Online CIDR Calculator: Subnet Division and IP Address Planning

What Is CIDR

CIDR (Classless Inter-Domain Routing) is a flexible method for allocating IP addresses and routing. It replaced the traditional classful addressing system (Class A, B, C), allowing more granular address space allocation. Try our free CIDR Calculator to plan your subnets as you read.

CIDR notation appends a prefix length after the IP address with a slash:

192.168.1.0/24
             ^^
             Prefix length (network bits)

Why You Need a CIDR Calculator

1. VPC network planning: Subnet design on cloud providers (AWS, Alibaba Cloud)
2. Container networks: Kubernetes Pod network configuration
3. Firewall rules: IP allowlist CIDR range configuration
4. Server deployment: Internal IP address planning
5. CDN configuration: IP range restrictions and edge node planning
6. Security auditing: Analyzing IP range coverage

CIDR Fundamentals

IP Address Structure

An IPv4 address is a 32-bit binary number, typically shown in dotted decimal:

192.168.1.100
= 11000000.10101000.00000001.01100100

First 24 bits = network (/24), last 8 bits = hosts

Subnet Mask

The subnet mask distinguishes network from host portions:

Usable Host Formula

For prefixes 0–30:

Usable hosts = 2^(32 - prefix_length) - 2

Minus 2 because:

• Network address (all host bits 0) is not assignable
• Broadcast address (all host bits 1) is not assignable

Special cases (as implemented by this site’s tool):

• /31 (RFC 3021 point-to-point): both addresses usable — no minus 2
• /32: single host, usable count = 1

Common CIDR Blocks

Implementer notes for this site’s tool

The on-site CIDR Calculator runs parseCIDRv4 entirely in the browser. Treat these boundaries as source of truth:

1. IPv4 only: input must match a.b.c.d/n (four decimal octets + / + 0–32). IPv6, host:port, and bracketed hosts fail format validation.
2. Mask parse: prefix === 0 → mask 0.0.0.0; else (0xFFFFFFFF << (32 − prefix)) unsigned. Network = IP ∧ mask; broadcast = network ∨ (~mask).
3. Host count: for prefix ≥ 31, /32 → 1 and /31 → 2; otherwise 2^(32−prefix) − 2. On /31//32, first/last host equal network/broadcast.
4. Auto-normalize: 192.168.1.130/24 still expands to network 192.168.1.0 — write security groups against the normalized block.
5. Start–end → CIDR: a second mode covers an inclusive IPv4 range with the fewest CIDR blocks (still no IPv6, no overlap checker). No dotted-mask string input (use /24).

For equal splits of a parent block, use the Subnet Calculator (fields are IP + prefix + power-of-two piece count — not a “target mask” field).

How to Use the Online CIDR Calculator

1. Enter an IP address and CIDR prefix (e.g., 192.168.1.0/24)
2. The tool calculates network, broadcast, netmask, usable range, and host count
3. To cut a /16 into four equal /18s, switch to the Subnet Calculator

Private ranges, routing, and ACL traps

RFC 1918 private space is only three blocks: 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0–172.31.255.255), and 192.168.0.0/16. Treating 172.32.0.0/16 as private is a frequent copy-paste error — that range is public.

Routing uses longest-prefix match (LPM): given both 10.0.0.0/8 and 10.1.2.0/24, traffic to 10.1.2.5 follows the /24. Firewall / Nginx allow lists are often first-match-wins top-to-bottom, which is not LPM — aggregating a wide prefix into an ACL can shadow a narrower exception.

In security groups, /32 is one host; typing /24 by mistake opens 254 addresses. The reverse (typing /8 for a small office allowlist) is an audit-sized hole. Cloud providers still reserve gateway/DNS/internal addresses, so console “available IPs” is often below the theoretical count above.

If the allowlist is a hostname or full URL, split it with the URL parser before deciding on a CIDR. TLS “who you connected to” and “is the source IP in-range” are separate control planes — certificate issues belong in the certificate decoder.

Cloud VPC Network Planning Example

VPC CIDR: 10.0.0.0/16 (65,536 IPs)

├── Public subnet:     10.0.1.0/24  (254 IPs) ← Web servers
├── App subnet:        10.0.2.0/24  (254 IPs) ← App servers
├── Database subnet:   10.0.3.0/24  (254 IPs) ← Databases
├── Management subnet: 10.0.4.0/28  (14 IPs)  ← Bastion hosts
└── Kubernetes:        10.0.5.0/24  (254 IPs) ← Pod network

The subnetting mental model that replaces memorization

Stop memorizing /8-/16-/24 boundaries; learn one binary fact — a /N has 32−N host bits, 2^(32−N) addresses, and for 0–30 minus 2 usable. Everything derives: /26 = 6 host bits = 64 addresses = 62 hosts. The admin shortcut: block size = 256 − mask’s last octet (mask .192 → blocks of 64; valid networks at 0, 64, 128, 192). “Which network am I in” = IP AND mask. The three questions CIDR math always answers: what network (AND), what broadcast (network + block − 1), what range (between them).

VLSM planning: the allocation algorithm that prevents fragmentation

Variable-length subnetting fails when teams allocate in arrival order — small blocks fragment the space and the next /24 cannot fit. The algorithm: list subnets by size descending; allocate sequentially from the base. Leave a planning margin and document a next-free pointer. This site’s subnet tool does equal-length splits only; for VLSM, allocate by hand and verify each block in the CIDR calculator.

IPv6: habits must change — and this page’s tools do not compute it

IPv6 makes /64 the standard LAN size (host arithmetic exits the stage); planning moves to prefix delegation (/48 or /56 from the provider) and carving summarizable /64s. Mistakes carried from IPv4: subnetting /64s (breaks SLAAC), VLSM “to conserve addresses” (meaningless at /48 scale), writing /128 host routes where a /64 belongs.

Important: this site’s CIDR and subnet calculators implement IPv4 only. Plan IPv6 with a dedicated address planner or your cloud console — do not assume this page expands 2001:db8::/32.

FAQ

What's the Difference Between /32 and /31?

/32 is a host route (exact match for one machine). /31 is a special format for point-to-point links that eliminates separate network/broadcast reservations — both IPs are assignable to endpoints.

What Are Common Subnet Design Practices?

1. Segment by function (web, app, database)
2. Segment by environment (dev, staging, production)
3. Reserve roughly 20%+ for future expansion
4. Use private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

How Do I Check If Two CIDRs Overlap?

If either network address falls inside the other’s network–broadcast span (including equality), they overlap. This site’s calculator does not auto-detect overlap — expand both blocks and compare ranges, or keep a planning spreadsheet.

Triage notes

The three pitfalls are ranked by blast radius: treating 172.32.0.0/16 as private is a frequent slip (RFC 1918 reserves only 172.16–31; everything beyond is public space), and a /32 mistyped as /24 admits 254 addresses. The sneakiest is the rule-engine divergence — routing tables prefer the longest prefix, while firewalls and Nginx allow lists are typically first-match top-down, so after you summarize a broad range into an ACL a more specific exception can end up shadowed; test with one address from each block before going live. The mental-model section teaches a single binary fact — /N leaves 32−N host bits — from which every boundary can be derived on the spot, and the tool states its own limits honestly: IPv4 only, no overlap detection.

Provided by ToolVault. Related tools: CIDR Calculator, Subnet Calculator, URL Parser, Certificate Decoder. Related reading: Subnetting / CIDR explained. More tools on the homepage.