CIDR notation, explained

How to read a block like 10.0.0.0/24, work out how many addresses it covers, and see why 0.0.0.0/0 in a cloud firewall rule is the one to watch, with links to the standard and the AWS documentation.

1. What it is

   A slash and a number split the bits.

   CIDR writes a block of addresses as an address, a slash and a number. An IPv4 address has 32 bits, and the number says how many of them, counted from the left, are fixed: the network part. The remaining bits are free, and they number the individual addresses. In 10.0.0.0/24, the first 24 bits are fixed and the last 8 are free. (RFC 4632 calls the number the count of "significant bits".)

   Source: RFC 4632 (CIDR), section 3.1

2. How it works

   Each free bit doubles the block.

   The number of addresses in a block is 2 to the power of (32 minus the number). A /32 is one address, a /26 is 64, a /25 is 128, and a /24 is 256. These are addresses in the block; some networks reserve a few of them (AWS, for example, reserves five in each subnet), so the number you can actually assign to hosts can be lower.

   Source: RFC 4632 (CIDR), section 3.1

3. Why it matters

   0.0.0.0/0 means every IPv4 address.

   In an AWS security group rule, the source can be a CIDR block. A /0 fixes no bits, so 0.0.0.0/0 matches every IPv4 address. AWS warns: "When you add inbound rules for ports 22 (SSH) or 3389 (RDP) so that you can access your EC2 instances, authorize only specific IP address ranges. If you specify 0.0.0.0/0 (IPv4) and ::/ (IPv6), this enables anyone to access your instances from any IP address using the specified protocol." (The IPv6 equivalent is ::/0. The rule only matters if the instance can be reached from the internet at all.)

   Source: AWS, Amazon VPC User Guide, security groups

The takeaway: The number after the slash says how many bits are fixed. Each bit you free doubles the block. And a /0 fixes none, so it matches everything: keep it out of SSH rules.

More short lessons

ADIR also offers a free external pen test for cloud teams: see the offer.

Transcript

How do you read a block like 10.0.0.0/24? And what does 0.0.0.0/0 mean? CIDR writes a block of addresses as an address, a slash, and a number. An IPv4 address has 32 bits, and the number says how many, from the left, are fixed. The rest number the individual addresses. Each bit you free doubles the block. A /32 is one address. A /26 is 64, a /25 is 128, and a /24 is 256. The count is 2 to the power of 32 minus the number. In an AWS security group, the source can be a CIDR block. A /0 fixes no bits, so 0.0.0.0/0 matches every IPv4 address. Allow SSH from it, and anyone, from any address, can reach port 22. AWS says to authorize only specific address ranges. So, the number says how many bits are fixed. Each bit you free doubles the block. And a /0 fixes none, so it matches everything. Keep it out of SSH rules.

Narrated with an AI voice.