CIDR Subnet Calculator
CIDR notation, or an address and a dotted netmask: 10.0.0.0/255.255.255.0.
Asks whether this address falls inside the block above.
Subnet
192.168.1.128/26
64 addresses, 62 usable · private (RFC 1918)
- Network address192.168.1.128
- First usable host192.168.1.129
- Last usable host192.168.1.190
- Last address in block192.168.1.191
- Total addresses64
- Usable hosts62
192.168.1.130 is a host inside this block, not its network address. Masking the host bits off gives 192.168.1.128.
Address check
192.168.1.200 is outside 192.168.1.128/26
Nothing in the block matches after masking.
Reading a block from its prefix length
The number after the slash is how many leading bits of the address belong to the network; the rest identify a host inside it. A /26 fixes the first 26 bits, leaving 6 host bits and 64 addresses. Give this tool an address anywhere in the block and it masks the host bits off: 192.168.1.130/26 is the block 192.168.1.128 to 192.168.1.191, with hosts from .129 to .190, a netmask of 255.255.255.192 and 62 usable addresses.
Each row is derived, not looked up: the network address is the address AND the netmask, and the last address is the network with every host bit set. Paste an address into the second field and it answers whether that address falls inside, and how far into the block it sits.
Why “minus two” breaks at /31 and /32
The rule most people carry is that a block holds two fewer hosts than addresses, because the first is the network identifier and the last is the broadcast address. It holds from /0 down to /30 — a /30 has four addresses and two hosts, which is why point-to-point links were traditionally given one — and then it falls apart. Applied to a /31 it gives zero usable hosts, and to a /32 it gives minus one.
RFC 3021 fixed the /31 case in 2000 by removing the reservation: on a point-to-point link there are only two possible destinations, so broadcasting is meaningless and both addresses can be assigned. A /31 therefore carries exactly two hosts and halves the waste of the /30 it replaces. A /32 is a single host route — a loopback interface, a firewall rule for one address — with no subnet to reserve anything from, so its one address is network, first host and last host at once. This tool reports two and one rather than zero and minus one.
Wildcard masks and where you will meet them
A wildcard mask is the netmask with every bit flipped, so a /24 with the netmask 255.255.255.0 has the wildcard 0.0.0.255. The convention inverts with it: in a netmask a 1 bit means “this bit is network”, and in a wildcard a 0 bit means “this bit must match”. Cisco access lists and OSPF statements are written the second way, so one /24 appears as 192.168.1.0 0.0.0.255 in one file and 192.168.1.0/24 in another.
Both are shown here so a configuration can be copied out without doing the inversion in your head, which is where the digit slips happen.
Unsigned arithmetic, and two inputs this refuses
IPv4 addresses are 32-bit unsigned integers, and JavaScript’s bitwise operators are defined on signed 32-bit integers, so a naive implementation goes wrong above 127.255.255.255: build 255.255.255.0 with a shift and it prints as −256, and a comparison then places 224.0.0.1 below 10.0.0.1. Every value here is forced back to unsigned before it is used or compared. The mask for a /0 is special-cased as well, because a shift by 32 is taken modulo 32 and quietly returns its input unchanged instead of clearing it.
Two inputs are rejected rather than guessed at. An octet with a leading zero, such as 192.168.01.1, is read as octal by anything using the old inet_aton conversion and as decimal by everything else, so it is ambiguous by construction. A dotted mask whose one bits are not contiguous, such as 255.255.0.255, is a valid 32-bit number and not a prefix length, so it has no CIDR equivalent to report.
Why a /24 is not 256 usable addresses
Why does a /24 hold 254 hosts rather than 256?
The first address in the block identifies the subnet itself and the last is its broadcast address, so neither can be assigned to an interface. That leaves 254 for a /24, and the same two-address deduction applies to every block from /0 to /30.
Is an address ending in .0 or .255 always unusable?
No — that only holds when the block happens to be a /24. In a /23 such as 10.0.0.0/23, the address 10.0.0.255 is an ordinary host and 10.0.1.255 is the broadcast address. The prefix length decides, not the final octet.
How do I split a /24 into four equal subnets?
Borrow two host bits, which turns the /24 into four /26 blocks: .0, .64, .128 and .192, each with 62 usable hosts. Borrowing one bit gives two /25s of 126 hosts, and three bits gives eight /27s of 30.
What does the offset figure mean when an address is inside the block?
It is how far in from the network address that address sits, so offset 1 is the first usable host in a /24. It is a quick way to check that a static assignment lands in the part of a block your DHCP pool does not cover.
Does this handle IPv6 as well?
No, this is IPv4 only. IPv6 has no broadcast address and no network-address reservation, so the usable-host arithmetic that makes this tool worth having does not carry over, and interface identifiers are conventionally a full 64 bits wide.
What is the difference between a netmask and a prefix length?
Nothing beyond notation: 255.255.255.0 and /24 describe the same 24 leading network bits. The prefix form is shorter and cannot express a non-contiguous mask, which is a feature rather than a limitation.
Which ranges am I free to use on a private network?
RFC 1918 sets aside three: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Watch the middle one — it runs from 172.16.0.0 to 172.31.255.255, so 172.32.0.0 is public address space belonging to somebody else.
How many /24 blocks fit inside a /16?
Two hundred and fifty-six, because each bit added to the prefix halves the block, and there are eight bits between /16 and /24.
Can two blocks of different sizes overlap?
Yes, and routing depends on it: 10.1.0.0/16 contains 10.1.2.0/24 entirely, and a router picks the longest matching prefix, so the /24 wins for addresses inside it. Overlap is only a fault when two people assign the same addresses without meaning to.