BRev Subnet & CIDR calculator
Paste anything a network gives you — 192.168.1.0/24, an address with a mask, a bare IP, or an IPv6 prefix — and see the network, broadcast, usable range, masks and counts, with the /31 and /32 special cases handled properly. Split the block, test whether an address is inside it, check two CIDRs for overlap, aggregate a list, and copy the result in the form your firewall or cloud console expects.
Private address space — the home/office default. Usable inside your own network; needs NAT to reach the internet.
| # | Subnet | Range | Broadcast | Usable |
|---|---|---|---|---|
| 1 | 192.168.1.0/26 | 192.168.1.1 – 192.168.1.62 | 192.168.1.63 | 62 |
| 2 | 192.168.1.64/26 | 192.168.1.65 – 192.168.1.126 | 192.168.1.127 | 62 |
| 3 | 192.168.1.128/26 | 192.168.1.129 – 192.168.1.190 | 192.168.1.191 | 62 |
| 4 | 192.168.1.192/26 | 192.168.1.193 – 192.168.1.254 | 192.168.1.255 | 62 |
10.0.0.0/8 covers 10.0.0.0 → 10.255.255.255; 10.1.2.0/24 covers 10.1.2.0 → 10.1.2.255. They share 256 addresses: 10.1.2.0 → 10.1.2.255.192.168.0.128/25 + 192.168.1.0/25 are next to each other but do not merge: the pair is not aligned on a /24 boundary.192.168.1.0/24cidr_blocks = ["192.168.1.0/24"]aws ec2 authorize-security-group-ingress --group-id sg-XXXXXXXX --protocol tcp --port 443 --cidr 192.168.1.0/24iptables -A INPUT -s 192.168.1.0/24 -j ACCEPTallow 192.168.1.0/24;- ipBlock:
cidr: 192.168.1.0/24access-list 101 permit ip 192.168.1.0 0.0.0.255 anyip route 192.168.1.0 255.255.255.0 <next-hop>An IPv4 address is one 32-bit number wearing a costume: 192.168.1.10 is four bytes printed in decimal with dots between them. CIDR — Classless Inter-Domain Routing — simply says how many of those bits from the left are fixed. /24 means “the first 24 bits identify the network; the remaining 8 are free”. That is the whole idea, and the binary view above is it drawn out: everything left of the rule is fixed, everything right of it varies, and the number of addresses is 2 raised to the number of free bits.
Why a /24 is 256 addresses but 254 hosts
Eight free bits give 28 = 256 addresses. Two of them are spoken for: the network address(all host bits 0) names the block itself, and the broadcast address (all host bits 1) reaches everyone on the segment. Neither can be assigned to a machine, which leaves 254 usable. That is the “minus two” rule — and it is where most calculators go wrong, because it does not always apply:
- /31 — 2 addresses, 2 usable. On a point-to-point link there is nobody to broadcast to, so RFC 3021 hands both addresses to the two routers. A calculator that reports “0 usable” for a /31 is applying a rule that was explicitly retired for this case in 2000.
- /32 — 1 address, 1 usable. A host route. There is no block to name and nothing to broadcast to, so the single address is simply itself. Firewall rules, loopbacks and BGP announcements all use this form.
- IPv6 — no subtraction at all. IPv6 has no broadcast address; multicast does that job. The only address to be careful with is the all-zeros one in a subnet, which is the subnet-router anycast address (RFC 4291).
VLSM, in two sentences
Variable-Length Subnet Masking means the subnets you carve out of a block do not all have to be the same size — give a 500-host office a /23, a 20-host branch a /27, and a router link a /31, all from the same parent. The only rules are that each subnet must start on a boundary that its own size divides evenly, and that the pieces must not overlap; the Split card above always produces equal subnets, so use it once per size and take the remaining space forward.
Private address space (RFC 1918)
| Block | Range | Addresses | Where you see it |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 – 10.255.255.255 | 16,777,216 | Large corporate networks, cloud VPCs — room to carve hundreds of subnets. |
| 172.16.0.0/12 | 172.16.0.0 – 172.31.255.255 | 1,048,576 | Docker’s default pool, mid-size networks. Note it is /12, not /16 — 172.32.x is public. |
| 192.168.0.0/16 | 192.168.0.0 – 192.168.255.255 | 65,536 | Home and small-office routers. Usually handed out one /24 at a time. |
These three blocks are yours to use inside your own network, and no router on the internet will carry them. Two ranges get mistaken for them: 100.64.0.0/10 is carrier-grade NAT space that belongs to your ISP — using it in your own LAN causes collisions you cannot debug — and 169.254.0.0/16 is what a machine assigns itself when DHCP does not answer, so seeing one is a symptom, not a design.
IPv6: the /64 convention
IPv6 subnets are almost always /64, and not because 18 quintillion addresses are needed on a LAN. The lower 64 bits are the interface identifier, and SLAAC — the mechanism by which a host configures itself without DHCP — assumes it has all 64 of them. Make a LAN smaller than /64 and stateless autoconfiguration stops working. So the sizes you actually choose between are the ones above the LAN: a /48 per site (65,536 LANs), a /56 per small site (256 LANs), a /64 per LAN. Point-to-point links between routers are the documented exception — RFC 6164 recommends /127 there.
Reading a wildcard mask
Cisco ACLs take the mask inverted: 0.0.0.255 is the wildcard for a /24. A 0 bit means “this bit must match”, a 1 bit means “don’t care”. Routing statements on the same box take the ordinary netmask, which is why 255.255.255.0 and 0.0.0.255 both show up in one config for the same subnet. The Copy-ready card above emits the right form for each.