Classless Inter-Domain Routing (CIDR): an Address Assignment and Aggregation Strategy
obsoleted by
- rfc-4632 — Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan
obsoletes
- rfc-1338 — Supernetting: an Address Assignment and Aggregation Strategy
Extracted elements (25)
Address space is allocated hierarchically from the NIC to service providers, and from providers to clients, rather than from a central authority directly to each client. This distributes administrative load, scales as the Internet grows, and enables topological aggregation so that a provider can advertise a single aggregate covering all its clients.
Both the new addressing plan and updated classless inter-domain routing protocols are jointly required for supernetting to reduce routing table growth. Deploying either without the other is insufficient: deploying only the addressing plan will temporarily accelerate routing table growth before protocol changes arrive.
CIDR was motivated by three scaling crises: imminent exhaustion of class B address space (class C too small, class B too large for mid-sized organizations), explosive growth of routing tables beyond manageable size, and eventual exhaustion of the 32-bit address space. The plan addresses the first two immediately while deferring the third.
Deploying the new addressing plan before classless inter-domain protocols are available will cause routing tables to temporarily grow faster than baseline, since individual class-C assignments will be visible before aggregation is possible. This deployment sequencing risk must be considered when planning rollout.
Multi-homed organizations receive their address space from a provider but cannot be aggregated because each of their service providers must explicitly advertise them. The routing cost for multi-homed sites under CIDR is therefore similar to the pre-CIDR status quo.
Preconfigured aggregation ranges are preferred over purely dynamic aggregation because dynamic aggregation cannot distinguish a temporarily unreachable constituent route from one that does not belong to the aggregate, risking both under- and over-aggregation.
CIDR supernetting is incompatible with older inter-domain protocols such as EGP2 that lack classless network representation. The recommended interoperability strategy is for new routers peering with old routers to advertise a default route rather than exploding supernet information into individual class-based entries.
Transit networks that import external routing information into an IGP must either adopt a classless IGP (e.g., OSPF or IS-IS), use internal BGP to propagate external reachability without flooding the IGP, or flood only a default route. Older fixed-subnet or classful IGPs cannot propagate supernet information.
When a client allocated from provider RA's space moves to provider RB without renumbering, RA's aggregate still attracts traffic for the client. Under Rule #2, RA discards that traffic (no routing loop), but diagnostic tools such as traceroute will falsely suggest a problem inside RA's network.
When CIDR is extended to class A address space, all routers within the class A domain must run a classless IGP supporting variable-length subnet masks. Using a single fixed subnet mask throughout a sub-allocated class A is likely to require advertising tens of thousands of subnets and is impractical.
A routing domain that performs route summarization MUST discard packets that match the aggregate but do not match any of the explicit constituent routes. This prevents routing loops in the presence of less-specific routes such as a default route.
All organizations, including multi-homed ones, should obtain address allocations from their service provider(s), with blocks falling on bit boundaries to permit easy route aggregation.
It is recommended that preconfiguration of aggregation ranges be used rather than purely dynamic aggregation, because it allows precise specification of the range of destinations to aggregate and avoids ambiguity when a constituent route is temporarily unreachable.
Organizations which change service providers are recommended to eventually renumber into the new provider's address space to avoid 'punching holes' in the original provider's aggregate advertisement.
Route masks must be left-contiguous. Implementations must accept arbitrary network number and mask pairs for all routing destinations; routing filter elements must also allow masks.
Routing to all destinations MUST be done on a longest-match basis only. Multi-homed destinations cannot be summarized and must always be explicitly announced into every routing domain through which they are reachable.
The degenerate default route 0.0.0.0 mask 0.0.0.0 MUST be accepted by all implementations. It should never be advertised via the inter-domain protocol unless specific configuration explicitly permits doing so.
A 'sink route' is installed by a border router for each of its aggregated address blocks. By longest-match, traffic destined to components of the aggregation that are not explicitly reachable is forwarded to the sink and discarded, preventing routing loops.
Address blocks allocated to clients must be power-of-two aligned contiguous ranges, expressible as a single (network, mask) pair. For example, 8 class-C networks starting at 192.24.0.0 are described as 192.24.0.0/255.255.248.0.
Aggregates must not numerically encompass class D (multicast) address space even if they do so numerically. The handling of aggregates that span multicast addresses is not well understood and the optimal strategy is to exclude class D from any aggregate.
CIDR represents routing destinations as (network, mask) pairs rather than classful A/B/C network numbers. Routing decisions are made by longest-prefix match: among all (network, mask) pairs matching a destination, the one with the longest mask is selected.
For sub-allocated class A space, IN-ADDR.ARPA delegation also proceeds on octet boundaries. A provider holding 10.8.0.0/255.248.0.0 requires eight second-level delegations (8.10 through 15.10 IN-ADDR.ARPA); a client holding 10.10.64.0/255.255.192.0 requires 64 third-level delegations (64.10.10 through 127.10.10 IN-ADDR.ARPA).
IN-ADDR.ARPA reverse DNS zones for CIDR blocks must be delegated along octet boundaries. For a block of 1024 class-C networks spanning 199.0.0 – 199.3.255, delegation requires four second-level records (0.199, 1.199, 2.199, 3.199 IN-ADDR.ARPA) rather than 1024 third-level records.
Route filter elements must be extended to include explicit masks alongside network addresses. Filters should automatically permit more-specific prefixes when a less-specific entry is accepted, making previously implicit class-based masks explicit.
The authors explicitly state that security issues are not discussed in this memo.