How it works
CIDR notation compresses a whole network into two numbers: an address and a prefix length. The prefix says how many of the 32 bits belong to the network; everything left over is host space. A /24 leaves 8 host bits — 256 addresses, 254 usable after removing network and broadcast. This calculator does the bit math instantly and shows every derived value at once: network, broadcast, first and last usable address, subnet mask, wildcard mask, total and usable counts.
Two masks appear because both are daily tools. The subnet mask (255.255.255.0) defines the network in routing tables and host configs; the wildcard mask (0.0.0.255) is its inverse, used by Cisco ACLs and some firewalls. The binary view shows exactly which bits are network — the fastest way to build real intuition instead of memorizing tables.
Scope detection covers the ranges that change how you treat a block: RFC 1918 private space (10/8, 172.16/12, 192.168/16), loopback, link-local (APIPA) and CGNAT shared space (100.64/10). The class field (A/B/C) is included for completeness — classful networking is obsolete since CIDR, but the vocabulary survives in documentation and exams.
Everything is computed locally in your browser: no lookup, no request, and you can paste internal addressing plans without leaking your network design.
Worked example
Calculate 192.168.1.137/26. The /26 leaves 6 host bits, so each block holds 64 addresses and the address falls in the second block.
| Value | Result | Why |
|---|---|---|
| Network | 192.168.1.128 | 2 blocks of 64: 0–63, 64–127, 128–191 — the address lands in the third. |
| Broadcast | 192.168.1.191 | Last address of the block. |
| Usable range | .129 – .190 | 62 usable hosts. |
| Wildcard mask | 0.0.0.63 | Inverse of 255.255.255.192, for ACLs. |
- Enter the CIDR: Any address in the block works — the tool normalizes to the network.
- Read the range: Network, broadcast, first and last usable are listed together.
- Copy the masks: Subnet mask for host configs, wildcard for ACLs, binary for learning.
- Check the scope: Private, CGNAT, link-local or public before you route or expose anything.
The special cases behave as expected: a /31 shows 2 usable addresses (point-to-point links per RFC 3021, no broadcast), and a /32 shows a single host route.
Common errors and edge cases
- Network vs any address in the block. 192.168.1.137/26 is a host address; its network is 192.168.1.128. Routers want the network address, hosts use anything usable.
- Forgetting broadcast loss. A /24 has 256 addresses but 254 usable — network and broadcast are reserved. Cloud providers reserve additional addresses per subnet (AWS takes 5).
- Wildcard vs subnet mask. Cisco ACLs want the wildcard (0.0.0.255); host configs want the mask (255.255.255.0). Swapping them breaks both silently.
- /31 needs RFC 3021 support. Point-to-point /31 links have no broadcast; very old equipment rejects them. Use /30 for maximum compatibility.
- Summarization boundaries. You can only merge networks that share a bit boundary: 192.168.0.0/24 + 192.168.1.0/24 summarize to /23, but 192.168.1.0/24 + 192.168.2.0/24 do not.
Code equivalents
The same math is two lines with standard libraries — useful for validating plans in scripts.
| Language | Example |
|---|---|
| Python 3 | ipaddress.IPv4Network('192.168.1.137/26', strict=False) — .network_address, .broadcast_address, .num_addresses. |
| Linux | ipcalc 192.168.1.137/26 prints network, broadcast, masks and host range. |
| Bit math | block = 2^(32-prefix); network = floor(ip/block)*block; broadcast = network+block-1 |
Related tools
Frequently asked questions
What does /24 actually mean?
The first 24 bits are the network, leaving 8 bits for hosts: 256 addresses, 254 usable. Larger prefix = smaller network; /30 is 4 addresses, /16 is 65,536.
Why are two addresses unusable?
The first identifies the network itself, the last is the broadcast address. Exception: /31 point-to-point links use both (RFC 3021) and /32 is a single host route.
What is a wildcard mask for?
It is the inverse of the subnet mask, used by Cisco ACLs and some firewalls: a 0 bit means 'must match', 1 means 'ignore'. 255.255.255.0 becomes 0.0.0.255.
Is 192.168.1.0/24 the same network as 192.168.1.128/24?
Yes — both describe the same /24 block; the calculator normalizes any address to its network 192.168.1.0.
Can I use this for IPv6?
No — this calculator is IPv4-only. IPv6 uses 128-bit addressing with different conventions (always /64 on LANs, no broadcast), which changes every formula.
Privacy note
All processing happens in your browser. The values you enter never leave your device and are never transmitted to ToolPlex.