CIDR Notation and IP Ranges Explained

What does the slash number mean?

Start with simple IPv4 blocks where the slash lines up with the numbers between dots. The green part is fixed. The blue part can be any number from 0 to 255.

The prefix length is the number after the slash. It tells you how many leading binary digits, called bits, are fixed for the network. In the simple examples above, /8 fixes one dotted number, /16 fixes two, and /24 fixes three. A /32 fixes the entire IPv4 address. Other prefixes can split inside a dotted number, but the idea is the same: more fixed bits means a smaller block.

To calculate an IPv4 block size yourself, use 2^(32 − prefix length) addresses.

How do IPv4 subnet masks relate to CIDR prefixes?

A CIDR prefix length and an IPv4 subnet mask describe the same boundary. The prefix length counts consecutive network bits set to 1; the remaining host bits are 0. Each dotted number in the mask represents eight bits, so /24 means three complete groups of eight network bits: 11111111.11111111.11111111.00000000, written in decimal as 255.255.255.0.

Prefixes can also split inside a dotted number. For example, /25 adds one network bit in the final octet and corresponds to 255.255.255.128. Use the IP subnet calculator to convert prefixes and masks and inspect the resulting address range.

Which address spans do uneven prefixes create?

Which subnet mask matches each IPv4 prefix length?

This table maps IPv4 prefix lengths from /0 through /32 to their dotted-decimal network masks and total address counts. The class labels mark old default boundaries; modern CIDR is classless.

The table counts every address in each block. A /0 covers the entire IPv4 address space and is commonly used as a default route. Under the traditional IPv4 subnet convention, the first address is the network address and the last is the broadcast address, so a /24 is often described as 254 usable host addresses even though it contains 256 total addresses. A /31 can use both addresses on a point-to-point link, and a /32 identifies one address.

How do IPv6 prefix lengths work?

The same notation works for IPv6. In a /64, the first four hexadecimal groups are fixed and the remaining four can vary:

The block above is 2001:db8:1234:5678::/64, the usual size for one IPv6 network segment. Providers commonly delegate larger prefixes that contain many of these segments.

IPv6 normally uses prefix lengths rather than an IPv4-style dotted-decimal subnet mask. An IPv6 address has 128 bits and is written in hexadecimal, so a prefix such as /64 states the network boundary directly without translating it into a long mask representation. An IPv6 block contains 2^(128 − prefix length) addresses, and a /128 identifies one address.

These sizes describe network structure, not a universal customer boundary. Providers may delegate a /48, /56, /64, or another size as a customer prefix according to their policies. A visible /64 may be one network segment, one host, or part of a larger customer delegation. For background on the two address versions, see IPv4 and IPv6 addresses.

Why do ranges matter in an IP lookup?

Most network facts are properties of a block rather than of one address. Registries delegate prefixes. Networks exchange announcements about them using Border Gateway Protocol (BGP), the rules for sharing routing information. IP intelligence feeds also list prefixes. That is why an IP lookup reports the block an address belongs to.

IP Lens shows the most specific block registered for an address as the IP Prefix, and when available, also shows a larger Delegated Prefix that a registry handed to an organization. Reading the prefix tells you how broad a fact is: a tag or registration record that applies to a /16 covers far more addresses than one that applies to a /29. See IP registries for who delegates these blocks.

How can I block or allow a range without overblocking?

Treat every prefix as a choice about how many addresses a rule affects. A narrow block or allow rule affects fewer unrelated users, while a broad rule is easier to maintain but risks including addresses that only share the same provider, city, office, or hosting platform. Start with the most specific evidence you have, then widen only when the pattern is clearly shared across the range.

Blocking and allowing have different failure modes. A broad block risks false positives; a broad allow rule risks bypassing protections for unrelated traffic. Review rules after an incident cools down, and prefer more specific prefixes when the original evidence was narrow.