Subnet Calculator

v3.9.1

IP Address?Enter an IPv4 address (e.g. 192.168.1.1) or CIDR notation (e.g. 192.168.1.0/24). The subnet mask field is optional when using CIDR notation.

Netmask?Enter the subnet mask as a prefix length (/24), dotted-decimal (255.255.255.0), or wildcard (0.0.0.255). Leave blank when using CIDR notation in the IP field.

Transform

Visualize

Lookups

Tool

Split Subnet

Split into?Enter a prefix length larger than the parent (e.g. /25 splits a /24 into two /25 subnets). The result is capped at the configured maximum.

Supernet & Route Summarisation

?Finds the smallest single CIDR block that contains all of the listed CIDRs. Useful for aggregating routes into a single summary route. ?Computes the minimal set of non-overlapping CIDRs that exactly covers the listed networks. Unlike Find Supernet, this avoids including addresses outside the input ranges.

IP Range → CIDR?Enter a start and end IPv4 address to get the minimal set of CIDR blocks that exactly covers that range using the greedy largest-aligned-block algorithm.

Subnet Allocation Tree

Parent CIDR

Subnet Tree Editor?Interactive subnet planner. Click a node to split it. Drag onto a sibling to merge. Edits autosave to your browser; use Save Session to share across devices.

Root CIDR

Or load saved session

Split

Choose how many equal children to create.

Edit

Name Notes

Compare two trees

Pick two saved trees and compare added, removed, and changed subnets.

Tree A (before)

Use the autosaved draft for the current root CIDR.

Tree B (after)

Use the autosaved draft for the current root CIDR.

added removed changed

Apply Template

Pick a preset, then confirm or customise the root CIDR before it's applied to the editor.

Root CIDR

Drop a JSON file into data/tree-presets/ to add your own. Schema reference.

Node

Wildcard ↔ CIDR?Bidirectional Cisco-style converter. Enter a wildcard mask (e.g. 0.0.0.255) to get its CIDR prefix, or a prefix (/24 or 24) to get the wildcard. Non-contiguous masks are rejected.

IP Lookup?For each IP, finds every CIDR that contains it. The "Deepest" column is the longest-prefix (most specific) match. Mixed IPv4/IPv6 inputs are allowed; CIDRs only match IPs of the same family. Caps: 100 CIDRs, 1000 IPs.

CIDRs (one per line, max 100) IPs (one per line, max 1000)

Subnet Diff?Compares two CIDR lists. Inputs are canonicalised (host bits zeroed, IPv6 lowercased) before comparison. Reports added, removed, unchanged, and changed (same network address but different prefix length). Mixed IPv4/IPv6 inputs are allowed. Cap: 1000 entries per side.

Before (one CIDR per line) After (one CIDR per line)

IPv6 Address

Prefix

Foundational

Address utilities

Transition

Prefix planning

Multicast

Tool

Split Subnet

Split into?Enter a prefix length larger than the parent (e.g. /65 splits a /64 into two /65 subnets). The result is capped at the configured maximum.

IPv6 ULA Prefix Generator (RFC 4193)

Global ID (optional 10 hex chars)?A 40-bit hex value used as the globally unique portion of the ULA prefix (RFC 4193). Leave blank to generate one pseudo-randomly from the current timestamp.

IPv6 Range → CIDR?Enter a start and end IPv6 address to get the minimal set of CIDR blocks that exactly covers that range. Uses GMP arithmetic so /128-wide ranges work without overflow. Output is capped (default 256 blocks); the cap is configurable via $range_max_cidrs.

IPv6 Supernet & Route Summarisation?IPv6 counterpart to the IPv4 Supernet tool. Find returns the smallest CIDR enclosing all listed IPv6 prefixes; Summarise reduces the list to the minimal covering IPv6 prefixes. Pure GMP — works for /128-wide inputs. Maximum 50 CIDRs per check.

IPv6 CIDR list (one per line)

?Finds the smallest single IPv6 CIDR block that contains all of the listed CIDRs. Useful for aggregating IPv6 routes into a single summary route. ?Computes the minimal set of non-overlapping IPv6 CIDRs that exactly covers the listed networks. Unlike Find Supernet, this avoids including addresses outside the input ranges.

Zone ID Parser?Zone identifiers (RFC 4007) scope an IPv6 address to a specific interface. They are written after a percent sign — e.g. fe80::1%eth0 — and are only meaningful on link-local (fe80::/10) addresses; most operating systems ignore zones supplied on global addresses.

IPv6 address with optional zone identifier

Derive Address?Derives the IPv6 forms generated from a 48-bit MAC address per RFC 4291 §2.5.1: the modified EUI-64 interface identifier (with the U/L bit flipped), the link-local address (fe80:: + EUI-64), and the solicited-node multicast address (ff02::1:ff + the low 24 bits of the unicast address). Accepts colon, hyphen, Cisco dotted, or bare-hex MAC formats.

MAC address

SLAAC Privacy?Generates an RFC 8981 privacy interface identifier inside the supplied /64 prefix. The 64-bit interface ID is cryptographically random (PHP random_bytes), with the U/L bit cleared so it cannot be confused with an EUI-64 address derived from a real MAC. Production hosts should leave the seed blank; the seed input is provided only for reproducible documentation/testing output.

