CIDR questions come in three shapes: what does this block cover, what blocks cover this range, and what is the shortest list that covers all of these. Most CIDR calculators answer only the first. This one reads the shape off your input, so a CIDR expands to its range, a start-end range compresses to the minimal block list, and a pasted pile of blocks and addresses merges into the smallest equivalent set. All of it is bit arithmetic in this tab; nothing you type leaves the page.
What the calculator does
One input field, three behaviours, chosen automatically:
- A CIDR block (
10.0.0.0/22) expands: first and last address, netmask and wildcard mask, host counts, plus findings such as the range being RFC 1918 space or the input having its host bits set. - A range (
10.0.0.10 - 10.0.0.200, also..or the word "to") compresses to the minimal list of CIDR blocks that covers exactly those addresses, with the reason the list has the length it has. - A list (blocks, bare addresses and ranges, separated by newlines or commas) aggregates: duplicates and contained blocks vanish, adjacent and overlapping entries merge, and the result is the shortest exact equivalent.
The --supernet flag adds the other kind of answer: the single covering block, together with an honest count of how many extra addresses it takes in. Every value copies with a click, the copy button exports the whole block list as plain lines for a firewall config or a terraform variable, and the URL tracks your input (?q=10.0.0.0/22) so a calculation can be pasted into a ticket as a link.
What the /number means
An IPv4 address is 32 bits. 10.0.0.0/22 fixes the first 22 bits and lets the last 10 vary, so the block holds 210 = 1,024 addresses. That is the entire notation; everything else is consequences. The prefix length maps one-to-one to the old-style netmask (22 ones then 10 zeros, 255.255.252.0), a longer prefix means a smaller block, and two blocks either nest or are disjoint, never partially overlap. That last property is what routers exploit: given several matching routes, the longest prefix wins, which lets one short aggregate route coexist with more specific exceptions inside it.
The name, classless inter-domain routing, records what it replaced. Until 1993, block sizes were locked to the first address bits: class A meant /8, class B /16, class C /24. Mid-size networks got a /16 for a few hundred hosts, and routing tables filled with unaggregated /24s. RFC 4632 describes the classless scheme that fixed both, and the class vocabulary survives only as slang for /8, /16 and /24.
Prefix sizes /8 to /32
The reference table. "Usable hosts" applies when the block is used as a classic subnet (minus network and broadcast); as a route or firewall range, all addresses count:
| CIDR | Addresses | Usable hosts | Equivalent /24s |
|---|---|---|---|
| /8 | 16,777,216 | 16,777,214 | 65,536 |
| /9 | 8,388,608 | 8,388,606 | 32,768 |
| /10 | 4,194,304 | 4,194,302 | 16,384 |
| /11 | 2,097,152 | 2,097,150 | 8,192 |
| /12 | 1,048,576 | 1,048,574 | 4,096 |
| /13 | 524,288 | 524,286 | 2,048 |
| /14 | 262,144 | 262,142 | 1,024 |
| /15 | 131,072 | 131,070 | 512 |
| /16 | 65,536 | 65,534 | 256 |
| /17 | 32,768 | 32,766 | 128 |
| /18 | 16,384 | 16,382 | 64 |
| /19 | 8,192 | 8,190 | 32 |
| /20 | 4,096 | 4,094 | 16 |
| /21 | 2,048 | 2,046 | 8 |
| /22 | 1,024 | 1,022 | 4 |
| /23 | 512 | 510 | 2 |
| /24 | 256 | 254 | 1 |
| /25 | 128 | 126 | — |
| /26 | 64 | 62 | — |
| /27 | 32 | 30 | — |
| /28 | 16 | 14 | — |
| /29 | 8 | 6 | — |
| /30 | 4 | 2 | — |
| /31 | 2 | 2 (RFC 3021) | — |
| /32 | 1 | 1 (host route) | — |
Everything in the table is one doubling apart from its neighbours, which makes the two memorable anchors enough: a /24 is 256 addresses, a /16 is 65,536, and you count halvings or doublings from there.
