Free tool · runs in your browser
Subnet Calculator
Powered by ip-address · MIT
Result
192.168.1.0/24
- CIDR block
- Network address
- Broadcast
- First host
- Last host
- Usable hosts
- Total addresses
- Netmask
- Wildcard mask
- Expanded form
- Address type
- Class (historic)
- Hexadecimal
- Integer
- Reverse DNS zone
Binary
networkhost- Address
- Mask
- Network
- Broadcast
Split into subnets
| # | Subnet | First host | Last host | Broadcast | Hosts |
|---|
One block or range per line (or comma-separated), IPv4 or IPv6. Adjacent and overlapping blocks are merged.
Summary
What is CIDR notation?
CIDR notation represents a block of IP addresses with an address followed by a prefix, such as 192.168.1.0/24. The number after the slash is the number of bits reserved for the network. The remaining bits determine the size of the block, in both IPv4 and IPv6.
CIDR notation
An IPv4 address is 32 bits long, an IPv6 address 128. The prefix, written after the slash, says how many leading bits identify the network. The remaining bits number the hosts.
In 192.168.1.10/24, the first 24 bits (192.168.1) fix the network and the last 8 leave 256 addresses. The netmask 255.255.255.0 says the same thing in dotted notation.
CIDR (RFC 4632) replaced classes A, B and C in 1993, which forced fixed-size blocks. The class is still shown out of habit, but it plays no part in routing.
IPv6
An IPv6 local network is almost always a /64: 64 bits of prefix and 64 bits of interface identifier. A site usually receives a /48 or a /56 from its provider, to be split into /64 networks.
There is no broadcast and no network address to set aside. Addresses are written in hexadecimal, and :: stands for the longest run of zero groups (RFC 5952). The tool also shows the expanded form, which helps when comparing two addresses or writing a firewall rule.
Private and reserved ranges
RFC 1918 reserves three blocks for internal networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
Providers use 100.64.0.0/10 for carrier-grade NAT (RFC 6598). 169.254.0.0/16 appears when a machine fails to get a DHCP lease.
Documentation and examples should use 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737), or 2001:db8::/32 for IPv6 (RFC 3849), which are never routed.
In IPv6, fe80::/10 is link-local and fc00::/7 holds unique local addresses.
The /31 and /32 cases
A /30 gives two hosts and gives up two addresses to the network and the broadcast. On a point-to-point link, RFC 3021 allows a /31 whose two addresses are both hosts.
A /32 is a single machine: a router loopback, a host route, a firewall rule. In IPv6, a /127 plays the part of the /31 (RFC 6164) and a /128 that of the /32.
Scoping a penetration test
Copy the authorised ranges exactly as they appear in the engagement letter, then check their real bounds here. A 10.10.0.0/23 also covers 10.10.1.0/24, which often comes as a surprise.
Make sure no out-of-scope address slips into a target file, and remove network and broadcast addresses if the client asks for it.
For a first IPv4 sweep, nmap -sn finds live hosts without scanning ports. masscan is much faster on large ranges, but its rate must suit the client’s network: start at around 1,000 packets per second.
The calculations rely on the open source ip-address library (MIT licence), which parses, validates and compares IPv4 and IPv6 addresses. This page only handles formatting and the list of reserved ranges.
?Frequently asked questions
Why does a /24 give only 254 hosts?
A /24 block holds 256 addresses. The first identifies the network and the last is the broadcast address, which leaves 254 addresses to assign to hosts. In IPv4 the general rule is 2^(32 − prefix) − 2.
Can a /31 be used?
Yes, on point-to-point links. RFC 3021 allows both addresses of a /31 to be used as hosts, with no network or broadcast address, which saves two addresses per router link. A /32 is a single host, for example a loopback interface or a route to one machine.
How does the tool handle IPv6?
IPv6 has no broadcast, so the tool shows the first and last address of the block and counts every address. The numbers quickly exceed what a JavaScript number holds exactly, so they are computed as BigInt integers (a /32 holds 2⁹⁶ addresses). Sweeping a /64 for live hosts is pointless: in IPv6, discovery starts from DNS, logs or the neighbour cache (NDP).
Which ranges are private?
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for internal networks. 100.64.0.0/10 (RFC 6598) is used for carrier-grade NAT and is not private in the RFC 1918 sense. In IPv6, the equivalent is fc00::/7, unique local addresses (RFC 4193).
What is a wildcard mask for?
The wildcard mask is the bitwise inverse of the netmask. Cisco ACLs and OSPF use it to mark the bits that may vary: 0.0.0.255 matches a /24.
How do I give a range to nmap or masscan?
Both tools accept CIDR notation. nmap also understands per-octet ranges (10.0.0-3.0-255) and masscan full ranges (10.0.0.0-10.0.3.255). The tool generates these notations and the list of subnets for a target file (-iL).
What does the maths, and are my addresses sent anywhere?
The calculations rely on ip-address, an open source JavaScript library (MIT licence) that parses and validates IPv4 and IPv6. It runs in your browser with no network request, so you can enter a client’s internal ranges without them leaving your machine.
+More tools
- 0x7fSSRF Toolkit
IP address variants to slip past a filter, cloud metadata endpoints.
- x509Certificate Decoder
Decode an X.509 certificate or CSR: SANs, issuer, key, fingerprints.
- >_Reverse Shell Generator
Reverse shell payloads, listeners and TTY upgrades.
Technical assessment
Request an application or infrastructure assessment
For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.