CIDR Subnet Calculator

CIDR (Classless Inter-Domain Routing) notation writes a network as an address plus a prefix length, like 192.168.10.0/24. The prefix says how many leading bits are fixed as the network portion; the rest identify hosts. This calculator expands a block into everything you need to plan or audit it: network and broadcast addresses, subnet mask, wildcard mask, the usable host range, and the total host count.

How the math works. A /24 fixes the first 24 bits, leaving 8 host bits, so the block holds 2⁸ = 256 addresses. The first (network) and last (broadcast) addresses are reserved, leaving 254 usable hosts. Increase the prefix to /25 and you halve the block to 128 addresses (126 usable); a /30 leaves just 2 usable hosts, the classic point-to-point link. The wildcard mask (the inverse of the subnet mask) is what ACLs in Cisco IOS and many firewalls actually use.

How you'll use it. Paste a block to see its boundaries and a sample of the first host addresses. This is the daily bread of network design, firewall-rule review, and scoping a penetration test — you need to know precisely which addresses 10.0.0.0/8 or 172.16.0.0/12 covers before you scan or write a rule. To classify a single address inside the block — its scope, class, and whether it is private or reserved — hand it to the IP address info tool.

Common mistakes. Off-by-one errors at the block edges (forgetting the network and broadcast addresses are not assignable on ordinary subnets), and confusing the /prefix host count with usable hosts. Another trap: /31 and /32 behave specially — a /31 is used for point-to-point links with two usable addresses and no broadcast, and a /32 is a single host. A subtler error is writing a "host" address with host bits set as if it were a network — 192.168.10.5/24 is a perfectly valid interface address, but its network is still 192.168.10.0, and a firewall rule or route that treats the literal .5 as the network base will silently misbehave; this calculator masks the address down for you so the true network is unambiguous.

Defensive angle. Getting CIDR right is a security control. An overly broad firewall rule (/16 where you meant /24) silently exposes thousands of hosts; a scan that misjudges scope can stray outside authorization. Document your address plan in CIDR, keep segments as small as the design allows, and review rules against the actual block boundaries this tool makes explicit.