CIDR to IP range
Expanding a block is two bit operations. AND the address with the mask and the host bits drop to zero: that is the first address. OR the result with the inverted mask and they all become one: that is the last. For 10.0.0.0/22: first 10.0.0.0, last 10.0.3.255, and everything between belongs to the block, including addresses like 10.0.1.255 that look special but are ordinary hosts here.
Whether the two edge addresses are assignable depends on what the block is. As a subnet on a wire, the first is the network address and the last the broadcast, so 1,024 addresses mean 1,022 hosts. As a firewall range, an allowlist entry or a BGP announcement, all 1,024 count. The calculator reports both numbers side by side. For the subnet-side details, the roles of the two lost addresses, /31 point-to-point links, cloud host math, the subnet calculator is the deeper tool.
IP range to CIDR blocks
The reverse direction has a constraint that surprises people the first time: CIDR blocks are not intervals. A block of 2n addresses must start on a multiple of 2n, so "10.0.0.10 to 10.0.0.200" cannot be one block of 191 addresses. 191 is not a power of two, and .10 is not a valid /25 or /26 boundary anyway.
The minimal cover walks the range from the left. At each position, take the biggest block that (a) starts there, which the trailing zero bits of the position decide, and (b) does not shoot past the end. Emit it, jump to the address after it, repeat. For the example:
| Block | Covers | Addresses |
|---|---|---|
10.0.0.10/31 | .10 – .11 | 2 |
10.0.0.12/30 | .12 – .15 | 4 |
10.0.0.16/28 | .16 – .31 | 16 |
10.0.0.32/27 | .32 – .63 | 32 |
10.0.0.64/26 | .64 – .127 | 64 |
10.0.0.128/26 | .128 – .191 | 64 |
10.0.0.192/29 | .192 – .199 | 8 |
10.0.0.200/32 | .200 | 1 |
The shape is typical: blocks grow toward the middle of the range and shrink at the ragged edges. When the result feels too long for its purpose, there are exactly two honest fixes. Move the range edges to aligned boundaries (10.0.0.0 to 10.0.0.255 is a single /24), or turn on --supernet and take 10.0.0.0/24 as one block that covers the range plus 65 extra addresses, with the tool telling you the overshoot. Which trade is right depends on whether the extra addresses are yours and harmless to include, a question a calculator cannot answer for you.
Aggregating a list
Lists of blocks grow by accretion: an allowlist gets one office IP at a time, a route table one subnet per project, a VPN's traffic selectors one exception per incident. Merging them back down is the third mode. Paste the list, blocks, bare addresses and ranges mixed, comma- or line-separated, and the calculator sorts, deduplicates, drops entries contained in wider ones, merges neighbours, and prints the minimal exact equivalent. Four inputs like 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/23, 192.168.2.17 collapse to the single 192.168.0.0/22, and the findings say what happened: how many inputs merged, how many addresses were listed more than once, which lines did not parse.
Two properties of the merge are worth knowing before trusting any aggregation, ours included. It is exact: the output covers precisely the union of the inputs, never more, so it is always safe for allowlists and route filters. And it merges only aligned neighbours, because that is all CIDR can express: 10.0.0.0/24 plus 10.0.2.0/24 stays two blocks, with the gap at 10.0.1.0/24 intact. The covering supernet under --supernet is the deliberately inexact alternative for cases like router summarization, where announcing 10.0.0.0/22 for three of its four /24s is a policy decision. The tool shows the extra address count so the decision is made with numbers instead of a feeling.
Our own use for the merge mode, and the reason it handles messy separators and stray hostnames-that-are-not-IPs gracefully: pasting a quarter of unreviewed firewall additions and reading the two-line summary of what they really amount to. The answer is regularly "one /22 and a stray /32 someone typo-ed", and that is a review finding no diff view produces.
CIDR questions
What is CIDR notation and what does the number after the slash mean?
CIDR notation writes a block of IP addresses as a base address plus a prefix length: 192.168.1.0/24 means the first 24 of the 32 bits are fixed and the remaining 8 vary, giving 2^8 = 256 addresses from 192.168.1.0 to 192.168.1.255. A bigger number after the slash means a smaller block: /32 is one address, /24 is 256, /16 is 65,536, /8 is 16.7 million. CIDR (classless inter-domain routing, RFC 4632) replaced the old class A/B/C scheme in 1993; when someone says "a class C" today they mean a /24.
