What is a CIDR Block?

CIDR (Classless Inter-Domain Routing) notation writes IPv4 networks as an address plus a prefix length, for example 192.0.2.0/24. The number after the slash counts bits fixed for the network; the rest identify hosts inside the block. CIDR replaced rigid “class A/B/C” sizes so providers could allocate right-sized ranges and summarize routes for the global routing table.

Reading a CIDR block

A /24 fixes the first 24 bits, leaving 8 host bits: 256 addresses total, of which one is the network address and one is broadcast in classic IPv4 usage, leaving 254 usable assignments on many LANs. Larger prefixes mean smaller networks: /32 is one host; /8 is sixteen million-plus addresses. Two contiguous blocks can sometimes be aggregated into a shorter prefix for routing if alignment allows.

Private ranges reserved by RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routed on the public internet. Public CIDRs are announced with BGP by ASNs and their upstreams.

Where CIDR shows up in operations

Firewalls, cloud security groups, allowlists, and threat feeds all use CIDR. Blocking 198.51.100.0/24 denies 256 addresses; blocking too wide a prefix risks collateral damage. Good practice favors the smallest effective range and documents partner endpoints as specific prefixes or /32s when possible.

CIDR and fraud prevention context

Anti-fraud systems often reason about IPs in aggregates: data-center subnets, known proxy ranges, or VPN exits. Listing a whole abusive /22 can stop more bot traffic than banning single addresses that rotate inside the same block. Legitimate users sometimes share those ranges, so vendors balance CIDR rules with behavioral scores and appeals.

Advertisers feel outcomes as click fraud or ad fraud; CIDR is the addressing grammar underneath IP reputation. Remote access policies also combine CIDR with VPN pools and office ISP assignments. See how detection stacks combine signals beyond raw lists.