CIDR Subnet Calculator Guide

CIDR Subnet Calculator Guide

CIDR notation defines network boundaries with a slash. The number after the slash counts the network bits in the subnet mask, so /24 means 24 network bits (255.255.255.0), leaving 8 host bits for 254 usable addresses.¹

Cloud providers, routers, and firewalls all use CIDR notation to define routes, access control rules, and VPC boundaries. AWS requires CIDR blocks for every VPC and subnet. Azure uses CIDR for virtual network address spaces. Kubernetes assigns pod CIDRs to each node. Understanding CIDR arithmetic is fundamental to configuring any of these systems correctly and avoiding address conflicts that break production traffic.

CIDR prefix and subnet mask equivalents

Inside any CIDR block, two addresses are always reserved: the network address (all host bits zero) and the broadcast address (all host bits one). For /24, this leaves 254 usable hosts from 256 total. Understanding which addresses are usable and which are reserved prevents misconfiguration when assigning static IPs to servers or configuring DHCP pools.

Prefix length and address doubling

Each step shorter in prefix length doubles the address space: /23 gives 510 usable, /22 gives 1022, /21 gives 2046. Building on this, each step longer halves it: /25 gives 126, /26 gives 62, /27 gives 30. The formula is always 2^(32 minus n) minus 2 for usable host count, regardless of the starting address you choose.² Consequently, a quick mental model for common prefixes, /24=254, /25=126, /26=62, /27=30, /28=14, /29=6, /30=2, covers most network planning without a calculator.

Keep this doubling relationship in mind when sizing subnets for growth. A team that expects 120 devices today fits comfortably in a /25, but a /24 buys room for four times the current count without renumbering. CapyToolkit shows the usable host count for any prefix so you can pick the smallest block that still leaves headroom before you commit the address space.

CIDR in cloud and firewall rules

Cloud providers extend the CIDR standard with their own reserved addresses. AWS and Azure each reserve 5 addresses per subnet rather than the standard 2, so a /24 in either cloud provides 251 usable addresses.³ GCP reserves 4 addresses per subnet.⁴ Building on this, firewall rules in AWS Security Groups and Azure NSGs accept CIDR notation as the source or destination, where 0.0.0.0/0 means all IPv4 addresses and 10.0.0.0/8 means the entire RFC 1918 private range. Furthermore, BGP route advertisements use CIDR prefixes, and a more specific /24 overrides a covering /20 in the routing table, which is how traffic engineering and anycast routing work in the global internet.⁵

Using the CIDR calculator

Enter any IPv4 address and prefix length, for example 10.0.0.0 with /22, and the calculator instantly shows the network address, broadcast address, usable host range, total address count, and subnet mask in dotted-decimal. Consequently, with the subnet calculator you can count usable hosts in a /24 before entering it into a cloud console, where mistakes require subnet recreation and hours of troubleshooting.

Planning firewall rules with CIDR ranges

For firewall rule work, use the calculator to confirm the exact address range a given CIDR covers before writing a permit or deny rule that affects production traffic. CapyToolkit provides the same calculations in a browser, so you do not need to install anything or send your network data to a third-party service. The prefix spinner lets you step through values to find the smallest prefix whose host count meets your requirement without manual arithmetic each time you plan a new subnet.

CIDR aggregation and route summarization

Route summarization reduces the number of entries in a routing table by advertising one aggregate prefix instead of many specific ones. If a branch office uses 192.168.16.0/24 through 192.168.31.0/24, the headquarters router can summarize all 16 subnets as 192.168.16.0/20. This single /20 route covers the entire 16-subnet range and shrinks the routing table by 15 entries.

Calculating the summary address requires finding the longest common prefix across all constituent subnets. Convert the lowest and highest addresses to binary, then count matching bits from the left. For 192.168.16.0 and 192.168.31.255, the first 20 bits match, giving a /20 summary.⁶ Building on this, BGP route aggregation at the ISP level works the same way: an ISP holding 203.0.113.0/24 through 203.0.118.0/24 advertises the covering /21 to peers. Consequently, proper summarization at every layer of the network hierarchy keeps global routing tables manageable and reduces convergence time after topology changes.

When summarization hides reachability

A summary route advertises reachability for every address in the aggregate, including subnets that may not actually exist behind the advertising router. If the branch office only uses 192.168.16.0/24 and 192.168.17.0/24 but advertises 192.168.16.0/20, the headquarters router forwards packets for 192.168.18.0/24 to that branch even though no hosts exist there. These packets either time out or generate ICMP unreachable messages, creating a black hole. To prevent this, configure a null route for the summary prefix on the advertising router so unmatched addresses are dropped locally rather than forwarded into a void.

CIDR in IPv6: why the rules change

IPv6 uses CIDR notation identically to IPv4, but the design assumptions differ. The standard IPv6 subnet is always /64, not the variable /24-through-/30 range common in IPv4.⁷ SLAAC requires 64 host bits to build EUI-64 interface identifiers, and breaking this assumption breaks auto-configuration on most operating systems. Consequently, IPv6 network planning focuses less on host-count arithmetic and more on prefix delegation hierarchy: a /48 site allocation contains 65,536 /64 subnets, one per VLAN or segment.⁸

Inside an IPv6 deployment, the CIDR calculator still serves a purpose: verifying that delegated prefixes align on correct boundaries. A /48 must start at a multiple of the 48th bit, and a /56 must align on a 56-bit boundary to avoid routing issues at the provider level. Building on this, ISPs delegate prefixes to customers using DHCPv6-PD (Prefix Delegation), which hands out /56 or /48 blocks from the ISP's aggregate. Verifying the delegated prefix with the calculator before configuring your router's LAN interfaces prevents misaligned subnets that cause routing failures in the provider's aggregation layer.

When to use this

Use this calculator when you need to convert a CIDR block to its subnet mask equivalent, verify address ranges before committing them to a cloud VPC, or plan how many hosts fit in a given prefix.

Examples