 2^(32−prefix) − 2 | /26 → 62 |
| Increment | 256 − mask_octet | /26 → 256−192 = 64 |
Linux Commands
| Command | Purpose |
|---|---|
ip addr add 10.0.0.1/24 dev eth0 | Assign CIDR address to interface |
ip route add 192.168.0.0/16 via 10.0.0.1 | Add CIDR route |
ip route get 192.168.5.10 | Verify longest-prefix match |
subnetcalc 192.168.1.70/26 | Calculate network, broadcast, host range |
Best Practices
✅ Do This:
# Always use CIDR notation in route commands
ip route add 192.168.4.0/22 via 10.0.0.1 # ✅
# Verify the network address before assigning
subnetcalc 192.168.1.70/26 # ✅
# Use /30 for point-to-point links
ip addr add 10.0.0.1/30 dev eth0 # ✅
# Aggregate contiguous prefixes into a shorter prefix
ip route add 192.168.4.0/22 via 10.0.0.1 # ✅
# Check longest-prefix match with ip route get
ip route get 192.168.5.10 # ✅
# Use /0 for the default route
ip route add default via 10.0.0.1 # ✅❌ Don’t Do This:
# Assume the mask from the address
# 192.168.1.0 is not necessarily /24 in a classless world # ❌
# Use a /24 for a router-to-router link
ip addr add 10.0.0.1/24 dev eth0 # Wastes 252 addresses # ❌
# Add a route without a prefix length
ip route add 192.168.0.0 via 10.0.0.1 # Ambiguous # ❌
# Ignore the prefix length in routing protocol config
# OSPF network statements require the mask # ❌
# Assume a /26 route matches a /24 destination
# The /24 does not match the /26; prefixes are directional # ❌
# Use dotted-decimal masks in routing tables
# CIDR notation is the convention and the parser's expectation # ❌Common Pitfalls
| Pitfall | Why It Happens | Fix |
|---|---|---|
| Route does not match expected traffic | Longer prefix exists elsewhere | ip route get to verify selected route |
| Network address assigned to a host | Host bits not zero | Calculate network address first |
| Wrong broadcast address | Host bits not all one | Network OR inverted mask |
| Prefix length omitted from route | Assuming classful behavior | Always include /N |
| Aggregation fails | Prefixes not contiguous | Verify bit alignment before summarizing |
| Interface prefix mismatches subnet | Copy-paste error | ip addr show to confirm |
/0 route not recognized | Syntax error | Use default or 0.0.0.0/0 |
Real-World Examples
1. Assign a /26 interface
ip addr add 192.168.1.65/26 dev eth0
# Network is 192.168.1.64; host range .65-.1262. Add an aggregate route
ip route add 10.0.0.0/8 via 192.168.1.1
# One route covers all 10.x.x.x addresses3. Verify longest-prefix match
ip route add 10.0.0.0/8 via 10.0.0.1
ip route add 10.1.0.0/16 via 10.0.0.2
ip route get 10.1.2.3 # Matches /164. Calculate a /27 network
subnetcalc 192.168.1.100/27
# Network 192.168.1.96, broadcast .127, hosts .97-.1265. Point-to-point /30
ip addr add 172.16.0.1/30 dev eth0
ip addr add 172.16.0.2/30 dev eth16. Default route as /0
ip route add 0.0.0.0/0 via 192.168.1.17. Subnet a /22 into /24s
ip route add 10.20.28.0/24 via 10.0.0.1
ip route add 10.20.29.0/24 via 10.0.0.18. Check the mask on an interface
ip addr show eth0 | grep inet
# Output includes the /prefix9. BGP prefix advertisement
# Advertise 192.168.4.0/22 in BGP
network 192.168.4.0/2210. Firewall rule with CIDR
iptables -A INPUT -s 10.0.0.0/8 -j ACCEPT
# Matches all 10.x.x.x addressesVisual
CIDR Notation Anatomy
┌──────────────────────────────────────────────────────────────┐
│ 10.20.30.0/22 — THE TWO PARTS OF CIDR NOTATION │
│ │
│ ┌─────────────────────┐ ┌─────────────────────────────┐ │
│ │ 10.20.30.0 │ │ /22 │ │
│ │ The IPv4 address │ │ Prefix length │ │
│ └─────────────────────┘ └─────────────────────────────┘ │
│ │
│ Prefix length 22 means: │
│ ├─ Network bits: 22 ────────────────────────────┤ │
│ └─ Host bits: 10 ────────────────────┤ │
│ │
│ Mask: 11111111.11111111.11111100.00000000 │
│ 255 .255 .252 .0 │
│ │
│ Network address: 10.20.28.0 (host bits all zero) │
│ Broadcast: 10.20.31.255 (host bits all one) │
│ Usable hosts: 10.20.28.1 – 10.20.31.254 (1,022) │
└──────────────────────────────────────────────────────────────┘Prefix Length and Host Capacity
