The number after the slash

In CIDR notation, the number after / is the prefix length in bits. For IPv4, /24 means the first 24 bits identify the network. 192.0.2.0/24 describes an address block, whereas 192.0.2.10 is one address inside it. They are not equivalent lookup inputs.

Calculating address counts

The total IPv4 address count is 2 raised to the power of 32 minus the prefix length. A /24 contains 256 addresses. The usable host count depends on the network type: traditional subnets reserve network and broadcast addresses, while links such as /31 use different rules.

Care with allowlists

Using a broad prefix when intending to allow one host can grant unnecessary access. In IPv4, /32 identifies one address. Determine the intended network scope before adding a block. IPv6 applies the same prefix idea over 128 bits, so do not reuse IPv4 counts unchanged.

The scope of an allow rule

192.0.2.10/32 identifies one example IPv4, while 192.0.2.0/24 covers 256 addresses. Choosing /24 when granting access to one partner broadens the rule. Calculate the first and last addresses before applying it and compare that range with the requirement. This documentation block is an illustration, not a rule to copy into production.

Further reading

CIDR — RFC 4632 ↗

Put it into practice

Inspect one public IP, or compare a list of addresses with the bulk lookup tool. Location results are approximate.

Single lookup ↗ Bulk lookup ↗