What does CIDR notation like 192.0.2.0/24 mean?

CIDR writes IPv4 networks as an address plus a prefix length. The number after the slash counts bits fixed for the network; remaining bits identify hosts inside the block. CIDR replaced rigid class A, B, and C sizes so providers allocate right-sized ranges and summarize routes for the global routing table more efficiently.

How many addresses are in a /24 CIDR block?

A /24 fixes the first 24 bits, leaving 8 host bits for 256 addresses total. In classic IPv4 usage one address is the network identifier and one is broadcast, leaving about 254 usable assignments on many LANs. A /32 represents one host, while a /8 spans more than sixteen million addresses.

Where are CIDR blocks used in security rules?

Firewalls, cloud security groups, allowlists, and threat feeds express rules in CIDR notation. Blocking 198.51.100.0/24 denies 256 addresses at once. Good practice favors the smallest effective range and documents partner endpoints as specific prefixes or /32 host routes when possible to limit collateral damage from overly wide blocks.

What is a CIDR Block?

Abisola | Feb 16, 2026

CIDR (Classless Inter-Domain Routing) notation writes IPv4 networks as an address plus a prefix length, for example 192.0.2.0/24. The number after the slash counts bits fixed for the network; the rest identify hosts inside the block. CIDR replaced rigid “class A/B/C” sizes so providers could allocate right-sized ranges and summarize routes for the global routing table.

Reading a CIDR block

A /24 fixes the first 24 bits, leaving 8 host bits: 256 addresses total, of which one is the network address and one is broadcast in classic IPv4 usage, leaving 254 usable assignments on many LANs. Larger prefixes mean smaller networks: /32 is one host; /8 is sixteen million-plus addresses. Two contiguous blocks can sometimes be aggregated into a shorter prefix for routing if alignment allows.

Private ranges reserved by RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routed on the public internet. Public CIDRs are announced with BGP by ASNs and their upstreams.

Where CIDR shows up in operations

Firewalls, cloud security groups, allowlists, and threat feeds all use CIDR. Blocking 198.51.100.0/24 denies 256 addresses; blocking too wide a prefix risks collateral damage. Good practice favors the smallest effective range and documents partner endpoints as specific prefixes or /32s when possible.

CIDR and fraud prevention context

Anti-fraud systems often reason about IPs in aggregates: data-center subnets, known proxy ranges, or VPN exits. Listing a whole abusive /22 can stop more bot traffic than banning single addresses that rotate inside the same block. Legitimate users sometimes share those ranges, so vendors balance CIDR rules with behavioral scores and appeals.

Advertisers feel outcomes as click fraud or ad fraud; CIDR is the addressing grammar underneath IP reputation. Remote access policies also combine CIDR with VPN pools and office ISP assignments. See how detection stacks combine signals beyond raw lists.

Frequently Asked Questions

What does CIDR notation like 192.0.2.0/24 mean?
CIDR writes IPv4 networks as an address plus a prefix length. The number after the slash counts bits fixed for the network; remaining bits identify hosts inside the block. CIDR replaced rigid class A, B, and C sizes so providers allocate right-sized ranges and summarize routes for the global routing table more efficiently.
How many addresses are in a /24 CIDR block?
A /24 fixes the first 24 bits, leaving 8 host bits for 256 addresses total. In classic IPv4 usage one address is the network identifier and one is broadcast, leaving about 254 usable assignments on many LANs. A /32 represents one host, while a /8 spans more than sixteen million addresses.
Where are CIDR blocks used in security rules?
Firewalls, cloud security groups, allowlists, and threat feeds express rules in CIDR notation. Blocking 198.51.100.0/24 denies 256 addresses at once. Good practice favors the smallest effective range and documents partner endpoints as specific prefixes or /32 host routes when possible to limit collateral damage from overly wide blocks.
Why do fraud tools block whole CIDR ranges?
Anti-fraud systems reason about IPs in aggregates such as data-center subnets, known proxy ranges, or VPN exits. Listing an abusive /22 can stop more bot traffic than banning single addresses that rotate inside the same block. Vendors balance CIDR rules with behavioral scores because legitimate users sometimes share those network ranges.

Abisola

Abisola handles content and support at ClickPatrol. She helps customers get more value from cleaner traffic data and writes practical resources about ad fraud, fake traffic, and smarter PPC decisions.