# CIDR

CIDR notation writes a range of IP addresses as one address and a prefix length, so 203.0.113.0/24 means the 256 addresses sharing those first 24 bits.

Date: 2026-09-10

CIDR notation writes a range of IP addresses as one address and a prefix length: `203.0.113.0/24` means the 256 addresses that share those first 24 bits. Classless Inter-Domain Routing replaced the old fixed classes in 1993, and every allocation, route and blocklist has been written this way since.

## Where it appears in Spaw

`network` on an IP answer is the CIDR block the address was found in — the unit the registries allocate and the feeds list, so it is the right thing to remember if you are caching or aggregating.

CIDR is also the input format in two places: a secret API key can carry an allowlist of source addresses or ranges, and every threat and datacenter feed read here is compiled from published CIDR lists.

## Why a range and not an address

Almost nothing about an IP address is a fact about the address alone. Allocation, hosting, blocklisting and geolocation are all properties of a block, and an answer that pretends otherwise is claiming a precision the data does not have. `location_confidence` says which of country, region or city the underlying data actually supports for a given block.

Reference: https://spaw.co/glossary/cidr