Is this IP inside this range?
Check an address against one CIDR block or a whole list, and see every block that contains it — most specific first, the way a router resolves them.
CIDR membership checker
A single IPv4 or IPv6 address, with no prefix.
One per line. A bare address with no slash is treated as a single host.
Why this cannot be done by eye
Containment in a CIDR block is decided by the prefix length, and the prefix length has almost no relationship to how similar two addresses look when written out. The check is: take the prefix length, build a mask of that many leading one-bits, apply it to both the address and the block's network address, and compare. If the masked values are equal, the address is inside.
The consequence is that 10.1.2.30 is inside 10.0.0.0/8 — which
covers sixteen million addresses — but outside 10.1.2.0/28, which covers
sixteen and stops at 10.1.2.15. Three of the four octets match in the second
case and none of that helps. This is the single most common source of firewall rules that
do not do what their author intended.
When more than one block matches
Overlapping blocks are normal. A routing table or an access list usually has a broad rule with narrower ones layered over it, and an address can legitimately sit inside several at once. What decides the outcome is longest-prefix match: the narrowest block containing the address wins, no matter what order the rules appear in. Results here are sorted that way, so the first row is the one that would actually take effect.
That ordering is worth internalising, because it is not how most configuration files read.
A /32 exception buried at the bottom of a list still beats the /8
at the top.
Prefix lengths worth knowing by heart
/32— a single address. Used for host-specific rules./31— two addresses, for point-to-point links./30— four addresses, two usable. The classic small link subnet./24— 256 addresses. One full final octet, and the most common LAN size./16— 65,536 addresses. Two full octets./8— 16.7 million addresses. One full octet./0— everything. The default route.
The useful shortcut is that every step down in prefix length doubles the block: a
/23 is two /24s, a /22 is four. Going the other way,
each step up halves it.
Private ranges
The tool flags an address that falls in one of the reserved private ranges —
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, plus
loopback at 127.0.0.0/8 and link-local at 169.254.0.0/16. Seeing
that flag when you expected a public address usually means you are looking at an address
from behind a NAT rather than the one the outside world sees.
To break down a single block into its network, broadcast, and usable host range, use the main CIDR page. To carve one block into smaller ones, or to collapse a list of blocks into the minimal covering set, use the splitter.
Common questions
How do I check whether an IP is inside a CIDR block?
Mask both the address and the block's network address with the block's prefix length, then compare the results — if they are identical, the address is inside. That is exactly what this page does, and it is why the check cannot be done reliably by eye: containment depends entirely on where the prefix boundary falls, not on how similar the numbers look. 10.1.2.30 sits inside 10.0.0.0/8 but not inside 10.1.2.0/28, and nothing about the way those are written makes that obvious.
Why does an address that looks like it should match not match?
Almost always because the prefix is shorter or longer than assumed. A /24 covers 256 addresses and stops at .255; a /28 covers only 16, so 10.1.2.0/28 ends at 10.1.2.15 and an address of .30 falls outside it despite sharing three octets. The other common cause is a block whose network address is not on its own boundary — 10.1.2.5/24 is really 10.1.2.0/24, and the tool normalises it, which can be a surprise if you expected the range to start at .5.
What does it mean when several blocks match?
It means the blocks overlap, which is normal and usually deliberate — a broad rule with narrower exceptions carved out of it. Matches are listed most specific first, which is the order a router would resolve them: longest-prefix-match means the narrowest block containing the address wins, regardless of the order the rules were written in. If you are debugging a firewall or an access list, the top entry is the one that takes effect.
Are the network and broadcast addresses included?
Yes. This tool answers whether an address falls within the block's address range, and both the network address at the bottom and the broadcast address at the top are part of that range. They are not usually assignable to a host, which is a different question — the main CIDR page reports the usable host range separately. For firewall and routing purposes, which is what this page is for, the whole range is what matters.
Can I test an IPv4 address against IPv6 blocks?
You can paste a mixed list, and the IPv6 blocks will simply be reported as non-matches rather than as errors — an IPv6 block cannot contain an IPv4 address, so that is the truthful answer rather than a failure. This matters because real allow-lists routinely contain both, and having the tool refuse the whole list because of one entry of the wrong family would make it useless for exactly the case you pasted it for.
Does anything I paste get uploaded?
No. The arithmetic runs entirely in your browser using BigInt, so addresses large enough to need 128 bits are handled exactly. Nothing is sent to a server, logged, or stored, and the page keeps working with the network disconnected once it has loaded.