CIDR to IP Range
Expand any CIDR block into its start address, end address, and total count.
When a Firewall Rule Covers More IPs Than You Intended
A security engineer adds an ingress rule to allow SSH from 203.0.113.0/22 — the corporate office block. The range looks small: just 22 in the prefix. But a /22 covers 1,024 IP addresses. If the intent was to allow only the office's public egress address (203.0.113.50), the rule is allowing 1,023 extra addresses that should be blocked. This is a common audit finding in cloud security reviews: CIDR ranges that are too broad because the engineer did not calculate the actual span. Expanding a CIDR to its start/end range before adding a firewall rule is a basic sanity check.
The same issue appears in reverse when aggregating routes. A BGP engineer wants to advertise a summary route for 10.1.0.0–10.1.3.255 — four /24 blocks. The correct summary is 10.1.0.0/22. Getting the prefix wrong (using /23 or /24 in the summary) either fails to cover all the addresses or introduces a more specific route conflict. Expanding the candidate CIDR confirms the range matches the intent.
Reading CIDR Notation
CIDR (Classless Inter-Domain Routing) notation encodes a network as a base address plus a prefix length. The prefix length determines the size: for IPv4, the number of host addresses is 2(32 − prefix).
- /32: 1 address (a single host)
- /31: 2 addresses (point-to-point link per RFC 3021; no broadcast)
- /30: 4 addresses (2 usable) /28: 16 addresses (14 usable)
- /24: 256 addresses (254 usable)
- /22: 1,024 addresses (1,022 usable)
- /20: 4,096 addresses
- /16: 65,536 addresses
- /8: 16,777,216 addresses
- /0: 4,294,967,296 addresses (the entire IPv4 space, used in default routes)
Checking If an IP Falls Within a CIDR Range
One practical use of range expansion is membership testing: does a specific IP fall within a given block? The algebraic approach is to convert both the test IP and the CIDR start address to 32-bit integers, then check whether the test IP integer falls between start and end. This tool performs that check automatically when you enter both a CIDR and a test address — useful for auditing log entries against known network blocks.
Supernetting: Aggregating Multiple CIDRs
Supernetting is the reverse of subnetting — combining multiple contiguous CIDRs into a single summary. The rules: the blocks must be contiguous, and the starting block must be aligned to the boundary of the summary prefix. You can combine 10.0.0.0/24 and 10.0.1.0/24 into 10.0.0.0/23 (start address is on the /23 boundary). You cannot combine 10.0.1.0/24 and 10.0.2.0/24 into a single /23 because 10.0.1.0 is not on the /23 boundary. Expanding the candidate summary CIDR immediately shows you whether it covers exactly the intended blocks.
How to Use This Tool
- Enter any CIDR block in standard notation (e.g.
203.0.113.0/22). - The tool displays the start IP, end IP, total address count, and usable host count.
- Optionally enumerate every address in the range — capped at 1,024 addresses for browser performance.
- Enter a specific IP to test whether it falls within the range.
◇ FAQ
01 How many IPs does a /22 actually cover? +
2^(32-22) = 2^10 = 1,024 total addresses, 1,022 usable hosts (subtract network and broadcast). A /22 is four times larger than a /24. This is a common surprise in firewall rule audits where engineers expect /22 to be "slightly larger than /24."
02 Can two CIDR blocks overlap without being identical? +
Yes — this is called a CIDR containment relationship. 10.0.0.0/16 contains 10.0.1.0/24, which in turn contains 10.0.1.128/25. Overlapping (non-nested) CIDRs are possible too: 10.0.0.0/22 and 10.0.2.0/23 overlap in the 10.0.2.0–10.0.3.255 range. Checking start/end ranges directly makes overlaps immediately visible.
03 What is a /31 subnet used for? +
RFC 3021 (2000) allows /31 subnets for point-to-point links. Since there are only two addresses and no broadcast is needed between exactly two devices, both addresses are usable as host addresses. This saves one IP address compared to a /30 on every router interconnect, which matters in large networks with many links.
04 How do I aggregate multiple /24s into a summary route? +
The blocks must be contiguous and start at the correct power-of-two boundary. Two consecutive /24s (e.g., 10.0.0.0/24 and 10.0.1.0/24) aggregate to a /23 if the first starts at an even boundary (0, 2, 4...). Four /24s aggregate to a /22 if the first is divisible by 4. Expand the candidate summary CIDR here to verify it covers exactly the intended range.
