01 / ADDRESS SPACE · 5 MIN READ
CIDR notation, without the guesswork
The number after the slash tells you how much of an address belongs to the network.
One slash. A boundary.
In 192.168.10.42/24, the first 24 of the 32 bits identify the network. The remaining 8 bits cover 256 addresses. The canonical network is 192.168.10.0/24.
Address count is not always host count
For ordinary IPv4 subnets through /30, the network and broadcast addresses are excluded from usable host counts. A /31 point-to-point link uses both addresses; /32 identifies one address. IPv6 has no broadcast address and does not use that same subtract-two rule. Address assignment and subnet-router anycast still matter.
The same idea applies to IPv6
IPv6 has 128 address bits. A /64 therefore contains 2⁶⁴ addresses. That is why this toolbox shows exact counts rather than rounding them to an imprecise JavaScript number.
A subnet is not a firewall rule
Belonging to a range does not mean an address is reachable, authorized or assigned to a device. Routing, address allocation and security policy answer different questions.
References: RFC 4632, RFC 3021, RFC 4291.
Membership and Exact Coverage
With the documentation range 192.0.2.64 through 192.0.2.95, the minimal exact cover is 192.0.2.64/27. Start at .65 instead, and several smaller aligned blocks are required: .65/32, .66/31, .68/30, .72/29 and .80/28. The range tool includes both endpoints without adding addresses outside them.
The membership tool checks the entire mathematical block, including boundary addresses. A “yes” does not mean the address is a conventional IPv4 host, free to assign, or authorized by a firewall.
Before Using a Result
- Confirm the actual prefix; a source IP alone cannot reveal it.
- Check reservations, device support, provider rules and overlap with existing networks.
- Verify routes and access controls separately.