What Is a CIDR Block? – Definition and How It Works

Informational P3 what is a cidr block

Learn how CIDR notation expresses an address range, how prefix length maps to size, and where it is used in practice.

A CIDR block is a range of IP addresses written as an address followed by a prefix length — 203.0.113.0/24. The prefix length says how many leading bits are fixed; the rest vary.

1. Reading the Notation

203.0.113.0/24 fixes the first 24 bits and leaves 8 free, giving 256 addresses from 203.0.113.0 to 203.0.113.255.

Prefix	Addresses	Common use
/32	1	A single host
/29	8	A very small allocation
/24	256	A typical small network
/22	1,024	A modest ISP block
/16	65,536	A large organisation
/8	16,777,216	A historical giant allocation

The rule to internalise: a smaller prefix number means a larger block. Each step down doubles the size, and /16 is 256 times larger than /24.

2. Why It Replaced Classes

The original scheme allocated in fixed classes — roughly 16 million, 65 thousand, or 256 addresses. An organisation needing 500 addresses had to take 65,536, wasting most of them.

Classless routing allows any prefix length, so allocations fit need. It also enables route aggregation: adjacent blocks are advertised as one shorter prefix, keeping global routing tables far smaller than they would otherwise be.

3. Where You Meet It

Proxy pool descriptions. A provider offering addresses across many /24s in different ASNs is describing genuine diversity; one offering a single /22 is offering addresses that are trivially blocked together.

Firewall and allowlist rules. Access granted to a CIDR block rather than to individual addresses.

Cloud provider ranges, published as CIDR lists — which is how sites identify datacenter traffic in bulk.

Rate limiting. Sophisticated limiting applies per block rather than per address, precisely because rotating within one /24 is not rotation in any meaningful sense.

4. The Consequence for Rotation

This is the practical point. If a defence rate-limits per /24, then rotating between 200 addresses inside one /24 gives no benefit at all — every request lands in the same bucket.

Effective diversity means addresses across many blocks, and ideally across many ASNs. Counting addresses without looking at their prefix distribution overstates a pool's real variety, sometimes enormously.

5. Working With Blocks in Code

import ipaddress

net = ipaddress.ip_network("203.0.113.0/24")
print(net.num_addresses, net.network_address, net.broadcast_address)

print(ipaddress.ip_address("203.0.113.42") in net)      # True

# Collapse a list of blocks into the minimal set
blocks = [ipaddress.ip_network(b) for b in ["10.0.0.0/25", "10.0.0.128/25"]]
print(list(ipaddress.collapse_addresses(blocks)))       # [10.0.0.0/24]

# How many distinct /24s does a pool actually span?
pool = ["203.0.113.5", "203.0.113.9", "198.51.100.7"]
print({str(ipaddress.ip_network(f"{a}/24", strict=False)) for a in pool})

That last snippet is the one worth keeping. It answers "how diverse is this pool really" in three lines.

6. IPv6 Differs in Scale

IPv6 uses the same notation with 128-bit addresses, and the customary allocations are vastly larger — a /64 for a single subnet, a /48 or /56 to a customer site.

The consequence is that per-address blocking is meaningless in IPv6, since one customer may hold an effectively unlimited number of addresses. Blocking there operates on /64 or shorter prefixes, which is a different mental model from IPv4.

7. Reserved Ranges

Some blocks never appear as public internet sources: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (private), 127.0.0.0/8 (loopback), 169.254.0.0/16 (link-local), 100.64.0.0/10 (carrier NAT).

Recognising these matters for validation — an inbound request appearing to originate from a private range indicates a proxy header being trusted when it should not be.

8. Summary

CIDR notation writes an address range as a prefix length, where a smaller number means a larger block, and it replaced fixed classes to allow allocations that fit actual need and routes that aggregate.

Its practical importance is that blocking and rate limiting frequently operate per block rather than per address — so a proxy pool's real diversity is the number of distinct prefixes and ASNs it spans, not the number of addresses it contains.