Free IP Subnet Calculator - IPv4 & IPv6 CIDR Tool

Work out a subnet's network, broadcast and usable host range

Type an IP address and a CIDR prefix and this subnet calculator returns the network address, broadcast address, subnet mask, wildcard mask, usable host range, total and usable host counts, address class and address type — recalculating as you type, with no submit button. Everything runs in your browser: the address you enter is never sent to a server, which matters when the thing you are subnetting is a customer's production network.

Beyond the basic calculation there are two more tabs. CIDR Merger collapses a messy list of ranges and prefixes into the smallest set of CIDR blocks that covers them, which is how you clean up a firewall object group. VLAN Planning lays out a VLAN table with validation and then emits ready–to–paste switch configuration for nine platforms. The calculator also has an IPv6 mode, AWS VPC and Azure VNet subnet templates, a binary view, and generated ping–sweep commands for the network you just calculated.

How to use the calculator

• Enter the address in the IP Address field — 192.168.1.0, or any host inside the network you care about.
• Enter the prefix in the CIDR field, 0 to 32. You do not need to know the dotted–decimal mask; the tool derives it and shows it back to you.
• Read the Network Information panel for the network address, broadcast address, subnet mask, wildcard mask and canonical CIDR notation, and the Host Information panel for the usable range, host counts, class and type. Every row has a copy button.
• Toggle Binary Representation when you need to see where the mask boundary actually falls — the reason a /22 behaves the way it does is much easier to explain from the binary than from the decimal.
• Use the share–link button to hand someone the exact calculation. The address, prefix, active tab and binary toggle are all encoded in the URL.

You can paste in a host address rather than a network address and the tool will mask it down for you. Enter 192.168.1.130/26 and it reports the network as 192.168.1.128, not 192.168.1.130 — which is exactly the answer you want when you are trying to work out which subnet a given machine is sitting in.

Worked example: subnetting 192.168.1.0

A single /24 is 256 addresses: network 192.168.1.0, broadcast 192.168.1.255, and 254 usable hosts from 192.168.1.1 to 192.168.1.254, mask 255.255.255.0, wildcard 0.0.0.255. Every subnet below is carved out of that same space, and each step down the table halves the block.

The pattern to internalise is the block size column, because it tells you where the next subnet starts. At /26 the block is 64, so the valid network addresses are 0, 64, 128 and 192 — and nothing else. A subnet cannot start at 192.168.1.100 with a /26 prefix; type that in and the calculator will silently give you 192.168.1.64, because that is the network the address belongs to.

Two more examples outside the third octet. 10.0.4.0/22 gives mask 255.255.252.0, wildcard 0.0.3.255, broadcast 10.0.7.255, and 1,022 usable hosts from 10.0.4.1 to 10.0.7.254 — note that the range spans four third–octet values, which is the part people get wrong by hand. And the whole RFC 1918 middle block, 172.16.0.0/12, has mask 255.240.0.0 and runs to a broadcast of 172.31.255.255: it covers 172.16 through 172.31, not 172.16 through 172.32.

Wildcard masks, binary view and ping sweeps

The wildcard mask row is the mask inverted — each octet subtracted from 255 — and it is what Cisco ACLs and OSPF network statements expect. A /26 gives 0.0.0.63, so access-list 10 permit 192.168.1.128 0.0.0.63 matches that whole subnet. Copying it straight out of the calculator removes the most common source of ACL typos.

Below the results the tool generates a ping sweep for the network you just calculated, in three flavours: a Bash loop, a Windows for /L loop, and an nmap -sn one–liner. For a /24 the Bash form sweeps .1 to .254 in parallel; for a /25 through /30 it uses the actual first and last host octets rather than assuming a full range; for a /31 it pings both endpoints; and for anything larger than a /24 it stops trying to build a shell loop and tells you to use nmap, which is the correct advice. Use these on networks you are authorised to scan.

Merging a messy list of subnets into minimal CIDR blocks

The CIDR Merger tab takes one entry per line and accepts three input formats interchangeably: CIDR notation (192.168.1.0/25), explicit ranges (172.16.5.100-172.16.5.110), and bare single addresses. Lines beginning with # are treated as comments, so you can paste an annotated firewall export straight in. It sorts, merges anything overlapping or contiguous, and re–expresses the result as the smallest set of aligned CIDR blocks.

