CIDR Blocks — Sizing Your Network

Inkwell is creating its own private network in AWS, a VPC, and the first box asks for an "IPv4 CIDR block". Type something too small and the network fills up; type something that clashes with the office network and connecting the two later becomes painful. Two minutes of arithmetic now saves a rebuild later.

The rule

The slash counts fixed bits; the rest are yours: 2 to the 32 minus slash.

An IPv4 address is 32 bits, written as four numbers from 0 to 255. CIDR notation writes a range as a starting address and a slash:

• The /16 says the first 16 bits are fixed: every address in the range starts 10.0.
• The other 32 − 16 = 16 bits are free, so the range holds 2 to the 16th, which is 65,536 addresses, from 10.0.0.0 to 10.0.255.255.

Handy values to know by heart:

• /16 → 65,536 addresses (the largest block AWS allows for a VPC)
• /20 → 4,096
• /24 → 256 (the last number runs 0 to 255)
• /28 → 16 (the smallest block AWS allows)

Each extra bit after the slash halves the range; each bit fewer doubles it.

In a VPC, AWS reserves five addresses in every subnet: the first four (network address, VPC router, DNS, and one kept for future use) and the last. So a /24 subnet gives 256 − 5 = 251 usable addresses.

Use the private ranges set aside for internal networks, 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and pick a block that does not overlap any network you may connect to later, such as your office or another VPC.

The shortcut

To size any block: subtract the slash from 32, raise 2 to that power, and subtract 5 if it is a subnet.

The trap is reading the slash backwards: a bigger number after the slash means a smaller network. A /28 is tiny; a /16 is huge.

Drills

Answer fast — trust the rule.

Remember

• The slash counts fixed bits; the range holds 2 to the power of (32 minus slash).
• Shortcut: subtract from 32, power of two, minus 5 per subnet in AWS.
• Trap: a bigger slash number is a smaller network, and never overlap networks you will connect.