CIDR / Subnet Calculator
Network, broadcast, host range and mask for any IPv4 or IPv6 CIDR block — plus split and contains.
Runs entirely in your browser — nothing you paste is uploaded.
About CIDR / Subnet Calculator
Enter a CIDR block like `10.0.0.0/22` and get everything that follows from it: network address, broadcast address, first and last usable host, total and usable host counts, the dotted netmask and the wildcard mask that ACLs want. IPv6 works the same way, minus the concept of a broadcast address, which IPv6 doesn't have.
Two extra modes handle the questions that come up around a subnet rather than about it. Contains-check answers whether a given address falls inside a block — the question you're really asking when you're staring at a security group rule. Split divides a block into equal smaller prefixes and lists them, which is what carving a VPC into subnets actually consists of.
The `/31` and `/32` cases are handled per RFC 3021 rather than reported as negative. A `/32` is a single host. A `/31` has two addresses and, on point-to-point links, both are usable — there's no network or broadcast address to reserve. Calculators that blindly subtract two report `/31` as having -1 usable hosts, which is a well-known way to spot a tool nobody checked.
Worth remembering when planning: in AWS every subnet loses five addresses, not two — the network address, the broadcast address, and three reserved by VPC for the router, DNS and future use. A `/28` gives you 11 usable addresses there, not 14.
Frequently asked
›How many usable hosts are in a /24?
254. A /24 holds 256 addresses; the first is the network address and the last is the broadcast address, neither of which can be assigned to a host. In an AWS VPC it's 251, because AWS reserves three more in every subnet.
›Why does a /31 show 2 usable hosts?
RFC 3021. On point-to-point links a /31 has no meaningful network or broadcast address, so both of its two addresses are assignable. Subtracting two blindly would give -1, which is the classic bug in subnet calculators.
›What is a wildcard mask?
The bitwise inverse of the netmask — `0.0.0.255` where the netmask is `255.255.255.0`. Cisco ACLs and some routing protocols express matches with it instead of a netmask. Same information, inverted.
›Which ranges are private?
For IPv4: `10.0.0.0/8`, `172.16.0.0/12` and `192.168.0.0/16` from RFC 1918, plus `100.64.0.0/10` for carrier-grade NAT and `169.254.0.0/16` for link-local. For IPv6, `fc00::/7` is unique-local and `fe80::/10` is link-local.
›How small can a subnet be in practice?
The protocol allows down to /32, but platforms impose their own floors — AWS won't accept a subnet smaller than /28, and many appliances want /30 or larger for a routed segment. Plan the block bigger than you think you need; renumbering later is far more painful than wasting addresses now.