DevKitHub

Programming

CIDR Subnet Calculator — IPv4 Ranges, Masks and Hosts

Enter an address with a prefix, such as 192.168.1.0/24, to see its network, broadcast, mask and usable host range. A mask can be given instead of a prefix.

Private (RFC 1918)Network address

192.168.1.0/24 — 254 usable

Network
192.168.1.0
Broadcast
192.168.1.255
Netmask
255.255.255.0
Wildcardfor ACLs
0.0.0.255
First host
192.168.1.1
Last host
192.168.1.254
Total addresses
256
Usable hosts
254
Netmask in binary
11111111.11111111.11111111.00000000
Address in binary
11000000.10101000.00000001.00000000

This tool runs entirely in your browser. Your input is never uploaded, stored or logged.

How it works

The address and prefix are turned into 32-bit integers and the rest is masking. The network address is the address ANDed with the mask, the broadcast is the network ORed with the inverted mask, and the usable range sits between them. The wildcard mask — the inverse — is shown because that is what Cisco access lists and OSPF take, and reading it off by hand is a common source of a rule that matches more than intended.

A /31 and a /32 are treated as the special cases they are rather than run through the same subtraction. A /31 has no broadcast address at all: RFC 3021 makes both addresses usable, which is how point-to-point links between routers are numbered, and subtracting two from a two-address block gives zero. A /32 is a single host, and the same arithmetic gives minus one. Calculators do print both of those numbers, and both are wrong.

An address with host bits set is reported as a host inside its subnet rather than silently answered for the network. 192.168.1.10/24 describes a machine in 192.168.1.0/24, and quietly normalising it is how a firewall rule ends up wider than the person writing it believed. The block is also checked against the special-use registries, so a private, loopback, link-local, carrier-grade NAT, multicast or documentation range is named rather than left to be recognised.

Common problems

Every example below is run against this tool in our test suite, so what it says here is what the tool actually does.

That is not a valid IPv4 address.

192.168.1.010/24
Why:
An octet with a leading zero is ambiguous. The traditional inet_aton reads 010 as octal 8, while most modern parsers read it as 10 — a disagreement that has been the basis of real SSRF filter bypasses.
Fix:
Write octets without leading zeroes: 192.168.1.10.

That is not a valid subnet mask.

10.0.0.0/255.255.0.255
Why:
A subnet mask has to be a solid run of ones followed by a solid run of zeroes. A mask with a gap in it describes no prefix length and cannot be used, even though it looks like a mask.
Fix:
Use a contiguous mask such as 255.255.255.0, or give the prefix length directly as /24.

A /30 link shows 2 usable hosts but a /31 shows 2 as well.

Why:
A /30 has four addresses and loses two to the network and broadcast. A /31 has two and loses neither, because RFC 3021 removed the broadcast address for point-to-point links.
Fix:
Both are correct. Use a /31 for a router-to-router link and keep the two addresses a /30 would waste.

Frequently asked questions

Why does a /31 show two usable addresses instead of zero?
Because RFC 3021 says so. A /31 has no broadcast address, so both of its addresses are usable, and that is how point-to-point links between routers are numbered. Subtracting two for network and broadcast gives zero, which is what most calculators print and is wrong.
What is a wildcard mask for?
It is the inverse of the subnet mask, and it is what Cisco access control lists and OSPF network statements take instead of a mask. 255.255.255.0 becomes 0.0.0.255.
Does it support IPv6?
Not yet. An IPv6 address is rejected rather than half-parsed, because producing plausible-looking output for an address it did not really understand would be worse than saying no.

Related tools

Last updated