CIDR Calculator Guide

What it does

Classless Inter-Domain Routing (CIDR) writes an IP network as an address plus a prefix length, such as 192.168.10.0/24. The prefix says how many leading bits identify the network. The remaining bits identify addresses inside that network.

For IPv4, a /24 uses 24 network bits and leaves 8 address bits, producing 256 total addresses. A shorter prefix describes a larger block: /16 is larger than /24. IPv6 uses the same notation over 128 bits; a typical LAN prefix is /64.

The calculator accepts an IPv4 or IPv6 CIDR and masks off host bits. Entering 192.168.10.37/24 therefore describes the network 192.168.10.0/24, not a separate network starting at .37.

What this tool tells you

The result breaks a CIDR block into values used by routers, firewalls, DHCP servers, cloud networks, and access-control lists:

• Network address is the first address and canonical start of the block.
• Prefix length is the number after the slash.
• Netmask is the bit mask represented by the prefix.
• Total addresses is the size of the block.
• First and last host show the calculated host range.
• Broadcast is the IPv4 all-hosts address at the end of a traditional subnet.

Use these boundaries to check whether an address belongs in a route or allowlist, whether two proposed networks overlap, and whether a block is large enough for the intended number of devices. When copying a cloud-provider route or firewall rule, use the canonical network address shown by the result rather than an arbitrary host address.

For IPv4 prefixes through /30, the traditional usable count excludes the network and broadcast addresses. /31 is commonly used for point-to-point links under RFC 3021, and /32 represents one address. IPv6 has no broadcast; the numerical end of its range is simply the last address, even if a result field uses the shared label “broadcast.”

How it fits with other technologies

CIDR is the compact notation behind several network controls:

• A subnet mask is another representation of an IPv4 prefix. /24 and 255.255.255.0 describe the same boundary. The Subnet Calculator is useful when you start with a host address and mask.
• A route table chooses the most specific matching prefix. A /24 route normally wins over a covering /16 route.
• Firewalls and ACLs use CIDR blocks to match source or destination addresses. An overly broad prefix grants more access than intended.
• DHCP leases host addresses inside a subnet but must avoid reserved gateway, infrastructure, and static ranges.
• NAT translates addresses; it does not change the internal subnet math or resolve overlapping private networks.
• DNS maps names to addresses, while CIDR describes how addresses are grouped and routed. Correct DNS can still point to an unreachable address if routing or firewall prefixes are wrong.
• VPCs, VLANs, and VPNs often attach one or more CIDR blocks to logical network segments. Overlap can prevent routing between them.

CIDR does not describe a physical network by itself. The same prefix can appear in a route, a security rule, an allocation plan, or an interface configuration, and each context gives it a different operational effect.

Troubleshooting unexpected results

1. Check the prefix direction. Smaller prefix numbers mean larger networks. Changing /24 to /23 doubles the address count and moves the network boundary.
2. Use the canonical network. If host bits are set, the calculator normalizes them. A route entered as 192.168.1.50/24 really covers 192.168.1.0/24 on systems that accept noncanonical input.
3. Check overlap. Compare the network and final address of each block. Private ranges reused across a VPN, acquisition, or cloud peering connection commonly collide.
4. Check the route actually installed. A correct calculation does not mean a router accepted or selected the route. Inspect the route table, next hop, metrics, and longest-prefix match.
5. Check both traffic directions. Return traffic needs a valid route too. A one-way route often looks like an application or firewall failure.
6. Review firewall prefixes. Confirm the source and destination blocks are in the correct fields and that no broader deny rule takes precedence.
7. Allow for reserved addresses. Cloud platforms reserve additional addresses inside each subnet beyond the traditional IPv4 network and broadcast addresses. Use the platform’s documented usable count.
8. Treat IPv6 differently. IPv6 has no broadcast and normally uses /64 for ordinary LANs. Do not apply IPv4 NAT and host-count assumptions without checking the IPv6 design.

When an address appears outside the expected range, convert the prefix to a mask and compare the network bits. A single prefix typo can move the boundary much farther than the final decimal octet suggests.

What this tool cannot prove

The calculator performs address math. It cannot see route tables, interfaces, VLAN tags, DHCP scopes, firewall policy, NAT rules, cloud reservations, or whether any host is reachable. It also cannot tell whether a CIDR allocation is registered to an organization or safe to expose publicly.

Use its output as the expected boundary, then compare that boundary with the live router, firewall, cloud, or operating-system configuration. Reachability still requires a valid forward route, return route, permitted policy, and a listening destination.