title: “CIDR Notation” created: 2026-07-23 updated: 2026-07-23 type: knowledge tags:

• aws
• certification
• networking
• vpc

CIDR Notation

What It Is

CIDR (Classless Inter-Domain Routing) is a compact notation to express a range of IP addresses. The format is:

network_address / prefix_length

The prefix length indicates how many of the 32 bits (IPv4) are fixed and identify the network. The remaining bits are available for hosts.

Why It Matters

• Every VPC, subnet, security group rule, and route table entry in AWS uses CIDR notation
• Understanding CIDR is required to design non-overlapping network segments
• Misconfigured CIDR blocks lead to routing conflicts or wasted IP space

Key Concepts

Formula: 2^(32 - prefix) = number of addresses

Rules of thumb:

• /16 → large network (~65k IPs) → typical for a VPC
• /24 → small network (256 IPs) → typical for a subnet
• The larger the prefix number, the smaller the network

How It Works

A CIDR block like 10.0.0.0/16 means:

• The first 16 bits (10.0) are locked — they identify the network
• The last 16 bits (x.x) are free — they identify hosts
• Range: 10.0.0.0 to 10.0.255.255

Subnets are carved out of a VPC’s CIDR block by using a longer prefix:

VPC 10.0.0.0/16          → full block 10.0.x.x
  ├── 10.0.25.0/24       → sub-block 10.0.25.x  (public subnet)
  ├── 10.0.50.0/24       → sub-block 10.0.50.x  (private subnet)
  └── ... remaining space available for other subnets

Examples

AWS Default VPC: 172.31.0.0/16

• Automatically created in every region
• Range: 172.31.0.0 to 172.31.255.255
• Pre-configured with /20 subnets (4,096 IPs each), one per AZ

Lab VPC: 10.0.0.0/16

• Public subnet: 10.0.25.0/24 → 256 addresses (10.0.25.0 – 10.0.25.255)
• Private subnet: 10.0.50.0/24 → 256 addresses (10.0.50.0 – 10.0.50.255)

AWS reserved addresses per subnet (5 total):

• .0 — network address
• .1 — VPC router
• .2 — DNS server
• .3 — reserved for future use
• .255 — broadcast (not supported in VPC but reserved)

So a /24 subnet has 251 usable IPs, not 256.

Gotchas

• A VPC CIDR block cannot be changed after creation (but secondary blocks can be added)
• Subnets cannot overlap within a VPC
• AWS enforces a minimum of /28 (16 IPs) and maximum of /16 (65,536 IPs) for VPC CIDR blocks
• The 5 reserved addresses per subnet matter more in small subnets (a /28 only has 11 usable IPs)
• CIDR blocks from peered VPCs must not overlap

See Also

• [[s3-fundamentals]]
• [[aws-arns]]