Determining whether an IP belongs to a given CIDR network segment requires converting the IP to a 32-bit (IPv4) or 128-bit (IPv6) binary integer, then performing a bitwise AND operation with the subnet mask before comparing the network address.