IP / CIDR Calculator

How an IP network works

An IPv4 address is just a 32-bit number, written as four decimal octets. A network splits those 32 bits in two: the left part identifies the network, the right part identifies the host inside it. The prefix length (/24) says how many bits belong to the network — that's exactly what the green/cyan split in the binary view shows.

The netmask is the same idea as a bitmask: /24 is 255.255.255.0 — twenty-four 1-bits. AND the mask with any address in the block and you get the network address; OR the inverted mask and you get the broadcast address. Everything between them is usable host space.

CIDR replaced classes

Before 1993, networks came in three rigid sizes: class A (/8), B (/16), and C (/24) — determined by the address's leading bits. That wasted enormous space (a company needing 300 hosts got a /16 with 65,534). CIDR (Classless Inter-Domain Routing) made the boundary movable: any prefix from /0 to /32. If someone says "class C" today, they almost always just mean a /24.

Prefix cheat sheet

prefix	netmask	addresses	usable hosts
/8	255.0.0.0	16,777,216	16,777,214
/16	255.255.0.0	65,536	65,534
/24	255.255.255.0	256	254
/26	255.255.255.192	64	62
/30	255.255.255.252	4	2
/31	255.255.255.254	2	2 — point-to-point links (RFC 3021)
/32	255.255.255.255	1	1 — a single host route

Usable hosts are normally total − 2 because the network and broadcast addresses are reserved. The exceptions: /31 links deliberately skip the broadcast so both addresses are usable, and a /32 names exactly one host.

Addresses that never route on the internet

range	purpose
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16	private networks (RFC 1918) — what your LAN uses behind NAT
127.0.0.0/8	loopback — the machine talking to itself
169.254.0.0/16	link-local / APIPA — self-assigned when DHCP fails (seeing one is a diagnosis)
100.64.0.0/10	carrier-grade NAT — your ISP's middle layer
224.0.0.0/4	multicast groups
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24	documentation — safe to use in examples, guaranteed to route nowhere
240.0.0.0/4	reserved since 1989 and still unused

Wildcard masks

Router ACLs (Cisco especially) use the netmask's inverse: /24 → wildcard 0.0.0.255, meaning "the last octet can be anything." A wildcard bit of 1 means don't care. This tool shows it for every network because typing the inversion by hand is where ACL typos come from.

Reading the binary view

Pick 172.16.10.5 255.255.240.0 and look at the third octet: the boundary cuts inside it — four network bits, four host bits. That's why the network is 172.16.0.0 and not 172.16.10.0: the 10 in the third octet is partly host space. Mid-octet boundaries are where all subnetting mistakes live; the binary view makes them visible.