┌──────────────────────────────────────────────────────────────┐
│ PREFIX LENGTH DETERMINES NETWORK SIZE │
│ │
│ /24 ────────────────────────────────────────────────────── │
│ 24 network bits │ 8 host bits │
│ Mask: .0 │ 256 addresses, 254 usable │
│ │
│ /26 ────────────────────────────────────────────────────── │
│ 26 network bits │ 6 host bits │
│ Mask: .192 │ 64 addresses, 62 usable │
│ │
│ /30 ────────────────────────────────────────────────────── │
│ 30 network bits │ 2 host bits │
│ Mask: .252 │ 4 addresses, 2 usable (point-to-point) │
│ │
│ /0 ─────────────────────────────────────────────────────── │
│ 0 network bits │ 32 host bits │
│ Mask: .0 │ 4,294,967,296 addresses (default route) │
│ │
│ Larger prefix = smaller network = fewer hosts. │
└──────────────────────────────────────────────────────────────┘Longest-Prefix Match
┌──────────────────────────────────────────────────────────────┐
│ ROUTING DECISION WITH CIDR PREFIXES │
│ │
│ Routing table: │
│ ┌─────────────────────┬──────────────┬──────────────────┐ │
│ │ Prefix │ Next Hop │ Prefix Length │ │
│ ├─────────────────────┼──────────────┼──────────────────┤ │
│ │ 10.0.0.0/8 │ 192.168.1.1 │ 8 │ │
│ │ 10.1.0.0/16 │ 192.168.1.2 │ 16 │ │
│ │ 10.1.2.0/24 │ 192.168.1.3 │ 24 │ │
│ └─────────────────────┴──────────────┴──────────────────┘ │
│ │
│ Packet to 10.1.2.5: │
│ Matches /8, /16, and /24 → /24 is longest → 192.168.1.3 │
│ │
│ Packet to 10.1.3.5: │
│ Matches /8 and /16 → /16 is longest → 192.168.1.2 │
│ │
│ Packet to 10.2.3.5: │
│ Matches /8 only → 192.168.1.1 │
│ │
│ Longest prefix wins. This is CIDR's core routing rule. │
└──────────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
| CIDR notation syntax | address/prefix-length, e.g., 192.168.1.0/24 |
| Prefix length | Number of leading bits identifying the network (0–32) |
| Mask derivation | First N bits set to 1; remaining bits 0 |
/24 equivalent | 255.255.255.0 |
/26 equivalent | 255.255.255.192 |
| Network address | Address with all host bits = 0 |
| Broadcast address | Address with all host bits = 1 |
| Usable hosts | 2^(32−prefix) − 2 |
/0 | Default route; matches every address |
/30 | Point-to-point link; 2 usable hosts |
| Longest-prefix match | Most specific route wins |
| Aggregation | Combining contiguous prefixes into a shorter prefix |
Key takeaways:
- CIDR notation carries the network boundary explicitly. A bare address is ambiguous; the
/Nsuffix resolves the ambiguity by stating exactly how many leading bits belong to the network. - The prefix length and the mask are the same information.
/26and255.255.255.192are interchangeable representations. The slash form is the one routing protocols and Linux configuration use. - Host capacity follows from the prefix length. The formula
2^(32−prefix) − 2gives usable hosts. A/26has 62; a/30has 2. - The network address is not the first host. It is the address with all host bits zero. The first usable host is network address + 1.
- Longest-prefix match makes aggregation possible. A
/16aggregate covers many/24networks, and the/24routes win for traffic within their specific ranges . - Linux expects CIDR in route commands.
ip route add 10.0.0.0/8 via ...is the syntax. Omitting the prefix length produces an error or an ambiguous route. /0is the default route. It means zero network bits and matches every destination.ip route add defaultandip route add 0.0.0.0/0are equivalent.
Remember: CIDR notation is the language that classless routing speaks. Every prefix you configure—whether on an interface, in a routing daemon, or in a firewall rule—uses this syntax. The slash is the boundary between the address and the network length, and that length is the single most important number in the configuration. Read it correctly, calculate the mask and host range correctly, and the routing follows. Misread it, and you will advertise unreachable networks or drop traffic that should have been delivered.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!