CIDR Calculator

An IPv4 address is 32 bits, written as four decimal octets. CIDR (Classless Inter-Domain Routing) describes a block of addresses as a starting address plus a prefix length: the number of leading bits that every address in the block shares. 192.168.1.0/24 means the first 24 bits are fixed and the last 8 vary, giving 2^8 = 256 addresses from 192.168.1.0 to 192.168.1.255. CIDR replaced the old class A, B and C scheme in 1993 and now underlies every routing table, cloud VPC, firewall rule and VPN configuration you will meet.

Enter any IPv4 block and this calculator returns the network address, the broadcast address, the dotted netmask, the count of usable host addresses and the first-to-last host range. The arithmetic runs in your browser, so internal address plans never leave your machine. The tool is IPv4 only; IPv6 blocks need a different calculator or the Python one-liner further down. The companion guide Understanding CIDR and Subnetting covers the same ground with more worked examples.

How the numbers are derived

A prefix of /n produces a mask with n ones followed by (32 minus n) zeros. For /24 that is 11111111.11111111.11111111.00000000, or 255.255.255.0. The network address is the input address AND the mask (all host bits cleared); the broadcast address is the network address OR the inverted mask (all host bits set). Total addresses are 2^(32 minus n). Two of them are conventionally not assigned to hosts, the network address and the broadcast address, which is why a /24 has 254 usable hosts. Cisco-style access lists use the inverted mask, called the wildcard mask: for /24 it is 0.0.0.255.

Two special cases break the "minus two" rule. RFC 3021 allows a /31 on point-to-point links with both addresses usable, and a /32 is a single host with no network or broadcast address at all. The calculator applies the classic formula, so it reports zero usable hosts for those two prefixes; read them as "two hosts" and "one host" respectively.

Ranges you should recognise on sight

• 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16: private address space (RFC 1918), never routed on the public internet.
• 100.64.0.0/10: carrier-grade NAT space (RFC 6598), which is what many Indian broadband and mobile connections sit behind.
• 127.0.0.0/8: loopback. 169.254.0.0/16: link-local, also where cloud metadata services live (169.254.169.254).
• 0.0.0.0/0: every address, the default route, and in a security group the phrase "open to the whole internet".

Planning cloud networks

Cloud providers reserve addresses inside every subnet. AWS takes five: the network address, the VPC router (.1), the DNS resolver (.2), one held for future use (.3) and the broadcast address, so an AWS /24 has 251 usable addresses and an AWS /28 has 11. Azure and Google Cloud reserve a similar handful at the start and end of each range; check their documentation for the exact count before sizing tiny subnets. AWS VPCs must be between /16 and /28.

The mistakes that hurt later are overlaps. Two VPCs with the same 10.0.0.0/16 cannot be peered, a site-to-site VPN cannot route between an office and a cloud that both use 192.168.1.0/24, and a Kubernetes cluster whose pod CIDR overlaps the VPC produces baffling connectivity failures. Allocate from a single plan: for example one /16 per environment and region, carved into /20 subnets per availability zone, with the pod and service CIDRs drawn from a separate range such as 100.64.0.0/16 that nothing else uses. Write the plan down; the calculator tells you the boundaries, the spreadsheet stops the collisions.

Command-line equivalents

# Debian / Ubuntu: apt install ipcalc
ipcalc 10.0.0.0/22

# Any system with Python 3, no packages needed
python3 -c "import ipaddress as i; n=i.ip_network('10.0.0.0/22'); print(n.netmask, n.num_addresses, n.broadcast_address)"

# Split a block into /24s
python3 -c "import ipaddress as i; print(*i.ip_network('10.0.0.0/22').subnets(new_prefix=24), sep='\n')"

# Does an address fall inside a block?
python3 -c "import ipaddress as i; print(i.ip_address('10.0.3.7') in i.ip_network('10.0.0.0/22'))"

# IPv6 works the same way
python3 -c "import ipaddress as i; n=i.ip_network('2001:db8::/48'); print(n.num_addresses)"

A note on IPv6

IPv6 addresses are 128 bits written as eight hexadecimal groups, with one run of zero groups compressible to ::. The same prefix idea applies, but the sizes are enormous: a /64 is the standard size for a single LAN segment because stateless address autoconfiguration requires it, sites commonly receive a /48 or /56, and there is no broadcast address (multicast is used instead). 2001:db8::/32 is reserved for documentation, fe80::/10 is link-local and fc00::/7 holds unique local addresses, the IPv6 counterpart of RFC 1918 space.

1. Type an IPv4 block in CIDR form, for example 10.0.0.0/16 or 192.168.1.0/24, into the input. The address must be a valid dotted quad and the prefix a number from 1 to 32.
2. Read the network address, broadcast address and dotted netmask; these are the values firewall and routing configurations ask for.
3. Use the usable host count to check that the subnet is big enough, remembering that cloud providers reserve a few extra addresses.
4. Copy the first-to-last range into your security group, VPN configuration or IP allocation spreadsheet.
5. Treat /31 and /32 as special cases: the classic formula shows zero usable hosts, but a /31 link has two and a /32 is one host.

• Sizing AWS or Azure subnets for an application tier and confirming the host count after provider reservations.
• Checking that a new VPC range does not overlap the office network before requesting a site-to-site VPN.
• Converting a /27 into its dotted netmask for a router or firewall that does not accept prefix notation.
• Writing a security group rule that allows only the office egress range instead of 0.0.0.0/0.
• Verifying that a Kubernetes pod CIDR is large enough for the planned node count.
• Answering "which subnet is 10.20.37.14 in?" during an incident by testing candidate blocks.