Skip to content
Advertisement

CIDR / Subnet Calculator

Turn an IPv4 or IPv6 prefix into netmask, broadcast, usable range and host count — then split it, compare it, or aggregate a range.

Network Calculator

IPv4 · /24

26 bits

Network
10.0.0.0/24
Broadcast
10.0.0.255
Usable range
10.0.0.1 – 10.0.0.254
Usable addresses
254 256 total, minus network and broadcast
Netmask
255.255.255.0
Wildcard mask
0.0.0.255
Integer
167,772,160
Hex
0x0a000000

Split into /26

4 subnets

  • 10.0.0.0/26
  • 10.0.0.64/26
  • 10.0.0.128/26
  • 10.0.0.192/26

How CIDR / Subnet Calculator works

CIDR notation replaced the old address classes with one explicit number. In 10.0.0.0/24 the prefix length says the leading 24 bits identify the network and the remaining 8 identify a host inside it. Everything a subnet table used to list — netmask, broadcast address, block size, the boundary the next block starts on — is arithmetic on that single figure, which is why routing stopped needing to know whether an address looked like a class A.

The arithmetic is bitwise. AND the address with the netmask to get the network address; OR it with the wildcard mask, which is the netmask inverted, to get the broadcast. The block holds two-to-the-power-of-the-remaining-bits addresses, of which two are spoken for: the all-zeros network identifier and the all-ones broadcast. A /24 is 256 addresses and 254 usable hosts, and the same subtraction holds at every size.

Two prefixes break that subtraction deliberately. RFC 3021 defines /31 as a two-address point-to-point link with BOTH addresses usable, on the reasoning that a link with exactly two endpoints has nobody to broadcast to — this halves the address waste on router interconnects, which used to burn a /30 each. A /32 is a single address: a loopback, a route target, a host entry in a firewall rule. The textbook "minus two" would give /31 zero hosts and /32 negative one.

IPv6 uses the same prefix idea over 128 bits, so the counts leave the range of ordinary integers immediately and have to be computed as big integers. There is no broadcast address, and no two addresses are reserved out of a subnet, but there is a canonical text form: RFC 5952 requires lowercase hex, no leading zeros within a group, and a single :: covering the longest run of zero groups — leftmost when two runs tie. Two spellings of one address are a real operational hazard when a config file is grepped or an ACL is compared.

Reference

  • network = address AND netmask
  • wildcard = NOT netmask · broadcast = network OR wildcard
  • total addresses = 2^(32 − prefix), or 2^(128 − prefix) for IPv6
  • usable hosts = total − 2, except /31 → 2 (RFC 3021) and /32 → 1
  • a /n block contains 2^(m − n) subnets of size /m

How to use this calculator

  1. Type a block

    Any address with a prefix length, v4 or v6. If host bits are set — 10.0.0.5/24 rather than 10.0.0.0/24 — the containing network is reported instead of being masked off without comment.

  2. Take the boundaries

    Network, broadcast, first and last usable address, netmask, wildcard mask, and the count, with the integer and hexadecimal forms alongside for anything that wants a numeric literal.

  3. Split or aggregate

    Divide the block into equal subnets of a longer prefix, or feed in a start and end address to get the shortest list of CIDR blocks that covers exactly that range and nothing outside it.

  4. Test containment

    Check whether one block sits inside another or merely overlaps it — the question behind most peering conflicts and most firewall rules that match more than intended.

Worked examples

An ordinary /24

Given
10.0.0.0/24
Result
Netmask 255.255.255.0, broadcast 10.0.0.255, hosts 10.0.0.1–10.0.0.254, 254 usable

The wildcard mask 0.0.0.255 is the same value inverted, and it is the form Cisco ACLs and OSPF network statements expect.

Host bits left set

Given
10.0.0.5/24
Result
Interpreted as the 10.0.0.0/24 network, with the discrepancy called out

Silently masking the address hides a typo. The distinction matters when the input came from an interface configuration, where 10.0.0.5/24 is a perfectly correct way to state an address and its prefix.

A point-to-point link

Given
192.0.2.0/31
Result
Two addresses, both usable: 192.0.2.0 and 192.0.2.1

RFC 3021. Older equipment predates it and will reject the configuration, which is the one thing to verify before rolling /31 out across a fabric.

A cloud subnet

Given
A /28 carved out of a VPC
Result
16 addresses, 14 by the textbook, 11 in practice on AWS, Azure or GCP

Each provider reserves five: network, gateway, one or two for internal services, and broadcast. Sizing from the textbook figure and then filling the subnet is a reliable way to run out.

Canonical IPv6

Given
2001:0DB8:0000:0000:0000:0000:0000:0001/64
Result
2001:db8::1/64, containing 18,446,744,073,709,551,616 addresses

RFC 5952 form. The uppercase, zero-padded spelling is the same address and will not match it in a string comparison.

When to use it

  • Carving a VPC address range into subnets per availability zone without leaving unusable gaps between them.
  • Working out whether a proposed peering range overlaps something already routed before the connection is requested.
  • Converting a firewall change request written as "10.20.0.0 through 10.20.63.255" into the blocks that cover it exactly.
  • Reading a route table entry during an incident to see which addresses it actually captures.
  • Sizing a DHCP scope, where the reserved addresses at both ends decide whether the pool fits.

Things to watch out for

  • Leading zeros in an octet are rejected rather than trimmed. Some libraries read 010 as decimal ten and others as octal eight, and an address that means two different things to two tools is worse than one that fails to parse.
  • Cloud providers reserve five addresses per subnet rather than two, so usable capacity in a VPC is three lower than the classic formula predicts at every prefix length.
  • An IPv4-mapped address such as ::ffff:192.0.2.1 is an IPv6 spelling of a v4 address; it belongs to a v6 prefix and is not routable as v4 on its own.
  • A /0 covers the whole address space and a /32 covers one address. Both are legal, and both appear in real route tables — as a default route and as a host route respectively.
  • Range aggregation returns the minimal covering set, which may be several blocks of different sizes. Any range whose endpoints do not fall on power-of-two boundaries cannot be one block.

Frequently asked questions

Why does a /31 have two usable addresses?

RFC 3021 removed the network and broadcast reservation for two-address links, because a point-to-point connection has exactly one other endpoint and never needs to broadcast. It halves the addresses consumed by router interconnects compared with the /30 that was previously required.

How many hosts fit in a /26?

Sixty-four addresses, of which 62 are usable on a normal network once the network identifier and the broadcast address are subtracted. On AWS, Azure or Google Cloud the figure is 59, because each provider reserves five addresses in every subnet.

What is a wildcard mask and how does it differ from a netmask?

It is the netmask with every bit flipped: a /24 has netmask 255.255.255.0 and wildcard 0.0.0.255. Cisco access lists and OSPF network statements take the wildcard form, so a mask pasted from the wrong column matches an entirely different set of addresses.

Can two IPv6 addresses look different and be the same?

Yes, which is what RFC 5952 exists to prevent. Case, zero padding within a group, and where the :: compression is placed can all vary while the underlying 128 bits are identical, so string comparison of non-canonical addresses is unreliable.

What does it mean when a prefix has host bits set?

It means the address identifies a specific interface inside the block rather than the block itself. 10.0.0.5/24 is valid as an interface configuration and belongs to the 10.0.0.0/24 network, but it is not itself a network address.

Related DevOps tools

All devops tools