Work out what a CIDR block actually covers
Enter a block and read back its range, mask, and host count. IPv4 and IPv6.
CIDR calculator
An address, optionally followed by a slash and a prefix length. A bare address is read as a single host.
- Network
- —
- Netmask
- —
- Broadcast
- —
- Total
- —
- Usable hosts
- —
- Scope
- —
Prefix lengths at a glance
Every bit you drop from the prefix doubles the size of the block. For IPv4 the common ones are worth committing to memory:
/32— 1 address. A single host, as used in firewall rules./31— 2 addresses, both usable. Point-to-point links./30— 4 addresses, 2 usable. The old way to do a point-to-point link./29— 8 addresses, 6 usable. A typical small business allocation./24— 256 addresses, 254 usable. One "class C", the default LAN./16— 65,536 addresses. A typical VPC or campus network./8— 16,777,216 addresses. The whole of 10.0.0.0 private space.
The arithmetic is always the same: a block of prefix n holds
2^(32 - n) addresses for IPv4, or 2^(128 - n) for IPv6. The minus
two for network and broadcast applies only to IPv4, and only up to /30.
Common questions
What does the number after the slash mean?
It is the number of bits fixed at the start of the address, called the prefix length. A /24 fixes the first 24 bits, leaving 8 bits free, which gives 256 addresses. Every bit you take away doubles the block: a /23 is 512 addresses, a /22 is 1,024, and so on.
Why does a /24 have 254 usable addresses and not 256?
IPv4 reserves the first address in a block as the network address and the last as the broadcast address, so neither can be assigned to a host. That costs you two addresses in every block from /0 to /30. IPv6 reserves neither, so an IPv6 block's usable count equals its total.
What is special about a /31?
RFC 3021 allows both addresses in a /31 to be assigned, because a point-to-point link has exactly two ends and needs no broadcast address. This tool reports 2 usable addresses for a /31 rather than 0, which is what a naive minus-two calculation gives.
I entered a host address and got a different network back. Why?
Entering 192.168.1.137/24 describes a host inside the 192.168.1.0/24 block, so the network address is 192.168.1.0. The prefix masks off the host bits. This is the single most common source of confusion when reading a routing table, and seeing the rounded-down network is usually the answer you actually wanted.
Which ranges count as private?
For IPv4: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, plus 127.0.0.0/8 for loopback and 169.254.0.0/16 for link-local. The 172.16/12 range is the one people get wrong — it covers 172.16 through 172.31, not 172.16 through 172.32. For IPv6: fc00::/7 for unique local and fe80::/10 for link local.