CIDR (Classless Inter-Domain Routing)
Definition
A compact notation for IP address ranges that appends a prefix length to the address, such as 192.168.1.0/24. The prefix length states how many leading bits identify the network. CIDR replaced the older Class A/B/C system and is the standard notation in routing tables, firewall rules, and WHOIS records.
- Full name
- Classless Inter-Domain Routing
- Notation example
- 192.168.1.0/24
- Replaced
- Older Class A/B/C addressing system
- Used in
- Routing tables, firewall rules, WHOIS records
Common questions
What does the number after the slash in a CIDR block actually mean?+
It states how many leading bits of the address are fixed as the network portion, so a /24 fixes the first 24 bits and leaves the remaining 8 bits for host addresses, giving 256 possible addresses in that block.
Why does an investigator need to understand CIDR when reading a WHOIS or abuse report?+
Ownership and routing records are commonly published as CIDR blocks rather than individual addresses, so recognising that a report covers a /24 or /16 block tells the investigator the size of the address range attributable to a given organisation, not just one IP.
How did CIDR improve on the old Class A/B/C system it replaced?+
The old system allocated addresses in fixed large blocks that often wasted address space, while CIDR allows arbitrary-sized blocks matched to actual need, which both conserved the limited IPv4 address pool and reduced the size of global routing tables.
Related terms
- Autonomous System (AS)
- A collection of IP networks operated under a single routing policy and identified by a unique Autonomous System Number (ASN). ISPs, large...
- BGP (Border Gateway Protocol)
- The routing protocol that autonomous systems use to advertise the IP address ranges they control to one another. BGP is the mechanism...
- IPv6 Privacy Extensions (RFC 8981)
- A mechanism defined in RFC 8981 (formerly RFC 4941) by which IPv6 hosts generate temporary randomised addresses for outbound connections, rotating them...
- MAC Address (OUI)
- 48-bit hardware address. First 24 bits are the Organisationally Unique Identifier assigned by IEEE to a vendor; the lower 24 are the...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- OSI Reference Model
- Seven-layer ISO/IEC 7498-1 model describing how network functions are partitioned: Physical, Data Link, Network, Transport, Session, Presentation, Application. A teaching model, not...
- RFC 1918 Private Space
- Three IPv4 ranges reserved for private use: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Not routable on the public internet; require NAT at the edge.
- RIR (Regional Internet Registry)
- One of five organisations that allocate IP address blocks by region: ARIN (Americas), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific),...
- SLAAC
- Stateless Address Autoconfiguration. IPv6 host generates its own address from the router-advertised /64 prefix plus a 64-bit interface identifier (EUI-64 or RFC...
- TCP/IP Stack
- Four-layer model that actually runs the internet: Link, Internet, Transport, Application. Defined by the IETF and mapped onto the OSI layers for...
Explained in these topics
- Computer Networking: OSI, TCP/IP, IPv4/IPv6 and SubnettingNotation `a.b.c.d/n` where the trailing slash gives the prefix length. Replaced classful addressing in 1993 (RFC 1518/1519) and enabled supernetting and route...
- IP Addressing and Routing Fundamentals for Investigators