Loading CIDR Subnet Calculator…
CIDR notation, or an address and a dotted netmask: 10.0.0.0/255.255.255.0.
Asks whether this address falls inside the block above.
192.168.1.128/26
64 addresses, 62 usable · private (RFC 1918)
192.168.1.130 is a host inside this block, not its network address. Masking the host bits off gives 192.168.1.128.
192.168.1.200 is outside 192.168.1.128/26
Nothing in the block matches after masking.
The number after the slash is how many leading bits of the address belong to the network; the rest identify a host inside it. A /26 fixes the first 26 bits, leaving 6 host bits and 64 addresses. Give this tool an address anywhere in the block and it masks the host bits off: 192.168.1.130/26 is the block 192.168.1.128 to 192.168.1.191, with hosts from .129 to .190, a netmask of 255.255.255.192 and 62 usable addresses.
Each row is derived, not looked up: the network address is the address AND the netmask, and the last address is the network with every host bit set. Paste an address into the second field and it answers whether that address falls inside, and how far into the block it sits.
The rule most people carry is that a block holds two fewer hosts than addresses, because the first is the network identifier and the last is the broadcast address. It holds from /0 down to /30 — a /30 has four addresses and two hosts, which is why point-to-point links were traditionally given one — and then it falls apart. Applied to a /31 it gives zero usable hosts, and to a /32 it gives minus one.
RFC 3021 fixed the /31 case in 2000 by removing the reservation: on a point-to-point link there are only two possible destinations, so broadcasting is meaningless and both addresses can be assigned. A /31 therefore carries exactly two hosts and halves the waste of the /30 it replaces. A /32 is a single host route — a loopback interface, a firewall rule for one address — with no subnet to reserve anything from, so its one address is network, first host and last host at once. This tool reports two and one rather than zero and minus one.
A wildcard mask is the netmask with every bit flipped, so a /24 with the netmask 255.255.255.0 has the wildcard 0.0.0.255. The convention inverts with it: in a netmask a 1 bit means “this bit is network”, and in a wildcard a 0 bit means “this bit must match”. Cisco access lists and OSPF statements are written the second way, so one /24 appears as 192.168.1.0 0.0.0.255 in one file and 192.168.1.0/24 in another.
Both are shown here so a configuration can be copied out without doing the inversion in your head, which is where the digit slips happen.
IPv4 addresses are 32-bit unsigned integers, and JavaScript’s bitwise operators are defined on signed 32-bit integers, so a naive implementation goes wrong above 127.255.255.255: build 255.255.255.0 with a shift and it prints as −256, and a comparison then places 224.0.0.1 below 10.0.0.1. Every value here is forced back to unsigned before it is used or compared. The mask for a /0 is special-cased as well, because a shift by 32 is taken modulo 32 and quietly returns its input unchanged instead of clearing it.
Two inputs are rejected rather than guessed at. An octet with a leading zero, such as 192.168.01.1, is read as octal by anything using the old inet_aton conversion and as decimal by everything else, so it is ambiguous by construction. A dotted mask whose one bits are not contiguous, such as 255.255.0.255, is a valid 32-bit number and not a prefix length, so it has no CIDR equivalent to report.
The first address in the block identifies the subnet itself and the last is its broadcast address, so neither can be assigned to an interface. That leaves 254 for a /24, and the same two-address deduction applies to every block from /0 to /30.
No — that only holds when the block happens to be a /24. In a /23 such as 10.0.0.0/23, the address 10.0.0.255 is an ordinary host and 10.0.1.255 is the broadcast address. The prefix length decides, not the final octet.
Borrow two host bits, which turns the /24 into four /26 blocks: .0, .64, .128 and .192, each with 62 usable hosts. Borrowing one bit gives two /25s of 126 hosts, and three bits gives eight /27s of 30.
It is how far in from the network address that address sits, so offset 1 is the first usable host in a /24. It is a quick way to check that a static assignment lands in the part of a block your DHCP pool does not cover.
No, this is IPv4 only. IPv6 has no broadcast address and no network-address reservation, so the usable-host arithmetic that makes this tool worth having does not carry over, and interface identifiers are conventionally a full 64 bits wide.