Understanding IPv4 and IPv6 CIDR, Prefix Arithmetic, and Subnet Boundaries
Classless Inter-Domain Routing (CIDR), standardized in RFC 4632, replaced the rigid historical classful addressing scheme (Classes A, B, and C) with variable-length prefix masks. Instead of inferring network boundaries from the leading bits of an IP address, CIDR explicitly appends a prefix length—such as 192.0.2.0/24 or 2001:db8::/32—indicating how many leading most-significant bits identify the network prefix.
1. Bitwise Prefix Arithmetic
Every IPv4 address is an unsigned 32-bit integer, and every IPv6 address is an unsigned 128-bit integer. Given an address A of width W bits (W = 32 for IPv4, 128 for IPv6) and a prefix length P (where 0 ≤ P ≤ W), the number of host identifier bits is H = W − P.
- Netmask (M): A W-bit integer with the leading P bits set to
1and the trailing H bits set to0. - Wildcard / Host Mask (~M): The bitwise inverse of M, having P leading
0bits and H trailing1bits. - Network Prefix Start:
Network = A & M(bitwise AND clears all host bits to zero). - Last Address in Block (IPv4 Broadcast):
Last = Network | (~M)(bitwise OR sets all host bits to one). - Total Addresses in Block:
2H = 2(W − P).
Address : 192.0.2.10 = 11000000.00000000.00000010.00001010
Mask (/24): 255.255.255.0 = 11000000.11111111.11111111.00000000
---------------------------------------------------------------
Network : 192.0.2.0 = 11000000.00000000.00000010.00000000
Broadcast : 192.0.2.255 = 11000000.00000000.00000010.111111112. IPv4 Boundary Cases: /30, /31 (RFC 3021), and /32
In standard multi-access IPv4 broadcast subnets (/0 through /30), two addresses are reserved: the all-zeros host identifier (the network address) and the all-ones host identifier (the directed broadcast address). Thus, a traditionalsubnet of prefix P provides 2(32 − P) − 2 usable host addresses.
For point-to-point links connecting exactly two routers, using a /30 block consumes 4 IPv4 addresses to assign only 2 interfaces—wasting 50% of the address space. To eliminate this waste, RFC 3021 standardized the use of /31 prefixes on point-to-point links:
| IPv4 Prefix | Subnet Mask | Total IPs | Usable Hosts | Engineering Semantics |
|---|---|---|---|---|
/24 |
255.255.255.0 |
256 | 254 | Standard LAN segment; .0 network, .255 broadcast |
/30 |
255.255.255.252 |
4 | 2 | Legacy point-to-point link (reserves network & broadcast) |
/31 |
255.255.255.254 |
2 | 2 | RFC 3021 point-to-point link; both endpoints usable |
/32 |
255.255.255.255 |
1 | 1 | Single-host route / loopback interface identifier |
/31 subnet (for example, 10.0.0.0/31), 10.0.0.0 and 10.0.0.1 are assigned directly to the two router interfaces. Limited broadcast (255.255.255.255) and link-local multicast continue to function normally for routing protocols such as OSPF and BGP.
3. IPv6 Prefix Architecture and RFC 6164 (/127)
IPv6 expands the address space to 128 bits, written as eight 16-bit hexadecimal groups (hextets) separated by colons. Under RFC 5952 canonical representation rules:
- Leading zeros within each 16-bit hextet must be suppressed (
0db8becomesdb8). - The longest consecutive run of two or more all-zero hextets is compressed to
::(if two runs are equal in length, the first run is compressed). - Hexadecimal digits
athroughfmust be lowercase.
Unlike IPv4, IPv6 has no broadcast address. All broadcast functionality is replaced by scoped multicast (ff00::/8). However, RFC 4291 defines the all-zeros interface identifier within a subnet as the Subnet-Router Anycast address.
On standard access networks, /64 is mandatory for Stateless Address Autoconfiguration (SLAAC, RFC 4862). On inter-router point-to-point links, however, assigning a /64 exposes routers to the Neighbor Discovery (ND) cache exhaustion attack (where an attacker sends packets to random addresses within the 264 range, forcing the router to queue millions of incomplete ND states). Consequently, RFC 6164 recommends configuring /127 prefixes on inter-router point-to-point links and disabling Subnet-Router Anycast on those interfaces.
4. Special-Purpose IPv4 & IPv6 Ranges
When configuring firewall ACLs, reverse proxies, or BGP route filters (bogon filtering), engineers must account for non-routable and special-purpose blocks defined in RFC 6890:
127.0.0.0/8and::1/128— Host loopback interfaces.10.0.0.0/8,172.16.0.0/12,192.168.0.0/16— RFC 1918 private IPv4 networks.100.64.0.0/10— RFC 6598 Shared Address Space for Carrier-Grade NAT (CGNAT).169.254.0.0/16andfe80::/10— Link-local unicast (including cloud instance metadata endpoints at169.254.169.254).fc00::/7(commonlyfd00::/8) — RFC 4193 IPv6 Unique Local Addresses (ULA).192.0.2.0/24,198.51.100.0/24,203.0.113.0/24, and2001:db8::/32— Reserved strictly for documentation and technical examples (RFC 5737 & RFC 3849).