Load the built–in example and you get eight input lines that expand to 13 CIDR blocks. After merging, six blocks remain — a 54% reduction:

• 192.168.1.0/25 and 192.168.1.128/25 are adjacent halves, so they collapse to 192.168.1.0/24.
• The four /26s at 10.0.0.0, 10.0.0.64, 10.0.0.128 and 10.0.0.192 tile a full /24, so they collapse to 10.0.0.0/24.
• 172.16.5.100-172.16.5.110 and 172.16.5.111-172.16.5.120 are contiguous, so they merge into the single range 172.16.5.100 to 172.16.5.120. That range is not power–of–two aligned, so it needs four blocks to express exactly: 172.16.5.100/30, 172.16.5.104/29, 172.16.5.112/29 and 172.16.5.120/32.

That last case is the one worth studying. Merging reduced the block count from seven to four, but it could not produce a single prefix, because CIDR blocks must start on an address that is a multiple of their own size. This is also why the merger never widens your ranges to get a tidier answer — it will hand you four awkward prefixes rather than one over–broad /27 that quietly permits addresses you did not list. If you would rather have the tidy prefix, that is a decision for you to make deliberately, not for the tool to make for you.

VLAN planning and switch configuration

The VLAN Planning tab builds a table of VLANs — ID, name, description, subnet and prefix, gateway, purpose, access or trunk, and whether routing is enabled — and validates as you go. It flags reserved VLAN IDs, including VLAN 1 (the default VLAN, a standing recommendation to avoid for production traffic) and the Cisco–reserved 1002 through 1005, and it detects subnet overlaps between the VLANs you have defined. Rows can be reordered by dragging, and it suggests conventional names per purpose — DATA, VOICE, MGMT, GUEST, IOT, DMZ and so on.

Once the table validates, it generates configuration for Cisco IOS, Cisco NX–OS, Arista EOS, Juniper, HP/Aruba, Dell OS10, Extreme, FortiSwitch and MikroTik, and exports the plan as CSV for change documentation. Read the output before you paste it — it is a starting scaffold for a switch, not a reviewed change.

IPv6, and the cloud templates

Switching the IP version to IPv6 accepts full, compressed and :: notation, then reports the network prefix, prefix length, address type (global unicast, link–local, unique local, multicast and so on), first and last address, total address count, and both the fully expanded and the compressed forms of the address. The expand/compress pair is worth the visit on its own: it settles arguments about whether two differently written addresses are the same address.

The Network Mode selector swaps the standard view for an AWS VPC or Azure VNet template. AWS shows a 10.0.0.0/16 laid out with public, private and database subnets across three availability zones; Azure shows a hub–spoke 10.0.0.0/16 including the fixed–name subnets the platform requires — GatewaySubnet, AzureFirewallSubnet and AzureBastionSubnet, each with its documented minimum size. Both come with the platform's sizing guidance attached. Treat them as a reference layout to copy the shape of, not a design to deploy unread.

Common mistakes and how to recognise them

• The network address you got back is not the one you typed. That is correct behaviour, not an error. The host bits of your input were masked off. If you expected the address to be preserved, your prefix is longer than you thought.
• Usable hosts is two fewer than you counted. The network address and the broadcast address are not assignable. A /26 is 64 addresses but 62 usable hosts, so a “60–user” subnet fits and a “64–user” one does not.
• The exceptions are /31 and /32. A /32 is a single host and the calculator reports one usable address. A /31 is the RFC 3021 point–to–point case where both addresses are usable, and the tool reports two — but the usable–range row is not meaningful at that prefix, so read the network and broadcast rows instead.
• “Invalid IP address format”. All four octets must be present and each must be 0–255. A trailing dot or a missing octet triggers this.
• “CIDR must be between 0 and 32”. You are on the IPv4 tab with an IPv6–sized prefix. Switch the IP version selector to IPv6, where the prefix range is 0 to 128.
• The IP Class row is not what you expected. It reflects the class equivalent of the prefix length — a /8 reads as A, a /16 as B, a /24 or longer as C — rather than being derived from the first octet. Classful addressing has not governed routing for decades; the row is a naming convenience, and the IP Type row (private, public, loopback, link–local) is the one that affects what you can actually do with the address.
• Your subnets overlap and you did not notice. Paste the whole plan into the CIDR Merger. If the merged output has fewer blocks than you have subnets, some of them overlap or abut — and overlap in an addressing plan is a routing incident waiting to happen.

When to use something else

This calculator answers questions about one prefix at a time and merges lists of prefixes. It does not split a block into a set of variable–sized subnets for you, so if you are doing VLSM design — “fit a 100–host, a 50–host and three 10–host segments into one /24” — you will size each piece here and place them yourself, working from the largest requirement down so the blocks stay aligned. On a live device, ip route, ip addr or show ip interface brief will tell you what is actually configured, which is the question to ask when the calculator's answer and the network's behaviour disagree. And for anything you are about to scan or change, confirm you are authorised to touch it first.