CIDR / subnet calculator

What this tool does

A CIDR block such as 192.168.1.0/24 is a compact way of naming a range of addresses. This tool takes one and answers the questions that follow from it: where the range starts and ends, how many addresses it holds, how many of those can be given to a machine, what the subnet mask looks like, whether a particular address falls inside, and what you get if you cut it into smaller pieces.

It handles IPv4 and IPv6, and it accepts a host address as readily as a network address — paste 192.168.1.57/24 straight out of ip addr and it will tell you the block that address lives in. Everything is arithmetic performed in your browser: no lookups, no server, and it works with the network unplugged.

What the slash number means

An IPv4 address is 32 bits. The number after the slash — the prefix length — says how many of those bits identify the network; the rest identify a host within it. A /24 fixes the first 24 bits and leaves 8 free, which is why it holds 2^8 = 256 addresses.

192.168.1.0                           # the address
11000000.10101000.00000001.00000000   # its 32 bits
11111111.11111111.11111111.00000000   # the /24 mask: 24 ones, 8 zeros

Where the mask has a one, the bit belongs to the network and is fixed for every address in the block; where it has a zero, the bit is free to vary and identifies a host. Every extra bit of prefix halves the block. That relationship is the whole of subnetting, and it is worth internalising rather than memorising a table:

• /24 — 256 addresses, 254 usable. The classic small network.
• /25 — 128 addresses, 126 usable. Half a /24.
• /26 — 64 addresses, 62 usable.
• /30 — 4 addresses, 2 usable. The traditional point-to-point link.
• /16 — 65 536 addresses. A /24 sixteen times over, twice.

Why two addresses are missing

A /24 holds 256 addresses but only 254 usable ones, because IPv4 spends two of them. The first address in a block is the network address, which names the block itself and is not assigned to any interface. The last is the broadcast address, which reaches every host on the link at once. That is where the familiar 2^n − 2 comes from.

Two prefixes break that formula, and most calculators get at least one of them wrong:

• A /31 has two addresses, and the formula says zero usable. RFC 3021 defines /31 for point-to-point links, where there is no need for a broadcast address and both addresses are assigned — one to each end. The right answer is 2.
• A /32 is a single address, and the formula says −1. A /32 names one host exactly; it is what you write for a single server in a firewall rule or a route.

This tool follows RFC 3021 and reports 2 and 1 for those cases. If another calculator tells you a /31 has no usable addresses, that is the textbook formula applied past the point where it holds.

The subnet mask and the wildcard mask

The subnet mask is the same information as the prefix length, written as a dotted quad: the network bits are ones and the host bits are zeros. /24 is 255.255.255.0. Older configuration formats want the mask, newer ones want the prefix, and they are interchangeable.

The wildcard mask is the subnet mask inverted — 0.0.0.255 for a /24. Cisco access lists and OSPF network statements are written with it, and the inversion catches people out often enough to be worth stating plainly: in a wildcard mask, a zero bit means "must match" and a one bit means "don't care", which is the opposite of a subnet mask.

IPv6 is the same idea with fewer exceptions

IPv6 addresses are 128 bits instead of 32, and the prefix works identically — a /64 fixes the first 64 bits. The arithmetic is the same; what changes is that two IPv4 complications disappear.

• There is no broadcast address. IPv6 replaced broadcast with multicast, so nothing is reserved at the end of a prefix.
• Nothing is reserved at the start either, so every address in the block is assignable and the usable count equals the total. (The all-zeros address in a subnet is the subnet-router anycast address, a routing convention rather than a hole in the range.)
• There is no dotted subnet mask. IPv6 is always written as a prefix length; a 128-bit mask in text would be unreadable and nothing asks for one.

A /64 is the standard size for a single link, because stateless address autoconfiguration expects 64 host bits. A site is typically given a /48 or /56, which is then split into /64s — one per VLAN or segment. That is why this tool will happily divide a /48 into /64s and tell you there are 65 536 of them.

The address counts get large fast, so they are shown both as a power of two and as a full figure: a /32 holds 2^96 addresses, which is 79 228 162 514 264 337 593 543 950 336. The power is what is readable; the digits are what you copy.

Writing IPv6 addresses the canonical way

One IPv6 address can be written many ways, which makes comparing two of them by eye unreliable. RFC 5952 defines a single canonical text form, and that is what this tool outputs:

• Lowercase hexadecimal, and no leading zeros inside a group — 2001:0db8 becomes 2001:db8.
• The longest run of all-zero groups is replaced by ::, and only the longest. On a tie the leftmost run wins.
• A single zero group is never compressed, because :: would save nothing and create a second spelling.

The expanded form is shown alongside it, with every group padded to four digits. That one is not canonical, but it is the form that lines up in a column when you are comparing a list of addresses.

Splitting a block

Cutting one network into several equal ones is the operation people usually come to a subnet calculator to perform. Each extra bit of prefix doubles the number of subnets and halves their size: a /24 becomes two /25s, four /26s, eight /27s, and so on.

192.168.1.0/24  ->  /26
192.168.1.0/26      # addresses   0-63
192.168.1.64/26     # addresses  64-127
192.168.1.128/26    # addresses 128-191
192.168.1.192/26    # addresses 192-255

The subnets tile the parent exactly — no gaps and no overlap — which is a property worth checking when you are carving up address space by hand. Note the counts grow quickly: a /8 split into /24s is 65 536 networks, so the list here is capped and the true total reported next to it rather than the answer being quietly truncated.

Ranges that mean something particular

Some blocks are reserved for a specific purpose, and a network that sits inside one is labelled here. The ones that come up most:

• Private (RFC 1918) — 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Routable inside an organisation, never on the public internet.
• Loopback — 127.0.0.0/8 on IPv4 and ::1 on IPv6. Traffic that never leaves the host.
• Link-local — 169.254.0.0/16 and fe80::/10. Self-assigned, valid only on one link. An IPv4 address in this range usually means DHCP failed.
• Carrier-grade NAT — 100.64.0.0/10. Used between a subscriber and an ISP; seeing it on your own network is a sign of an ISP-side NAT.
• Documentation — 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 and 2001:db8::/32. Reserved for examples, which is why they appear throughout this page.
• Unique local — fc00::/7. The IPv6 counterpart to RFC 1918 private space.

The label is applied only when the whole block sits inside the special range, not when it merely overlaps one. A 0.0.0.0/0 covers every private range in existence but is not itself private, and saying otherwise would be worse than saying nothing.