CIDR: naming a block of IP addresses

The idea

Every machine on a network has an IP address. An IPv4 address is 32 bits long, and we write it as four numbers from 0 to 255, one for each group of 8 bits, such as 10.0.1.25. A CIDR block names a whole range of these addresses with one short string: an address, a slash and a number, such as 10.0.0.0/16. The number after the slash is the prefix length. It says how many bits, counted from the left, are fixed. Every address whose first 16 bits are the same as those of 10.0.0.0 belongs to the block, so 10.0.0.0/16 means every address from 10.0.0.0 to 10.0.255.255.

The bits after the prefix are free to take any value, and they decide how big the block is. A /16 leaves 32 − 16 = 16 free bits, which gives 2¹⁶ = 65,536 addresses. Each extra bit in the prefix halves the block: a /17 holds 32,768 addresses, a /24 holds 256 and a /28 holds 16. So a bigger number after the slash means a smaller block. The address written before the slash is the first address of the block, with all of its free bits set to zero. That is why a /16 ends in .0.0 and a /24 ends in .0.

CIDR stands for Classless Inter-Domain Routing. Before it, networks came in only three sizes (/8, /16 and /24). CIDR lets the prefix be any length from 0 to 32, so each network can be given the size it needs.

Smaller blocks inside a bigger one

A block is just "these bits are fixed", so you can cut it in half by fixing one more bit. Fixing the 17th bit to 0 or to 1 splits 10.0.0.0/16 into 10.0.0.0/17, which runs from 10.0.0.0 to 10.0.127.255, and 10.0.128.0/17, which runs from 10.0.128.0 to 10.0.255.255. Splitting a half again gives two /18 blocks, and you can keep going down to the size you want. Blocks made this way never partly overlap: two of them are either completely separate, or one lies entirely inside the other.

This also means a block has to start at a multiple of its own size. A /24 holds 256 addresses, so it starts at .0 of some third number, as in 10.0.7.0/24. A /26 holds 64, so it can start at .0, .64, .128 or .192. Click a block in the diagram to split it, and click a split block to join its halves again.

An AWS VPC, split into subnets

In AWS, a VPC (virtual private cloud) is your own private network inside one Region, and you give it a CIDR block when you create it, for example 10.0.0.0/16. A Region contains several Availability Zones (AZs), which are separate data centres with their own power and networking. A subnet is a smaller block cut out of the VPC's block, and each subnet lives in exactly one AZ. When you launch an instance, you place it in a subnet, and it gets its private IP address from that subnet's block.

A common layout gives every AZ one public subnet, for things that must be reached from the internet such as load balancers, and one private subnet for application servers and databases. Spreading the same pair of subnets over several AZs means that if one AZ has a problem, the copies in the other AZs keep running. The diagram below lays the subnets out this way. Change the subnet size and the number of AZs, and watch how much of the VPC's address space is used.

The five addresses AWS keeps

Not every address in a subnet can be given to an instance. AWS keeps the first four and the last one for itself. In 10.0.1.0/24 these are 10.0.1.0, the network address; 10.0.1.1, the VPC router; 10.0.1.2, for the Amazon DNS server; 10.0.1.3, kept for future use; and 10.0.1.255, the broadcast address, which AWS keeps even though VPCs do not support broadcast. So a /24 subnet has 256 − 5 = 251 addresses you can use, and the smallest subnet AWS allows, a /28, has only 16 − 5 = 11.

Rules to keep in mind on AWS

A VPC's block and every subnet's block must have a prefix between /16 and /28, so a VPC holds at most 65,536 addresses and a subnet at least 16. Each subnet must sit inside the VPC's block, and no two subnets in a VPC may overlap. A subnet cannot stretch across AZs, so a layout that needs three AZs needs at least three subnets. If you run out of room, you can add more blocks to a VPC later as secondary CIDR blocks (five per VPC by default), but you cannot make an existing subnet bigger. That is why it pays to give the VPC a large block, such as a /16, and leave room between subnets for the ones you will add later.

For the VPC's block, use one of the private ranges set aside for internal networks: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. Pick a block that does not overlap with any network you may connect to later, such as another VPC (through peering or a Transit Gateway) or your office network (through a VPN). When two connected networks use the same addresses, a router cannot tell which side an address belongs to, and traffic between them cannot be routed. The default VPC that AWS creates in each Region uses 172.31.0.0/16 with one /20 default subnet per AZ, which is a reason to choose something else for your own VPCs.

IPv6 works the same way with 128-bit addresses. AWS usually gives a VPC a /56 and each subnet a /64, which is far more addresses than any subnet will ever need.

Sizes at a glance