What Is CIDR? Classless Routing, Prefixes and Aggregation

A route such as 203.0.113.0/24 looks like shorthand, but the idea behind it eased a crisis that, in the early 1990s, appeared likely to stall the internet's growth. This article covers why the original classful addressing failed, what a prefix actually states, how neighboring blocks merge into one route, and why a router always prefers the most specific route it knows. For the arithmetic of splitting a block into subnets, the subnet calculator is quicker than any explanation; the focus here is how the system works and why.

The problem with Class A, B and C

The original IPv4 plan, defined in RFC 791, sorted networks into classes by the leading bits of an address. As RFC 4632 recounts, Class A allowed 128 networks of about 16.7 million addresses each, Class B allowed 16,384 networks of 65,536 addresses, and Class C allowed about 2.1 million networks of 254 usable hosts. Nothing sat between 254 and 65,534 hosts.

A mid-sized organization was stuck. A Class C was too small and a Class B was too large for most organizations, yet Class B was the best fit available for use with subnetting, so demand for Class B numbers ran away. In November 1991 the IETF created the ROAD (Routing and Addressing) group. By January 1992 it had named three problems: the Class B space was running out, routing tables were growing beyond what software, hardware and operators could manage, and the 32-bit address space would eventually be exhausted. Its work produced RFC 1338 and then RFC 1519 (September 1993).

CIDR, Classless Inter-Domain Routing, was designed to ease the first two problems, not the third. RFC 4632, the 2006 revision, says the plan was meant as a short-term response lasting roughly three to five years while a longer-term solution was found. More than thirty years later it is still the notation routers and cloud consoles use.

What a prefix states

In CIDR an address block is written as an address, a slash and a prefix length: the number of leading bits that identify the network. The remaining bits identify hosts inside it. 192.0.2.0/24 fixes 24 bits and leaves 8, so the block holds 2^8 = 256 addresses. Each bit added to the prefix halves the block; each bit removed doubles it. A classful network was just a block whose prefix length was forced by its first bits, always /8, /16 or /24. CIDR removed the forcing, so an organization that needs about a thousand addresses can be given a /22, which holds 1,024, instead of a Class B.

Aggregation: one route instead of many

The other half of CIDR's purpose was routing. If a provider holds one large block and hands out pieces of it to customers, the rest of the internet needs only one route to the whole block instead of one per customer. RFC 4632 says prefixes are intended to roughly follow the underlying internet topology so that aggregation is possible, which is why they are generally assigned along provider-to-customer lines.

Aggregation only works when blocks line up. Two adjacent /24 blocks merge into a /23 only if the first one starts on an even boundary. 192.168.0.0/24 and 192.168.1.0/24 combine into 192.168.0.0/23. 192.168.1.0/24 and 192.168.2.0/24 cannot, because no /23 begins at 192.168.1.0. The smallest single block covering both is 192.168.0.0/22, which also takes in 192.168.0.0/24 and 192.168.3.0/24, addresses you may not own. That alignment rule is the practical reason to hand out addresses in power-of-two blocks from the start of a network plan.

Longest match: why the most specific route wins

When routes overlap, the router needs a tiebreak. RFC 4632 states that forwarding on the internet is done on a longest-match basis: of all the routes whose prefix contains the destination, the one with the longest prefix is used. Suppose a table holds 10.0.0.0/8 via router A, 10.1.0.0/16 via router B and 10.1.2.0/24 via router C.

• A packet for 10.1.2.9 matches all three routes and follows the /24 to C.
• A packet for 10.1.9.9 matches the /8 and the /16, and follows the /16 to B.
• A packet for 10.9.9.9 matches only the /8 and goes to A.

RFC 4632 (section 5.1) adds two rules. A network reachable through several providers must announce its own prefix explicitly instead of being hidden inside one provider's aggregate. And a router that generates an aggregate must discard packets that match the aggregate but none of its more specific routes, otherwise traffic for unreachable parts of the block can loop.

Details that still trip people up

• Usable hosts. A block of 2^(32−n) addresses normally loses two: the network address and the broadcast address. A /30 therefore has two usable hosts. RFC 3021 allows /31 prefixes on point-to-point links, where both addresses are usable.
• Private ranges are CIDR blocks too. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The middle block runs from 172.16.0.0 to 172.31.255.255 only, so an address such as 172.32.0.1 is public.
• Subnet zero. RFC 950 (1985), written for the classful era, advised against assigning subnets whose subnet field was all zeros or all ones. RFC 1878 (1995) calls that practice obsolete, and modern software can use every definable subnet.
• IPv6 uses a similar notation. RFC 4291 requires 64-bit interface identifiers for all unicast addresses except those starting with the binary value 000, so an ordinary IPv6 subnet is a /64 and address planning happens in the bits above it.

Sources and further reading

• RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan (Fuller and Li, 2006)
• RFC 1519: Classless Inter-Domain Routing (CIDR): an Address Assignment and Aggregation Strategy (Fuller, Li, Yu and Varadhan, 1993)
• RFC 950: Internet Standard Subnetting Procedure (Mogul and Postel, 1985)
• RFC 1878: Variable Length Subnet Table For IPv4 (Pummill and Manning, 1995)
• RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links (Retana, White, Fuller and McPherson, 2000)
• RFC 1918: Address Allocation for Private Internets (Rekhter et al., 1996)
• RFC 4291: IP Version 6 Addressing Architecture (Hinden and Deering, 2006)
• Kevin R. Fall and W. Richard Stevens, TCP/IP Illustrated, Volume 1: The Protocols, 2nd edition (Addison-Wesley, 2011)
• Larry L. Peterson and Bruce S. Davie, Computer Networks: A Systems Approach (Morgan Kaufmann)