Subnet calculator: CIDR, netmask and host range
Enter an IPv4 address with a prefix such as 10.0.4.17/22 and get the network address, broadcast, first and last usable host, netmask, wildcard and a colored binary view. Check whether another IP is inside the range, and convert between netmask, CIDR, wildcard, decimal and hex.
Calculate a subnet
Type an address with a prefix (10.0.4.17/22), or type just the address and pick the prefix from the list. A prefix in the text field wins over the list.
Results
Binary view
Green = network bits, orange = host bits.
How to read CIDR notation
CIDR notation writes an IPv4 network as an address, a slash and a prefix length, for example 192.168.10.0/24. The prefix length says how many of the 32 bits identify the network. The remaining bits identify hosts inside it. A /24 keeps the first 24 bits fixed (the first three octets) and leaves 8 bits for hosts, so the netmask is 255.255.255.0 and the block holds 28 = 256 addresses.
The network address is the address with all host bits set to 0. The broadcast address is the address with all host bits set to 1. On ordinary subnets those two are not assignable, so usable hosts = 2(32 - prefix) minus 2. Two prefixes are special: a /31 has two usable addresses for point-to-point links (RFC 3021) and a /32 is a single host.
The wildcard mask is the bitwise inverse of the netmask (0.0.0.255 for a /24). You see it in router access lists and some firewall rules.
Hosts per prefix: quick table
| Prefix | Netmask | Addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
Why subnetting shows up in CTF challenges
Network and forensics challenges often hand you a packet capture or a network diagram and ask questions that depend on subnet math. Typical examples: which hosts in a pcap belong to the internal /24 and which are external, whether a source address falls inside a private range, or which address in a diagram is the gateway or broadcast. Knowing the range boundaries lets you write a precise display filter instead of scrolling through thousands of packets. Some challenges also store an address as a 32-bit integer; the converter above turns it back into a dotted address and shows its hex form.
Worked example
Take 10.0.4.17/22. A /22 leaves 10 host bits, so the block size is 1,024 addresses and the third octet moves in steps of 4. Address 4 in the third octet is a multiple of 4, so the network is 10.0.4.0, the broadcast is 10.0.7.255, and usable hosts run from 10.0.4.1 to 10.0.7.254 (1,022 hosts). The netmask is 255.255.252.0 and the wildcard is 0.0.3.255.
When to use this, and when to use ipcalc
This calculator is IPv4 only and works on one block at a time. If you are already in a terminal, ipcalc or sipcalc give the same answers and also handle IPv6, and Python's ipaddress module is the better choice when you need to test thousands of addresses from a pcap against a range. Use this page when you want the numbers laid out with the binary view, or need to turn a 32-bit integer back into a dotted address without writing code.
Related CTF7 pages
Look up unfamiliar terms in the glossary, browse more CTF tools, or try real challenges on our practice event.