How do I convert a CIDR block to an IP range?
Clear the host bits for the start and set them for the end. For 10.0.0.0/22 the prefix leaves 10 host bits, so the block spans 2^10 = 1,024 addresses: start 10.0.0.0, end 10.0.3.255. Done by hand, the step size in the interesting octet is 256 minus the mask octet (the /22 mask is 255.255.252.0, so the third octet steps by 4). In code it is two bitwise operations: start = ip AND mask, end = start OR NOT mask.
How do I convert an IP range to CIDR notation?
Only ranges that start on an aligned boundary and span an exact power of two fit a single CIDR block; every other range needs a list. The standard algorithm walks from the start address, at each step emitting the largest block that both starts there (limited by the trailing zero bits of the start) and still fits in what remains, then advances past it. 10.0.0.0 to 10.0.0.255 collapses to 10.0.0.0/24; 10.0.0.10 to 10.0.0.200 becomes eight blocks from a /31 up to two /26s. Paste either form above and you get the minimal list.
Why does my IP range convert to multiple CIDR blocks?
Because CIDR blocks are not arbitrary intervals: a block of size 2^n must start on a multiple of 2^n. A range that begins at .10 cannot start a /24, and one that ends at .200 cannot end one, so the conversion stitches aligned power-of-two blocks along the edges: small ones near the ragged ends, big ones in the middle. That is arithmetic, not a tool limitation. If the block count bothers you (firewall rule limits, route table size), widen the range to the enclosing aligned boundaries, or accept one covering supernet that includes some extra addresses.
How many IP addresses are in a /16, /20 and /24?
A /16 has 65,536 addresses, a /20 has 4,096 and a /24 has 256. The rule is 2 to the power of (32 minus the prefix). As classic subnets, each loses two addresses to the network and broadcast roles, so 65,534, 4,094 and 254 assignable hosts; as route entries or firewall match ranges, all addresses count, which is why a firewall vendor and an IPAM sheet can disagree about the same block.
How many /24 subnets are in a /16?
256, because each added prefix bit doubles the count: 2^(24−16) = 256. The same arithmetic answers any nesting question: a /16 holds 16 /20s, a /20 holds 16 /24s, a /22 holds 4 /24s, and a /8 holds 65,536 /24s. This is also the fastest sanity check when carving cloud address space: an org-wide 10.0.0.0/8 handing each VPC a /16 has 256 to give out, and each of those VPCs can hold 256 /24 subnets.
What is supernetting (route aggregation)?
Combining several networks into one shorter-prefix block, the opposite of subnetting. 192.168.0.0/24 and 192.168.1.0/24 aggregate to 192.168.0.0/23, one route instead of two. It is what keeps the global BGP table near a million entries instead of billions, and the same move shrinks firewall rule sets and VPN traffic selectors. The catch is that aggregation is only lossless when the blocks are aligned neighbors; otherwise the summary route covers addresses you do not own, which invites blackholing traffic for space that was never yours.
Can 192.168.0.0/24 and 192.168.1.0/24 be summarized into one CIDR block?
Yes: 192.168.0.0/23, exactly those 512 addresses and nothing more. It works because the two /24s differ only in bit 24 and the lower one starts on a /23 boundary (its third octet, 0, is even). The pair 192.168.1.0/24 and 192.168.2.0/24 cannot be summarized: 192.168.1.0 sits on an odd boundary, so the smallest single block containing both is 192.168.0.0/22, which drags in 192.168.0.0/24 and 192.168.3.0/24 as well. Whether that overshoot is acceptable depends on whether you also control the extra space.
How do I write a single IP address in CIDR notation?
Append /32: 203.0.113.7/32 is the block containing exactly one address. Firewalls, route tables and cloud security groups all accept it, and writing the /32 explicitly is safer than relying on a bare address, because a few systems interpret a missing prefix classfully and quietly widen the match. In IPv6 the same idea is a /128.