Skip to main content
INSTRUMENTS/Network & life← I10 · J02 →
J01

Subnet calculator

CIDR arithmetic for IPv4 and IPv6 — network, broadcast, usable range, mask and subnetting.

HOW IT WORKS

Subnetting is one operation: build a mask from the prefix length, then do bitwise arithmetic with the address. A /24 mask is twenty-four ones followed by eight zeros; AND it with the address for the network address, OR it with its complement for the last address in the block. IPv4 and IPv6 differ only in whether the address is 32 or 128 bits wide.

Both families are held as bigint here, not because IPv6 demands it but because IPv4 in JavaScript does: `&`, `|` and `~` coerce to *signed* 32-bit integers, so the complement of a /1 mask comes back negative and every comparison after that is wrong. One numeric type for both families removes the whole class of bug.

Usable host counts are where calculators disagree, so the three cases are written out. At /30 and shorter you lose the network and broadcast addresses: 2^n − 2. A /31 has no broadcast address at all — RFC 3021 gives both of its addresses to the two ends of a point-to-point link — so the count is 2. A /32 is one host and no network. IPv6 has no broadcast address; its role is taken by multicast, so the whole block is addressable. The all-zeros host part is reserved as the subnet-router anycast address (RFC 4291 §2.6.1), but that is a reservation for routers rather than a hole in the count.

The scope column is a longest-prefix match against the IANA special-purpose registries, resolved the way a routing table would: 2001:db8::1 is documentation, not Teredo, even though 2001::/32 also covers it. Range-to-CIDR works by alignment — at each step it takes the largest block that both starts at the current position and does not run past the end, and `cursor & -cursor` isolates the lowest set bit, which is exactly that position’s alignment.

LIMITS

  • Leading zeros in IPv4 are refused outright. 010.0.0.1 is ten to this parser and eight to inet_aton, and which reading a given library takes is the root of a long line of SSRF bypasses. Refusing the form is the only answer that cannot be quietly wrong.
  • Subnet splitting and range decomposition are both capped. A /8 cut into /32s is four billion rows; past the cap the tool says how many it is showing instead of freezing the tab.
  • This is arithmetic only: no whois, no DNS, no reachability. "Global unicast" means "not reserved for anything in particular", not "reachable". For address-to-integer conversion or bit-level inspection, use the radix and bitwise tools in drawer B.