IPv4 CIDR Calculator

Type an address and choose a prefix length. Every value below is derived by arithmetic on the 32-bit address; no lookup, no request, nothing leaves the page.

What the prefix actually says

An IPv4 address is one 32-bit number written in four eight-bit pieces for the benefit of human eyes. The prefix length says how many of those bits, counting from the left, identify the network. Everything to the right of that line identifies a host inside it.

That single sentence generates every other value on this page. The netmask is the prefix expressed as bits set to one. The network address is the address with all host bits cleared. The broadcast address is the same address with all host bits set. The wildcard mask is the netmask inverted — the form access control lists and routing filters historically expect, where a one means ignore this bit rather than match it.

Why the host count is two short

A block of 2^(32 − prefix) addresses does not give you that many hosts, because two of them are spoken for: the all-zeros host part, which names the network itself, and the all-ones host part, which is the directed broadcast. Neither can be assigned to an interface, which is why a /24 offers 254 usable addresses rather than 256.

The subtraction gets expensive at the small end. A /29 has eight addresses and six usable ones — a quarter of the block lost to overhead. Subnetting an estate into many tiny blocks is not free, and the cost is paid in addresses that exist but cannot be used.

The two prefixes that break the rule

/31 is the exception that trips people up. On a point-to-point link there is nobody to broadcast to, so reserving an address for it is pure waste. RFC 3021 defines a /31 as two usable addresses with no broadcast — which is why routers accept it on serial and inter-router links and why the naive formula, which would report zero usable hosts, is simply wrong here.

/32 describes a single address. It is not really a subnet at all; it is how you write “this one host” in a place that expects a prefix — a route to a loopback, a firewall rule for one server, an allow-list entry. There is no network or broadcast address to set aside, so the block holds one usable address.

Both cases are handled explicitly above, and both are covered by the self-test that runs when this page loads.

Reading a prefix in a security context

Prefix boundaries are where most accidental exposure lives. A rule written against a /16 when the author meant a /24 permits two hundred and fifty-six times as much as intended, and the mistake is invisible in a review because the two look almost identical on screen. The same applies in reverse to logging: a hunt scoped to the wrong prefix quietly excludes the segment you cared about.

Two habits help. Write the network address rather than an arbitrary host address in the block — 10.20.0.0/16, not 10.20.7.3/16 — so the boundary is visible rather than implied. And when you inherit a rule, expand it: convert the prefix into a first and last address and ask whether everything between them genuinely belongs in the rule. Most over-broad rules survive because nobody performed that expansion.