Concept · 6 min read
What is CIDR?
How do you say 'this block of addresses' without listing them?
CIDR notation writes an address plus a prefix length to describe a block: /24 is 256 addresses, /16 is 65,536. Reading it quickly is a practical scanning and scoping skill.
Prefix length is a count of fixed bits
The host portion is the remaining bits. Sizes are always powers of two, and a block's network address is the first usable line of the block.
text
192.0.2.0/24 → 24 fixed bits → 2^8 = 256 addresses 192.0.2.0/26 → 26 fixed bits → 2^6 = 64 addresses 10.0.0.0/8 → 8 fixed bits → 2^24 = 16,777,216
Sizes worth memorising
- /32 — one address; how you write 'exactly this host' in a rule
- /31 and /30 — point-to-point links and tiny links (2 and 4 addresses)
- /24 — a typical LAN; a Nmap default scan is 256 × 1000 probes, which is why rate matters
- /22 — 1,024 addresses, common cloud allocation
- /16 — 65,536, usually one VPC
Scope arithmetic you will actually do
Before any range scan, compute the address count and multiply by ports. '203.0.113.0/24, ports 1-65535' is 16.7 million probes. That number is the conversation to have with the network owner, not something to discover mid-run.
Check your understanding
Answer before expanding. If you cannot explain it in one sentence, the section above needs a re-read.
Is 192.168.5.130/25 in the same block as 192.168.5.20?Q1
Yes. A /25 covers .0–.127 and .128–.255 — .130 is in the second half, .20 in the first: different subnets.
Why prefer /32 in an exclude file?Q2
Explicit single-address entries cannot silently widen if the block is edited later.
Where this shows up
Tools in the directory whose commands assume this knowledge.