Subnet Calculator
IPv4 CIDR → network, broadcast, host range, mask, and host count.
Subnetting is the piece of networking that stops most beginners cold, usually because it is taught as arithmetic instead of as a question: where does the network part of this address end and the host part begin? The slash number answers exactly that, and once it clicks the rest is bookkeeping.
How to use it
- Enter an IPv4 address with a prefix, such as 192.168.1.10/24.
- Read the network address, broadcast address, usable host range and total host count.
- Try changing only the prefix and watch the ranges grow and shrink.
What to take away
The prefix counts fixed bits
/24 means the first 24 bits identify the network and the remaining 8 identify hosts, giving 256 addresses of which 254 are usable. Every prefix step down doubles the size of the block.
Two addresses are always spent
The first address in a block names the network itself and the last is the broadcast address, so a /24 holds 256 addresses but only 254 hosts.
Why this matters in security
Scan scoping, firewall rules and "is this address inside our network" checks are all subnet questions. Getting a prefix wrong in a rule is how internal services end up exposed.
Frequently asked questions
How many hosts are in a /24?
256 total addresses, 254 usable — the network and broadcast addresses are reserved. A /25 halves that to 126 usable, a /23 doubles it to 510.
What is the difference between CIDR notation and a subnet mask?
They express the same thing. /24 and 255.255.255.0 are identical statements: 24 leading one-bits. CIDR is just the shorter way to write it.
What are the private IP ranges?
10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not routable on the public internet, which is why an SSRF that reaches them is interesting to an attacker.
Where this fits in the course
This security tool pairs with Path 02 — Networking — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- VLSM Subnet Planner — Plan variable-length subnets across several different host-count requirements from one base network.
- CIDR Overlap Checker — Check whether two CIDR ranges overlap — catches conflicting firewall/routing rules before they cause an outage.
- SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
- Raw HTTP Request Builder — Build a raw HTTP request from method, path, headers, and body — see exactly what goes over the wire.