DE EN IT

~/tools / subnet-calculator

Subnet calculator for IPv4 and IPv6

Enter an address with a prefix or netmask and see network, broadcast, usable hosts and more at once. Networks can be split into smaller subnets, and IPv6 prefixes are supported too.

For example 192.168.1.10/24, 10.0.0.0 255.255.255.0, 10.0.0.5 0.0.0.255 or 2001:db8::/48.

daniele@mikweb: ~/tools — less subnet-calculator.md

How CIDR works

An IPv4 address has 32 bits. The prefix length says how many of them name the network: with /24 it is the first 24 bits, and the remaining 8 bits count the hosts. The netmask is the same information written as an address (24 ones, then 8 zeros: 255.255.255.0); the wildcard mask is its inverse (0.0.0.255), as used in Cisco ACLs and OSPF.

  • Network address = address AND netmask (all host bits set to 0).
  • Broadcast = network address with all host bits set to 1.
  • Addresses in the network: 2(32 − prefix).

Example 192.168.1.130/26: netmask 255.255.255.192, network 192.168.1.128, broadcast 192.168.1.191, hosts .129 to .190, so 62 usable.

Inputs the form understands: 192.168.1.10/24, 10.0.0.0 255.255.255.0, 10.0.0.5 0.0.0.255 (wildcard), a single IPv4 address (treated as /32) and IPv6 prefixes such as 2001:db8::/48. The mask 0.0.0.0 is read as a wildcard (one host); for the default network write 0.0.0.0/0.

Reading the sizes from /8 to /32

  • /8 · 255.0.0.0 · 16,777,216 addresses, 16,777,214 usable
  • /16 · 255.255.0.0 · 65,536 addresses, 65,534 usable
  • /24 · 255.255.255.0 · 256 addresses, 254 usable
  • /25 · 255.255.255.128 · 128 addresses, 126 usable
  • /26 · 255.255.255.192 · 64 addresses, 62 usable
  • /27 · 255.255.255.224 · 32 addresses, 30 usable
  • /28 · 255.255.255.240 · 16 addresses, 14 usable
  • /29 · 255.255.255.248 · 8 addresses, 6 usable
  • /30 · 255.255.255.252 · 4 addresses, 2 usable
  • /31 · 255.255.255.254 · 2 addresses, both usable (RFC 3021)
  • /32 · 255.255.255.255 · 1 address, a single host

Every extra bit in the prefix halves the network. A /24 can therefore be split into two /25, four /26 or eight /27. That is what the “Split into smaller subnets” control does.

IPv6 works differently: one /64 per LAN is the rule (SLAAC needs 64 bits for the interface identifier). A site usually gets a /56 or /48, which means 256 or 65,536 networks of /64. Providers typically receive at least a /32.

Private and special ranges

  • Private (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16.
  • CGNAT (RFC 6598): 100.64.0.0/10, the address space between the provider's NAT and the customer connection.
  • Loopback: 127.0.0.0/8. Link-local: 169.254.0.0/16 (automatic addresses without DHCP).
  • Documentation (RFC 5737): 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24.
  • Multicast: 224.0.0.0/4. Reserved: 240.0.0.0/4, 0.0.0.0/8.
  • IPv6: fc00::/7 (ULA, private, RFC 4193), fe80::/10 (link-local), 2001:db8::/32 (documentation, RFC 3849), 2000::/3 (global unicast).

Common mistakes and FAQ

  • Network and broadcast addresses do not count as hosts. That is why there are 2n − 2 usable addresses. The exceptions are /31 and /32.
  • What about /31? Under RFC 3021 both addresses of a /31 may be used on point-to-point links. Very old equipment does not know this; use a /30 there.
  • Host address instead of network address. 192.168.1.130/26 is not a network: the network is 192.168.1.128/26. The calculator shows both.
  • A wildcard is not a netmask. 0.0.0.255 is the wildcard of a /24; used as a mask it makes no sense.
  • Leading zeros. Some programs read 010.0.0.1 as octal (that is, 8.0.0.1), so the calculator rejects such input.
  • Cloud networks have fewer usable addresses. AWS, for example, reserves five addresses in every subnet.
  • IPv6 has no broadcast. It uses multicast instead. A network smaller than /64 breaks SLAAC.

Privacy

Runs entirely in your browser; nothing is sent or stored.

daniele@mikweb: ~/tools — ls

Tools

SPF checkerCounts the DNS lookups of your SPF record (limit: 10).DNS TTL plannerPlans the TTL reduction and the move time.Cron explainerExplains cron expressions and shows the next runs.DMARC generatorBuilds a valid DMARC record to copy.Mail DNS checkChecks MX, reverse DNS, SPF, DMARC and MTA-STS of a domain.Certificate checkExpiry, chain and names of a TLS certificate.Security headersGrades HSTS, CSP and other security headers.JWT decoderShows header, claims and expiry of a JWT — in your browser only.SAML decoderDecodes SAML responses and spots typical errors.nginx for NextcloudGenerates an nginx config for Nextcloud with PHP-FPM.Explain an errorPaste an error — meaning, causes and checks (AI).Base64 encode/decodeEncode and decode Base64, files and Basic-auth headers included — in your browser only.chmod calculatorFile permissions octal ↔ symbolic, ready chmod commands and umask — in your browser only.Redirect generatorGenerates redirects for nginx and Apache (.htaccess) with a curl test.

← Tools