CIDR notation, subnet masks and IP ranges without the binary headache
CIDR — Classless Inter-Domain Routing — writes a network as an address plus a prefix length: 192.168.0.0/24 means the first 24 bits are the network and the remaining 8 bits (256 addresses) belong to hosts. The prefix is the whole game: slide it one bit and the network doubles or halves. That is why /24 hands you 254 usable hosts while /25 gives you two networks of 126.
The fiddly parts are the edge cases and the conversions. A /31 on a point-to-point link has two usable addresses and no broadcast (RFC 3021); a /32 is a single host. IPv6 drops broadcast entirely, writes addresses in compressed hexadecimal, and a /64 holds 2^64 addresses — a number floating-point calculators silently round. And when an allocation arrives as a start–end range, turning it into the minimal set of CIDR blocks for a firewall rule is alignment math nobody enjoys doing by hand. This calculator handles all of it with exact big-integer arithmetic.
Open the free CIDR Calculator — no signup, runs entirely in your browser.
How to use it
- Stay in CIDR notation mode and paste a block like 10.0.0.0/8 or 2001:db8::/32 — network, broadcast, usable range, masks and host counts appear instantly.
- If your address has host bits set (10.0.0.1/8), click the suggested network address to normalize it in one click instead of re-typing.
- Switch to IP range mode, enter a start and end address, and copy the minimal exact CIDR decomposition — ready for ACLs, firewall rules or BGP filters.
- Use the per-row copy buttons to grab individual values like the wildcard mask for an IOS config or the first usable host for a gateway.
Why this one
- Exact at any size: all math runs on arbitrary-precision integers, so IPv6 totals like 2^64 or 2^128 print exactly instead of as scientific-notation guesses.
- Edge cases done right: /31 and /127 point-to-point links report two usable addresses with no broadcast, and /32 or /128 report a single host.
- Strict, honest parsing: leading-zero octets, short forms, zone IDs and bracketed addresses are rejected with the reason, never silently misread.
- Range summarization is minimal and provably exact — an aligned range collapses to one block, a ragged one becomes the fewest blocks that cover it precisely.
Frequently asked questions
What does the number after the slash mean?
It is the prefix length: how many bits, counted from the left, identify the network. IPv4 has 32 bits total, so /24 leaves 8 host bits (256 addresses); IPv6 has 128 bits, so /64 leaves 64. Subtract the prefix from the bit width and raise two to that power to get the total address count.
Why does a /31 show two usable hosts and no broadcast?
RFC 3021 redefines /31 for point-to-point links: with only two addresses, treating one as network and one as broadcast would waste the whole subnet, so both are assigned to the link endpoints and broadcast simply does not exist. The same logic gives IPv6 /127 links two usable addresses under RFC 6164.
What is a wildcard mask and when do I need one?
A wildcard mask is the bitwise inverse of the subnet mask — 255.255.255.0 becomes 0.0.0.255. Cisco IOS ACLs and some OSPF configs match addresses with wildcards instead of prefix lengths, so the calculator shows both side by side for every IPv4 block.
Why does 10.0.0.1/8 get flagged instead of calculated?
Because in CIDR notation the address part is supposed to be the network address, and 10.0.0.1 has bits set inside the /8 host portion. Some tools silently mask it off and show results for a different block than you typed; this one tells you and offers 10.0.0.0/8 as a one-click fix, or you can pass normalize=true via the API.
Can IPv6 ranges really be converted exactly?
Yes. The range decomposition works on 128-bit integers directly — it never iterates addresses, so converting the entire IPv6 space collapses to ::/0 in one step, and host counts stay exact far beyond the 2^53 limit where float-based tools start drifting.