CIDR Calculator

How to use the CIDR calculator

1. Enter a block such as 192.168.1.0/24. You can also type an address with a dotted mask (172.16.5.4 255.255.240.0), a wildcard mask (10.0.0.0 0.0.0.255), a bare address (treated as /32), or an IPv6 prefix (2001:db8::/48).
2. Read the results: network and broadcast addresses, subnet and wildcard masks, first and last usable host, total and usable host counts, address type, and a binary view where network bits are blue and host bits are yellow.
3. Split it (optional): choose a longer prefix to list every subnet, for example a /24 into four /26 blocks.
4. Convert a range: switch to IP range to CIDR, enter a start and end address, and copy the minimal list of blocks for a firewall rule, security group or allow list.

Everything is calculated in your browser with 128-bit integer math, so results are exact for IPv6 as well. Nothing is sent to a server.

How CIDR notation works

An IPv4 address is 32 bits. The number after the slash says how many of those bits, counted from the left, identify the network; the remaining bits identify hosts inside it. In 192.168.1.0/24 the first 24 bits (192.168.1) are the network and the last 8 bits give 256 addresses, 192.168.1.0 to 192.168.1.255.

• Network address: all host bits zero. It names the subnet and is not assigned to a device in normal subnets.
• Broadcast address: all host bits one. Packets sent there reach every host on the subnet.
• Usable hosts: everything in between, so 2(32 − prefix) − 2.
• /31 and /32 are exceptions. A /31 is used on point-to-point router links (RFC 3021) where both addresses are usable, and a /32 is one host, common for loopbacks and cloud firewall rules like 203.0.113.7/32.

CIDR (Classless Inter-Domain Routing, RFC 4632) replaced the old class A, B and C system in 1993. CIDR lets providers allocate any prefix length and lets routers aggregate many routes into one.

Converting an IP range to CIDR blocks

Firewalls, AWS security groups, Azure NSGs and iptables rules want CIDR blocks, but vendors often publish ranges as a start and end address. A range only fits in one block if it starts on a boundary that is a multiple of its size and its size is a power of two. Otherwise it must be split. The algorithm used here starts at the first address, takes the largest aligned block that does not run past the end, and repeats. For 192.168.1.10 to 192.168.1.20 that yields four blocks:

If you only need something approximate, a single covering block (here 192.168.1.0/27) is shorter but also admits 21 addresses you did not ask for. For security rules, use the exact list.

IPv6 prefixes

IPv6 addresses are 128 bits, written as eight groups of four hex digits with leading zeros dropped and the longest run of zero groups shortened to :: (RFC 5952). Subnets are almost always /64, because SLAAC address autoconfiguration needs 64 host bits. A site typically receives a /48 (65,536 /64 subnets) or a /56 (256 subnets) from its provider. IPv6 has no broadcast address, so the calculator reports first and last address rather than usable hosts. Common ranges: 2000::/3 global unicast, fc00::/7 unique local, fe80::/10 link-local, and 2001:db8::/32 reserved for documentation. To see an address bit by bit, use the IPv6 to binary converter.

Subnet mask and CIDR reference table

Usable hosts follow the standard rule (total minus network and broadcast), with the RFC 3021 exception for /31 and a single host for /32.

Private and special IPv4 ranges

Cloud providers reserve some addresses inside every subnet: AWS keeps the first four and the last one, so a /24 VPC subnet has 251 assignable addresses, not 254. Azure also reserves five per subnet.

Frequently asked questions