CIDR Blocks and IP Allocation Explained

What CIDR notation means, how address blocks are sized, and how to read a prefix in an ASN lookup result.

Core Concept

CIDR, or Classless Inter-Domain Routing, is the notation used to describe a contiguous range of IP addresses as a single block, written as an address followed by a slash and a number — for example, 192.0.2.0/24.

The number after the slash indicates how many bits of the address are fixed, which determines how many individual addresses fall within that block.

Insight: A smaller number after the slash means a larger block — /24 covers far more addresses than /30.

Reading Common CIDR Sizes

/32 — a single IP address
/24 — 256 addresses, a common allocation size for smaller networks
/20 — 4,096 addresses, typical of mid-sized provider allocations
/16 — 65,536 addresses, often held by very large organizations
/8 — over 16 million addresses, historically allocated to only the largest early internet organizations

Every Step Doubles the Size

Each decrease of one in the CIDR number doubles the number of addresses in the block, which is why the difference between /20 and /16 is substantial.

What the Prefix Field Tells You

In an ASN lookup, the prefix field shows the CIDR block that the queried IP belongs to — not the address itself, but the boundaries of the network segment it's part of.

This is useful for understanding scale: a single suspicious IP within a small /29 block suggests a narrowly allocated resource, while the same IP within a large /16 block sits inside a much broader allocation likely serving many unrelated purposes.

IPv6 CIDR Notation

IPv6 uses the same slash notation but with a vastly larger address space, so allocations are typically expressed in much larger blocks — a /48 or /32 is common for organizational allocations, reflecting IPv6's design around abundant address availability.

Limitation: Comparing IPv4 and IPv6 CIDR sizes directly can be misleading, since IPv6's address space is astronomically larger and allocation conventions differ accordingly.

Why This Matters for Investigation

Understanding CIDR sizing helps calibrate expectations when investigating an IP — a large shared block hosting thousands of unrelated customers behaves very differently from a small, dedicated allocation tied to a single organization.

It also helps when reading BGP announcement data, since the size and specificity of an announced prefix can itself be a meaningful signal in routing analysis.

Real-World Implementation

Network engineers, security analysts and infrastructure teams all rely on CIDR notation daily, whether configuring firewall rules, defining routing policies, or interpreting the scope of an allocation during an investigation.

Fluency with CIDR sizing is a small but foundational skill that makes ASN and IP intelligence data significantly more useful to interpret correctly.

Common Mistakes to Avoid

Assuming a larger CIDR number means a larger address block, rather than smaller.
Treating a huge shared allocation the same as a small dedicated one during investigation.
Comparing IPv4 and IPv6 CIDR sizes without accounting for their very different scales.
Ignoring prefix size when assessing how many unrelated parties might share a block.
Confusing the CIDR prefix field with the specific queried IP address itself.

Best Practices Checklist

Check the CIDR prefix size to gauge how broadly shared an allocation likely is.
Treat findings on large shared blocks with more caution than on small dedicated ones.
Learn common CIDR sizes to quickly estimate address counts from the notation.
Account for IPv6's different allocation conventions when comparing block sizes.
Use prefix data alongside organization and registry fields for fuller context.

Frequently Asked Questions

What does the number after the slash mean?

It indicates how many bits of the IP address are fixed, which determines how many addresses fall within that CIDR block.

Is a /16 bigger or smaller than a /24?

A /16 is much larger — it covers 65,536 addresses compared to 256 in a /24.

What does /32 mean?

It refers to a single, specific IP address rather than a range.

Why does the prefix in my ASN lookup differ from the exact IP I searched?

The prefix shows the full CIDR block the IP belongs to, not just the single address queried.

Are IPv6 CIDR blocks sized the same way as IPv4?

The notation is the same, but typical allocation sizes differ significantly given IPv6's much larger overall address space.

Does a large CIDR block mean higher risk?

Not inherently — it simply means the block is shared among more addresses, which can include both legitimate and abusive traffic.

Check an IP's CIDR Allocation

Resolve an IP address to its ASN and see the full CIDR block it belongs to.

Launch Tool →