CIDR: A Prescription for Shortness of Address Space

This article explains the concept of CIDR and shows you how you can implement it on your network.
Private Address Groups

Another way many companies can expand their pool of usable IP addresses is to take advantage of the private IP addresses set aside for companies and individuals not requiring direct Internet access on all their machines. These numbers can be used as seen fit.

By using a firewall or proxy server that performs network address translation (NAT), called “masquerading” in the Linux community, these machines can still connect to the Internet. The bright side is you won't be routing internal company addresses to the Internet, since most routers are set up to not route these private addresses. Conversely, no one can directly access your systems, so rogue web sites springing up in your company will not come back to haunt you. In order for anyone to access an internal computer, they would have to either log in to the proxy server first, then continue in, or be redirected by the proxy through the server to the designated machine.

The reference for those addresses we can make use of with no prior coordination is RFC 1918, “Address Allocation for Private Internets”, February 1996. These private addresses are as follows (excerpt from RFC): - (10/8 prefix)   - (172.16/12 prefix)  - (192.168/16 prefix)

Note that under the old classful addressing, while the first address segment is one Class A network, the second would actually be 16 Class B networks, and the final segment 256 Class C networks. By implementing a Linux gateway box and setting up some simple rules in ipfwadm (generally available with all Linux distributions), we can perform masquerading or Network Address Translation, giving all computers on the private network full Internet access. However, those on the Internet cannot get to any of the computers with private addresses unless one of two things happens. One, the administrator sets up the gateway to act as a proxy server; proxying requests on a particular port to a particular computer, or two, by the Internet user using TELNET to access the gateway box first, then on to the internal computers. Thus, private addresses stay private.

These address groups can also be put to use in private networks that piggy back on the Internet. By using two “live” (non-private) IP addresses, one on each network's “gateway” machine, we can tie two private networks together using Linux's IPIP, IP tunneled inside IP. While this won't provide privacy unless the two gateways are running an encryption program such as ssh (secure shell), it can provide a virtual network.


While live Internet addresses are becoming scarce, companies and individuals can maximize use of their current address space and even expand their address space through the use of private addresses. CIDR can also be used to improve security and increase network response time through subnetting.

By staying current with trends in such things as CIDR and Linux's networking software, most obstacles to Internet and Intranet connectivity can be easily circumvented. As CIDR provides everyone with a way to maximize the little we have, private addresses afford us the flexibility to expand beyond those addresses provided by our Internet Service Provider.

David Bandel is a Computer Network Consultant specializing in Linux, but he begrudgingly works with Windows and those “real” UNIX boxes like DEC 5000s and Suns. When he's not working, he can be found hacking his own system or enjoying the view of Seattle from 2,500 feet up in an airplane. He welcomes your comments, criticisms, witticisms and will be happy to further obfuscate the issue. He can be reached via e-mail at



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

ping no longer working without destination address?

koanhead's picture

I realize that this article is 12 years old, but I stumbled across it whilst searching to find if/why ping does not work with CIDR addresses. The article says:

Type the following command:

ping -c 1
What you will see in response is every UNIX box answering back with its IP address, and each reply following the first one will have (DUP!) next to it, indicating it is a duplicate reply.

On my system, I see:
me@here:~$ ping -c 1
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
[-M mtu discovery hint] [-S sndbuf]
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
Which suggests to me that ping won't work at all without a destination address.
It's possible but not clear that my router is causing a problem with this. ip neigh show outputs the router's address only. I can ping other hosts on the network, but only if I already know their IP addresses. I don't know any other way of discovering the hosts on the network, so I tried ping with a CIDR address, which was not recognized:
me@here:~$ ping
ping: unknown host
Interestingly, nmap does work with CIDR, and discovers most but not all hosts on the network (except the sole Win7 computer, which responds to ping.)
None of this is intended as a complaint against the author, only as further information for others who may read this article.