How can we explain CIDR notation with /24 and /32 to a manager? [closed]

Question

Update: I seem to get two kinds of answers and I need to get more clarity on how they relate (or not). What we have so far is, roughly in the lines of:

you have 32 bits, the / indicates how you split it

and (or versus)

You have an address, the / indicates the range around it

---

Main question

I am looking for a way to explain a notation such as a.b.c.d/e to someone who is not too deep into networking.

Imagine it is a manager type, or even a data scientist who has seen some sites can be accessed by typing an IP address, but he/she does not have too much more familiarity with the field.

What have I tried?

I searched for explanations, and found many but often these things talk about 'subnet masks' which would require an explanation by itself.

Therefore I have tried to come up with a simple anecdote, though I am also open to an explanation that is simple without an anecdote I have found this to work well in the past.

Attempt so far -- Warning, comments pointed out my example has some serious issues

An IP address consists of four numbers separated with a dot between each. You read it from left to right, and each dot adds a level of detail. This is very similar to a real address, think about:

Country.City.Street.Housenumber

When working with IP addresses, we often add something like /24 or /32 at the back. This is...

Answer 1

An ip address consists of four numbers separated with a dot between each. You read it from left to right, and each dot adds a level of detail. This is very similar to a real address, think about:

Country.City.Street.Housenumber

I'm sorry, but this is simply wrong. The dots do not have any significance. They are only there to make a 32-bit binary number (that's all that an IPv4 address is) easier for humans to read. You can't infer any hierarchy from them. If you're explaining IP addresses that way, you're misleading people.

I know you don't want to get into subnet masks or binary math, but there's really no way around it. I'll keep it as simple as I can.

IP addresses have a two-level hierarchy: network and host. Think of area code and number for your phone (at least in the US). Ten digit telephone numbers have a fixed format: 3 digits for the area code, and 7 digits for the phone number. Similarly, for IP addresses, part of that 32-bit binary number is the network address portion, and part is the host address portion.

Unlike phones, IP addresses do not have a fixed format for hierarchy. The number of (binary) digits that make up the network and host portions can vary. Where you divide the bits between the two is determined by the subnet mask (There. I said it).

The CIDR notation tells you how many bits of the address belong to the network portion. For example, /20 means the first 20 bits of the address are the network portion of the address -- the rest (32 - 20 = 12) are the host portion. /24 means 24 bits are the network and 8 are the host (32 - 24 = 8), and so on.

If all you're doing is typing in address into your browser, you don't need to know the binary math. But if you're creating networks and assigning addresses, you need to understand the binary math behind them. Otherwise you will make mistakes that lead to incorrect addresses.

EDIT:

I know that my answer will go over the heads of many so-called "managers", but it's important that YOU understand it so you can explain it better. It you're confused, your explanation will be confusing (and possibly wrong). Based on your scenario, the best simple explanation I can give is this:

IP addresses are divided into two parts - network and host, just like telephone numbers are divided into parts - area/city code and number. The /xx indicates how much of the IP address is the network part and how much is the host part.

I wouldn't go any deeper than that. If you get questions, then you'll have to bring in binary and subnet masks.

Answer 2

You don't need even that detail. Simply treat them as magic values:

Short answer: An IP address has four blocks of digits. There is a standard notation called CIDR where if you put /24 at the end it means every IP address that starts by the same three numbers. So if you put 192.168.120.0/24 that means that access is allowed from every IP address from 192.168.120.0 to 192.168.120.255 so only those within the allowed range is allowed into the system.

Any network/security engineer actually needing to set that will understand that setting right away. If you sidetrack the product showcase into a Networking 101 you will lose time that could be used to present other features, while the technical people that is also in the meeting and that know perfectly about CIDR will be cringing about such waste of time.† And that manager won't need such information, anyway. It's best IMHO to ask them to question you after the meeting / send you a mail if they are interested in the long, detailed answer.

Nothing wrong about being curious and wanting to know more about it, but a product showcase is not the right place, and I suspect in reality such manager probably don't really mind about that detail.

† In fact, this simplified version may lead those network engineers to jump asking if you don't support IPv6, which they are using internally. A more accurate version of that answer would start by “An IPv4 address is formed by four octets...“ which would already get the manager lost in the first phrase.

Answer 3

... how many house numbers the street has.

If you have more than 256 houses in a street, you need to use part of the street number for house numbers. This is only important to know when you want to know if someone else lives on the same street as you because you drop off letters directly instead of giving them to the post office.

Answer 4

Here are some partial building blocks for you:

"Lets say you have an IP address, for example 123.4.5.6. It is a single IP address. However, if we change it a bit, we can get something like this: 123.0.0.0/8

That latter concept is something called a CIDR notation. You can think now that it is kind of a bunch of IP addresses. 123.0.0.0/8 means the same as 123.* .* .* Also, 123.0.0.0/16 means 123.0.* .*

So, the number after the slash tells how much of the address can be wildcards. The smaller the number, the bigger the amount of wildcards.

Wildcards start from the end of the address."

Answer 5

Nobody has yet addressed the "why" of subnet masks. At least in my understanding...

A subnet mask represents the scope of a broadcast domain.

Computers/devices within a subnet domain are able to discover other devices within that subnet. They can also find out how to communicate (find each others address) even though they initially know nothing about each other.

Computers/devices across different subnet domains cannot discover each other. Something must be known about the device being sought (such as a device name in the DNS system) before the devices can communicate.

An (rather poor) analogy may be multiple open-plan offices within a building. I can walk around my open plan office and introduce myself to anyone else. However to find someone in a different open-plan office I need to walk to reception, identify a specific person by name, and ask the receptionist in which room, and at which desk the person maybe found.

Answer 6

An IPv4 IP address is 32 bits of data, often written as 4 8 bit fields (A.B.C.D), (or, in binary, aaaaaaaa.bbbbbbbb.cccccccc dddddddd) . Netmasks are 32 bits, as well, and can be written the same way.

The IP address is, for routing purposes, divided into "network" and "host" fields, by the netmask. /20 and /24 are abbreviations for 20 and 24 bit netmasks. That's 20 or 24 initial 1 bits, 255.255.240.0 or 255.255.255.0. The 1 bits represent the "network" field in the IP address. The 0 bits in the netmask represent the "host" field. The size of the "host" field limits the number of hosts in the "local" network, except that host addresses 0 and all bits are reserved. Thus, a /20 network may have up to 2,045 unique IP addresses, while a /24 network may have up to 253.

To extract the "network" field, the IP address is logically ANDed with the netmask. To extract the "host" field, the IP address is logically ANDed with the complement of the netmask. 0.0.15.255 and 0.0.0.255 for the /20 and /24 examples.

If the "network part" of a destination IP address (destination IP address ANDed with the netmask) is equal to the "network part" of MY IP address (MY IP address ANDed with the netmask), the destination IP address is "local", and the packet containing the destination IP address can be sent out without routing.

If the two "network parts" are NOT equal, one must consult the routing tables to find where to send the packet.

Answer 7

Your phone number is 10 digits long right? Well, it's a /3 CIDR. We never talk about the CIDR in a phone number because they're all the same length (in the US). But your phone number is a /3 CIDR meaning all the numbers with the same area code are in the same network. When you call someone with a different area code, the call has to go through a 'router' which we call a long distance company.

Well....

IP addresses work the same way except that phone numbers use the digits 0-9, where IP uses just the digits 0 and 1. The CIDR number just tells you how many of those digits are part of the network and how many are part of the end user's number. We talk about the CIDR in networking because in IP networks (unlike phone networks) the CIDR can be different depending on economic and other factors.