Interactive tool
What that CIDR block actually contains
The network address, the usable range, how many hosts fit, and which RFC the block belongs to — including the two prefixes almost every calculator gets wrong.
Runs in your browser · nothing is sent anywhere
- Network
- 10.0.0.0/22
- Netmask
- 255.255.252.0
- Wildcard
- 0.0.3.255
- Usable range
- 10.0.0.1 – 10.0.3.254
- Broadcast
- 10.0.3.255
- Usable hosts
- 1,022
- Total addresses
- 1,024
- Scope
- Private RFC 1918
What a CIDR block is
An IP address identifies one machine. A CIDR block identifies a range of them, and it is written as an address followed by a slash and a number: 10.0.0.0/22.
The number after the slash says how many bits at the front of the address are fixed. Everything after those bits is free to vary, and each combination is one address in the range. A larger number means more bits fixed, so fewer addresses: a /24 holds 256, a /22 holds 1,024, a /32 holds exactly one.
That is the whole idea. The counter-intuitive part is only that the bigger number means the smaller network.
Using it
Type or paste a block. If you paste an address with the host bits set — 10.0.0.5/22 rather than 10.0.0.0/22 — the result says so and shows the block it belongs to, because that is what a router or a security group stores and it is a common source of confusion.
Two numbers are worth reading together. Total addresses is the size of the range. Usable hosts is what you can actually assign, which is normally two fewer: the first address names the network and the last is the broadcast address.
The split control divides a block into equal subnets, which is the arithmetic you want when carving a VPC range into per-zone subnets.
The prefixes that break the formula
“Subtract two” is right until it is not, and the two exceptions are the ones a calculator most often gets wrong.
A /31 has two addresses and both are usable. RFC 3021 defines it for point-to-point links precisely so that setting aside a network and a broadcast address does not consume the only two you have. A tool applying 2ⁿ − 2 reports zero usable hosts, which says a working configuration is impossible.
A /32 is a single address — a host route, the form used in a route table or a security-group rule for one machine. The formula gives −2.
The scope label names the RFC that reserves a range, which matters most for 169.254.0.0/16: an interface holding one of those has almost always failed to reach DHCP and assigned itself an address, so the address is a symptom rather than a configuration.
Tools that go with this
- Kubernetes Manifest AnalyzerPaste a manifest. Privileged containers, missing limits, absent probes, plaintext secrets — each linked to the failure it causes.
- Cron Expression ExplainerReads a five-field schedule in plain language and shows its next runs, with a warning about the day-of-month and day-of-week union rule.
Questions people ask about this
How many usable hosts are in a /24?
254. A /24 holds 256 addresses and two of them are not assignable: the first names the network and the last is the broadcast address.
The general form is 2^(32 - prefix) - 2, so a /22 gives 1,022 and a /16 gives 65,534. Cloud providers reserve more than two — AWS, for example, holds back five addresses per subnet — so the usable count inside a VPC is lower than the arithmetic here. This tool reports the standard IPv4 numbers, not any one provider's deductions.
Why does a /31 have two usable hosts and not zero?
Because RFC 3021 says so. A /31 exists for point-to-point links, where there are only ever two ends and reserving a network and a broadcast address would leave nothing to assign.
This is the case most calculators get wrong: applying 2^(32 - prefix) - 2 to a /31 yields zero and to a /32 yields −2, which tells you a working configuration is impossible. A /32 is one usable address — a host route, the form a route table or a security-group rule uses to name a single machine.
What does it mean that my address has host bits set?
It means the address you wrote is not the start of the block it describes. 10.0.0.5/22 is a valid thing to write, and the block it belongs to is 10.0.0.0/22.
Both forms appear in real configuration: an interface address carries the host bits, while a route or a firewall rule wants the network address. Some tools reject the first form and others silently rewrite it, which is why this one says which block you landed in rather than doing either quietly.
Why is 169.254.x.x showing up on my interface?
169.254.0.0/16 is link-local (RFC 3927), and an interface holding one of those addresses has almost always failed to reach a DHCP server and assigned itself one. It is a symptom rather than a configuration: the thing to investigate is why DHCP did not answer. The exception is cloud metadata, where 169.254.169.254 is a deliberate well-known endpoint.
Is anything I type here sent to a server?
No. The subnet arithmetic is a module that ships with the page and runs in your browser, so there is no endpoint for an address to reach. That is a property of how the page is built rather than a policy statement — the network tab will show no request when you type.
Did this get you to an answer?
No text box on purpose — please do not paste production logs anywhere