CIDR / subnet calculator
Enter an IPv4 block and get the full breakdown — network and broadcast addresses, subnet and wildcard masks, the usable host range, and the host count — with the /31 and /32 edge cases handled correctly. Everything is calculated in your browser.
IPv4 only. Everything is calculated in your browser — nothing you enter is sent anywhere.
Common prefix lengths
| Prefix | Subnet mask | Usable hosts |
|---|---|---|
| /24 | 255.255.255.0 | 254 |
| /25 | 255.255.255.128 | 126 |
| /26 | 255.255.255.192 | 62 |
| /27 | 255.255.255.224 | 30 |
| /28 | 255.255.255.240 | 14 |
| /29 | 255.255.255.248 | 6 |
| /30 | 255.255.255.252 | 2 |
| /31 | 255.255.255.254 | 2 (point-to-point) |
| /32 | 255.255.255.255 | 1 (single host) |
CIDR & subnetting, explained
What is CIDR notation?
CIDR (Classless Inter-Domain Routing) writes a network as an address followed by a slash and a prefix length, such as 192.168.1.0/24. The prefix says how many leading bits are the network portion; the rest identify hosts. /24 means the first 24 bits are the network, leaving 8 bits — 256 addresses — for hosts.
Why are there two fewer usable hosts than total addresses?
In most subnets the first address is the network identifier and the last is the broadcast address, and neither can be assigned to a host. So a /24 has 256 total addresses but 254 usable. The exceptions are /31 and /32.
What is special about a /31 and a /32?
A /31 has only two addresses and, under RFC 3021, both are usable — it is designed for point-to-point links where a network and broadcast address would be wasteful. A /32 is a single address, used to refer to one specific host, for example in a routing table or firewall rule.
What is the difference between the subnet mask and the wildcard mask?
The subnet mask marks the network bits with ones (255.255.255.0 for a /24). The wildcard mask is its inverse, marking the host bits with ones (0.0.0.255). Wildcard masks are used in some access control lists and routing configurations.
Does this handle IPv6?
Not yet — this calculator is IPv4 only. IPv6 uses the same CIDR idea with 128-bit addresses and much larger prefixes.
How to read the result
- Network address is the first address in the block and names the subnet. It is not given to a device.
- Broadcast address is the last address. It is not given to a device either.
- Usable hosts are everything in between, which is why a /24 holds 254 devices, not 256.
- Wildcard mask is the netmask turned inside out. It is the netmask with every bit flipped.
A /31 is the exception, where both addresses can be used on a point-to-point link:
“halve the amount of address space assigned to point-to-point links (common throughout the Internet infrastructure) by allowing the use of 31-bit subnet masks in a very limited way.”
Private ranges, and a common scoping mistake
Internal addresses come from three blocks reserved for private networks:
“10.0.0.0 - 10.255.255.255 (10/8 prefix); 172.16.0.0 - 172.31.255.255 (172.16/12 prefix); 192.168.0.0 - 192.168.255.255 (192.168/16 prefix).”
When you scope a penetration test, write the ranges down as CIDR blocks and check the host count. A /16 is 65,534 usable hosts, not the one office network you meant, and it changes both the time and the price. Work out what a test might cost with the pentest cost calculator.
Related tools and guides
Mapping your network's attack surface?
Knowing your ranges is the start; a penetration test tells you what is exposed within them. Compare UK penetration testing companies in our directory.
Browse the directory