IP subnet (CIDR) calculator
See which network an address belongs to and how many hosts it holds, split a parent block with VLSM to fit your needs, and check whether networks overlap before you build a VPN. Everything runs in your browser.
Calculated in your browser; nothing is sent.
Formats: 10.1.2.3/24, 10.1.2.3 255.255.255.0, 10.1.2.3 0.0.0.255 (wildcard mask) or IPv6 with prefix. An address alone counts as /32.
- Address
- 192.168.10.77/26
- Network address
- 192.168.10.64
- Broadcast address
- 192.168.10.127
- First usable – Last usable
- 192.168.10.65 – 192.168.10.126
- Usable addresses
- 62
- Total addresses
- 64
- Subnet mask
- 255.255.255.192
- Wildcard mask
- 0.0.0.63
- Address type
- Private address (RFC 1918)
Binary
- Address
- 11000000.10101000.00001010.01001101
- Mask
- 11111111.11111111.11111111.11000000
- Network
- 11000000.10101000.00001010.01000000
Bold bits are the network part, faded bits the host part.
The address you entered is not the first address of its network; the network address was calculated as 192.168.10.64/26.
Results are preliminary; verify the address plan in your own environment and against the relevant RFCs before deploying a network.
Shall we review your address plan, VLAN/zone structure or site-to-site VPN design together?
Request a meeting01
How to use
A
For subnet maths, enter the address with a prefix (/24) or mask; see network, broadcast, usable range and binary form. For IPv6 enter an address with a prefix.
B
For a VLSM split, enter the parent block and one name;hosts line per subnet; see the placement table from largest to smallest and download it as CSV.
C
Before a VPN or merger, paste all CIDRs and list the blocks that overlap or contain each other.
02
How CIDR and subnet maths work
In CIDR notation the prefix next to an address says how many of the 32 bits belong to the network. For /24 the first 24 bits are the network and the remaining 8 are the host part: 2^8 = 256 addresses, of which 254 go to hosts because the network and broadcast addresses are reserved. The network address has all host bits zero; the broadcast address has all of them set to one.
There are two exceptions. A /31 is used for point-to-point links (RFC 3021); no network or broadcast address is reserved and both addresses are usable. A /32 is a single address, used for a host route or a loopback interface. A wildcard mask is the inverse of the subnet mask (0.0.0.255 for 255.255.255.0); you meet it in access lists and some routing configurations.
03
VLSM and OT network segmentation
VLSM (variable length subnet masking) means splitting one parent block into subnets of different sizes. Starting with the largest requirement and placing blocks aligned minimises waste and fragmentation, and the tool does exactly that: each requirement is the host count plus network and broadcast addresses, rounded up to a power of two. The "Spare" column is the number of unused addresses inside the block.
In industrial networks the split usually follows the levels of the Purdue model: field and control (0–1), SCADA/HMI (2), MES and historian (3), industrial DMZ (3.5), enterprise (4–5). Putting each level in its own subnet is a prerequisite for applying the zone and conduit idea of IEC 62443: traffic between zones flows through defined crossing points with rules. Subnet separation alone does not provide security, but it makes firewall rules writable.
04
Why an overlap check matters
In a site-to-site VPN or a company merger it is common to find both sides using 192.168.1.0/24 or 10.0.0.0/24. Routing between overlapping networks is ambiguous; packets do not go where you expect. Finding the overlap first is the first step to deciding between renumbering and NAT.
CIDR blocks are either completely disjoint or one contains the other; partial overlap cannot occur. The tool compares every pair of blocks you paste and lists identical, containing and contained blocks. If an address is not the first address of its network (e.g. 10.1.2.3/24), it is converted to the network address and this is noted.
FAQ
- Are the addresses I enter sent anywhere?
- No. All calculation runs in code in your browser; what you type is not sent to any server and is not stored.
- Why are /31 and /32 treated differently?
- A /31 (RFC 3021) makes both addresses usable on point-to-point links; no network or broadcast address is reserved. A /32 is a single address with no range.
- Is 100.64.0.0/10 a private address?
- It is not an RFC 1918 private address. RFC 6598 reserved it as shared address space for carrier-grade NAT. Using it inside an organisation risks clashing with a provider network.
- Why does the VLSM result give some subnets extra addresses?
- Subnet sizes are powers of two. 100 hosts need a block of 128 addresses (/25, 126 usable); the difference appears in the "Spare" column and can serve as growth headroom.
- Why does the IPv6 view show a /64 count?
- In IPv6 the standard subnet size for a LAN is /64. The count shows how many LANs a prefix assigned to an organisation (e.g. a /48) can be split into.
Get the address plan right from the start
We support address planning, segmentation and VPN design for your server, network and OT/SCADA infrastructure. In a free discovery call we discuss your current network.