What is a Network Prefix (CIDR)?
A network prefix is a contiguous block of IP addresses that are treated as a single routable unit. Prefixes are written in CIDR notation: the starting address followed by a slash and a number indicating how many leading bits define the network. 8.8.8.0/24 is the block of 256 addresses from 8.8.8.0 through 8.8.8.255. 192.0.2.0/30 is just 4 addresses. The prefix length determines the block size with mathematical precision.
CIDR Notation and Binary Representation
CIDR (Classless Inter-Domain Routing) was introduced in September 1993 via RFC 1517–1520, replacing the original classful system (Class A /8, Class B /16, Class C /24). Classful addressing wasted enormous amounts of address space — organizations needing 300 addresses had to receive a full Class B with 65,536. CIDR allows any prefix length from /0 (all of IPv4) to /32 (a single host).
The prefix length describes how many bits of the 32-bit IPv4 address are fixed (the "network" bits); the remaining bits identify hosts within the network. To find all addresses in a prefix:
- Write the starting address in binary
- The first N bits (where N is the prefix length) are the network bits — fixed
- The remaining (32 − N) bits are the host bits — they range from all zeros to all ones
Example: 203.0.113.0/25
- Binary:
11001011.00000000.01110001.00000000 - First 25 bits fixed; last 7 bits variable
- Block: 203.0.113.0 through 203.0.113.127 (128 addresses)
Prefixes in BGP
BGP is the protocol that propagates prefix reachability across the internet. Each autonomous system announces the prefixes it originates (owns) and re-announces prefixes it has learned, building the global routing table. Every BGP router selects the best path to each prefix and programs its forwarding table accordingly.
When a packet arrives at a router, it uses longest prefix match to decide where to forward it: among all matching prefixes, the most specific (longest prefix length) wins. This is both a routing mechanism and an attack vector:
8.8.0.0/16matches all addresses 8.8.0.0–8.8.255.2558.8.8.0/24matches only 8.8.8.0–8.8.8.255- For destination 8.8.8.8, the /24 wins because it is more specific
This is how BGP hijacks exploit the routing system: announcing a more-specific prefix than the legitimate holder causes traffic to be routed to the attacker.
Prefix Aggregation
Aggregation (also called summarization or supernetting) combines multiple smaller prefixes into one larger one. If an AS holds 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24, and 10.0.3.0/24, it can announce a single 10.0.0.0/22 instead of four /24s. This reduces the size of the global routing table.
Proper aggregation is considered good internet citizenship. The global IPv4 BGP table would be several times larger without it. Operators who announce de-aggregated (overly specific) prefixes put unnecessary load on every router's memory and processing.
Prefix Length Conventions and Filtering
Most networks filter BGP announcements based on prefix length to prevent routing table bloat and defend against some classes of hijack:
| Protocol | Minimum (most general) | Maximum (most specific) | Notes |
|---|---|---|---|
| IPv4 | /8 | /24 | Prefixes longer than /24 are filtered by most providers |
| IPv6 | /19 | /48 | Prefixes longer than /48 are typically filtered |
A prefix like 1.2.3.4/32 (a single host route) will not propagate globally — it will be dropped at most upstream networks. This is why more-specific hijacks using /25s are effective (they are at the boundary of what propagates) while a /30 hijack would not spread far.
Route Origin Authorization (RPKI and Prefixes)
RPKI ties prefix ownership to cryptographic certificates. A Route Origin Authorization (ROA) specifies: "ASN X is authorized to originate prefix P, up to maximum length L." If a BGP announcement carries an ASN or prefix length that contradicts the ROA, routers performing Route Origin Validation will mark it as RPKI-invalid and may discard it.
The maximum prefix length in a ROA is critical: if you hold 192.0.2.0/24 and create a ROA with maxLength 24, an attacker cannot hijack you with a /25 announcement without that announcement being RPKI-invalid.
IPv6 Prefix Conventions
IPv6 prefixes follow a structured allocation hierarchy. IANA allocates /12 blocks to RIRs. RIRs allocate /32 blocks to ISPs. ISPs allocate /48 blocks to end-sites. End-sites use /64 for individual subnets. The abundance of IPv6 address space means these conventions can be followed strictly without ever risking exhaustion.