CIDR Subnet Calculator

What a CIDR block is

A CIDR block such as 192.168.1.0/24 is a range of IP addresses written as a starting address and a prefix length: the first 24 bits are fixed and the remaining 8 vary, so it holds 2^8 = 256 addresses, from 192.168.1.0 to 192.168.1.255. On IPv4 the first address is the network address and the last is the broadcast address, which leaves 254 usable hosts.

CIDR (Classless Inter-Domain Routing, RFC 4632) replaced the old class A, B and C networks in 1993. The prefix length can be any number from 0 to 32 on IPv4 and 0 to 128 on IPv6, so a block can be any power-of-two size.

How the numbers are worked out

The prefix becomes a mask of that many one bits followed by zeros. /26 is 26 ones and 6 zeros, which is 255.255.255.192 written as a netmask. The calculator then does four bit operations:

• Network address: the address AND the mask, so every host bit is 0.
• Broadcast address: the network OR the inverted mask, so every host bit is 1.
• Total addresses: 2 to the power of the host bits, 32 minus the prefix.
• Usable hosts: the total minus the network and broadcast addresses.

The wildcard mask is the netmask inverted (0.0.0.63 for /26). Cisco ACLs and OSPF use it, and some firewall tools ask for it instead of a prefix.

IPv6 is the same, with no broadcast

An IPv6 block works the same way, but IPv6 has no broadcast address, so every address in the block can be assigned. A LAN is a /64, because SLAAC address autoconfiguration needs 64 host bits (RFC 7421); a site is usually given a /48 or a /56, which holds 65,536 or 256 of those /64s. Counts this large are worked out as exact integers, not floating point, so ::/0 shows all 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses.

Address types worth knowing

Worked examples

On a Linux server, ip -brief address lists every interface with its address in CIDR form:

ip -brief address
# eth0  UP  203.0.113.24/24 2001:db8:4::24/64 fe80::1c2:ff:fe00:1/64

203.0.113.24/24 means the server is host .24 on the 203.0.113.0/24 network. To allow a whole office range through ufw, give the block itself:

sudo ufw allow from 198.51.100.0/27 to any port 22 proto tcp

To split 10.0.0.0/16 into four equal subnets, borrow two bits: four /18s, starting at 10.0.0.0, 10.0.64.0, 10.0.128.0 and 10.0.192.0.

Common mistakes

• Leading zeros. 010.0.0.1 is read as octal (8.0.0.1) by some programs and decimal by others. The calculator refuses it and asks you to drop the zero.
• A host address where a network is expected. 192.168.1.10/24 is a host on 192.168.1.0/24. Firewalls usually accept it, but some cloud consoles and route tables want the network address.
• Non-contiguous masks. 255.0.255.0 is not a netmask. ACL wildcards can be non-contiguous, but then they do not describe one subnet.
• Netmask and wildcard swapped. 0.0.0.255 is a wildcard, not a netmask; the calculator tells you which one it looks like.

Ranges on your own servers

Shipown manages ufw or firewalld on a server over SSH, lists the ports actually listening next to the rules, and adds an allow or deny rule for an address or range without locking out your own SSH connection.