CIDR: Flexible IP Address Blocks

WHY IT EXISTS The original internet used a "classful" system (Class A, B, C) that assigned IP addresses in huge, inflexible chunks. This was wasteful, leading to rapid exhaustion of IPv4 addresses and enormous, unmanageable routing tables on internet routers. CIDR was created in 1993 to fix this by allowing for flexible, variable-sized address blocks.

THE MENTAL MODEL Think of CIDR as creating custom-sized zip codes for the internet. Instead of just having small (Class C), medium (Class B), and large (Class A) zip codes, you can define a region of any size you need. A single CIDR route, like 10.0.0.0/8, can represent millions of individual addresses, collapsing what would have been thousands of separate routes into one entry in a router's table.

HOW IT WORKS CIDR adds a slash and a number to an IP address, like 192.168.100.0/24. This is the "prefix length". The number indicates how many bits of the 32-bit IP address are part of the fixed network portion. The remaining bits are for individual hosts. For a /24, the first 24 bits are the network, leaving 8 bits (32 - 24) for hosts, which allows for 256 addresses. For a /16, the first 16 bits are the network, leaving 16 bits for hosts, or 65,536 addresses.

WHEN TO USE IT CIDR is fundamental for defining Virtual Private Clouds (VPCs), subnets within a VPC, firewall rules (like allowing traffic from a specific IP range), and access control lists. It is the standard way to specify any contiguous range of IP addresses in modern networking and cloud computing.

WHEN NOT TO USE IT The main footgun is misinterpreting the prefix length; a smaller number means a larger network. For example, a /8 is a massive block of over 16 million addresses, while a /29 is a tiny block of only 8 addresses. This inverse relationship is a common source of configuration errors. Also, CIDR can only represent a single, contiguous block of IPs. You cannot use one CIDR block to represent a set of random, non-sequential addresses.

ONE CANONICAL EXAMPLE A common setup in AWS is to create a VPC with the CIDR block 10.0.0.0/16. This gives you a private network with 65,536 total IP addresses. You can then carve this up into smaller subnets. For example, a public web server subnet might be 10.0.1.0/24 (256 addresses), and a private database subnet might be 10.0.2.0/24 (another 256 addresses), all neatly organized within the larger VPC block.