IP Addresses, Subnets and CIDR

What an IP address is made of

Computers see an IPv4 address as 32 binary digits. Dotted decimal is just a readable way to write it, one number from 0 to 255 for each group of 8 bits. The address 198.51.100.77 is, in binary:

198      .51       .100      .77
11000110 .00110011 .01100100 .01001101

On its own, an address does not tell you which network it belongs to. You also need the prefix length or the subnet mask. A subnet mask is the same idea written as an address: ones for the network bits, zeros for the host bits. A /26 mask is 26 ones followed by 6 zeros, which is 255.255.255.192.

To find the network, a device performs a bitwise AND of the address and the mask. For 198.51.100.77/26 the result is 198.51.100.64. Any other address that produces the same result is on the same subnet and can be reached directly; anything else goes to a router. IPv6 uses the same prefix idea with 128-bit addresses, covered in IPv4 vs IPv6 and AAAA Records.

From address classes to CIDR

Early IPv4 used fixed classes. A Class A network had an 8-bit prefix, Class B 16 bits and Class C 24 bits, and the class was implied by the first few bits of the address. That wasted space badly: an organization too big for a Class C's 254 hosts would often get a Class B with more than 65,000.

CIDR replaced classes in the 1990s. Any prefix length is allowed, so a provider can hand out exactly the block a customer needs, and routers can summarize many adjacent blocks into one route. A provider holding 203.0.113.0/24 can announce that single prefix to the rest of the Internet even if it has split it into dozens of customer subnets internally.

Routers choose between overlapping routes with longest-prefix match: the most specific route that contains the destination wins. If a routing table has both 198.51.100.0/24 and 198.51.100.64/26, traffic to 198.51.100.77 follows the /26. The same rule governs routing between networks on the Internet, as described in BGP Basics: How Internet Routing Works.

CIDR reference table

This table covers the IPv4 prefix lengths you will meet most often. "Usable hosts" subtracts the network and broadcast addresses, which are not assigned to hosts in a normal subnet.

The formula behind the "Addresses" column is 2 raised to the number of host bits. A /26 has 32 minus 26, or 6, host bits, and 2 to the 6th is 64.

Working through a subnet

Suppose you are given 198.51.100.0/24 and need four equal subnets. Borrowing 2 bits from the host part makes four /26 blocks of 64 addresses each:

A host configured as 198.51.100.77/26 lives in the second block. On Linux, the ip command shows the address, its prefix, the broadcast address and the connected route the kernel built from them:

$ ip -4 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 198.51.100.77/26 brd 198.51.100.127 scope global eth0
       valid_lft forever preferred_lft forever

$ ip -4 route
default via 198.51.100.65 dev eth0 proto static
198.51.100.64/26 dev eth0 proto kernel scope link src 198.51.100.77

The second route says every address in 198.51.100.64/26 is reachable directly on eth0. Everything else goes to the default gateway at .65. A wrong prefix length is a classic cause of "some hosts reachable, others not": with a /24 configured by mistake, this host would try to reach 198.51.100.200 directly instead of through the router.

Blocks must start on a boundary that matches their size. 198.51.100.64/26 is valid because 64 is a multiple of 64; 198.51.100.70/26 is not a network address, and tools will either reject it or quietly round it down to .64.

Where prefixes show up in DNS work

DNS operators work with CIDR more often than it might seem:

• Reverse DNS. PTR records live under in-addr.arpa, which is organized by octet. A /24 maps neatly to one reverse zone, such as 100.51.198.in-addr.arpa. Blocks smaller than a /24 cannot be delegated on an octet boundary, so providers use the CNAME-based technique in RFC 2317. See Reverse DNS and PTR Records.
• SPF. The ip4: and ip6: mechanisms accept prefixes, for example v=spf1 ip4:192.0.2.0/24 -all. A prefix that is too wide authorizes far more senders than intended.
• Access control. Recursion, zone transfer and dynamic update permissions on name servers are usually written as lists of prefixes. An open resolver is often just an access list that says 0.0.0.0/0.
• EDNS Client Subnet. Some resolvers pass a truncated client prefix, often a /24 for IPv4, to authoritative servers so they can tailor geographic answers, as described in RFC 7871.

Not every address is meant for the public Internet. Ranges such as 10.0.0.0/8 are reserved for private use and must be translated before they can reach it; NAT and Private IP Address Ranges covers those blocks.

How DNS Panopticon helps

The Subnet Calculator works through any IPv4 or IPv6 block for you. It draws every bit of the address, mask, network and broadcast address so you can see where the network part ends, marks your address on the range, and splits a block into smaller subnets like the four /26s above.

Website Recon resolves a domain's A and AAAA records and looks up each resulting IP address in RDAP to find the network it belongs to and its autonomous system number. That tells you which registered block, and which operator, a name's addresses sit in without working out the prefix by hand.

If you manage a zone export, Zone Analyzer lets you build filters on the record data column, for example records whose data starts with a given network's leading octets, which is a quick way to list every name that points into one subnet before renumbering it.