IPv6 /64 prefix

Advanced (seed for reproducibility)

Optional 16-hex seed for reproducible output (RFC 8981 §3.3.1). Leave blank in production — every fresh generation should be cryptographically random.

Seed (16 hex characters) ?A 16-character hexadecimal seed (64 bits) makes the generated interface ID deterministic. Useful for reproducing examples in documentation or tests; never use a fixed seed in production because it defeats the privacy purpose of RFC 8981.

CIDRs (one per line, max 100) IPs (one per line, max 1000)

Before (one CIDR per line) After (one CIDR per line)

Reverse DNS (rdns6)?Generates the ip6.arpa zone-delegation name for an IPv6 address per RFC 3596. With no prefix (or /128) returns the full reverse name. The prefix length must be a multiple of 4 — that is the nibble boundary required for delegation.

IPv6 address?Any valid IPv6 literal (compressed or expanded form). Example: 2001:db8::1 or fe80::1.

Prefix (optional, /4 boundary)?Optional prefix length for zone-delegation form. Must be a multiple of 4 (0, 4, 8, …, 128). Common choices: /48 for ISP delegation, /56 for sub-allocation, /64 for a single LAN. Leave blank or set to 128 for the full reverse name.

IPv4-mapped / NAT64 (mapped6)?Bidirectional convert between IPv4, IPv4-mapped IPv6 (::ffff:0:0/96, RFC 4291) and NAT64 IPv6 (64:ff9b::/96 default, RFC 6052). Accepts any of the three forms; renders all four representations. Custom NAT64 prefix supported via the Advanced disclosure (must be /96).

Address?Any one of: an IPv4 dotted-quad (192.0.2.1), an IPv4-mapped IPv6 (::ffff:192.0.2.1), or a NAT64 IPv6 within the supplied prefix (64:ff9b::c000:201).

Advanced — custom NAT64 prefix

NAT64 prefix (/96 only)?Optional NAT64 prefix in /96 form. Defaults to the well-known 64:ff9b::/96 (RFC 6052). Operator-supplied custom prefixes such as 2001:db8:1::/96 are accepted. Non-/96 prefixes are rejected.

NAT64 / DNS64 (any RFC 6052 prefix length)?Open for prefix-length-aware NAT64 (RFC 6052 §2.2 — /32, /40, /48, /56, /64, /96) and DNS64 AAAA synthesis (RFC 6147). The well-known prefix 64:ff9b::/96 is rejected for non-globally-unique IPv4 per RFC 6052 §3.1.

Mode?encode embeds an IPv4 into a NAT64 prefix; decode extracts the IPv4 from a NAT64 IPv6; dns64 synthesises an AAAA record for an A record (RFC 6147).

Prefix length?One of 32, 40, 48, 56, 64, 96 per RFC 6052 §2.2. Defaults to /96 (matches DNS64 well-known prefix usage).

NAT64 prefix?IPv6 literal of the NAT64 prefix without the /PL suffix. Examples: 64:ff9b:: (well-known), 2001:db8::, 2001:db8:122::. Bits beyond the declared prefix length must be zero.

IPv4 (encode)?Dotted-quad IPv4 to embed. Globally-unique addresses only when using the well-known prefix 64:ff9b::/96 (RFC 6052 §3.1).

NAT64 IPv6 (decode)?IPv6 literal whose top bits match the NAT64 prefix. Example for /32: 2001:db8:c000:221::

A record (dns64)?IPv4 address from a DNS A record. DNS64 (RFC 6147) synthesises an AAAA by embedding it into the supplied NAT64 prefix.

Embedded IPv4 detector?Front door for v3.5.0 transition tools. Detects whether an IPv6 address embeds an IPv4 via IPv4-mapped, IPv4-compatible (deprecated), 6to4, Teredo, NAT64 well-known, or ISATAP — and extracts the embedded IPv4. Per-scheme deep-link buttons activate as their drawers ship.

IPv6 address?Any IPv6 literal. Examples: ::ffff:192.0.2.1 (mapped), 2002:c000:0201:: (6to4), 64:ff9b::192.0.2.1 (NAT64 WKP), 2001:db8::200:5efe:c000:201 (ISATAP).

6to4 address tool?Bidirectional translation between public IPv4 addresses and 2002::/16 6to4 prefixes (RFC 3056). Encode mode produces 2002:WWXX:YYZZ::/48 from W.X.Y.Z; decode mode extracts the embedded IPv4, 16-bit Subnet/SLA ID, and 64-bit Interface ID from a 6to4 address. RFC 7526 deprecated the 6to4 anycast relay in 2015 — use this tool for analysis and migration audits, not for greenfield deployments.

Mode?Encode: IPv4 → 2002:WWXX:YYZZ::/48. Decode: 6to4 IPv6 → embedded IPv4, Subnet ID, Interface ID.

Address?Encode: a public IPv4 (e.g. 192.0.2.1). Private (RFC 1918), reserved, multicast, and 0.0.0.0 are rejected. Decode: any IPv6 literal under 2002::/16 (e.g. 2002:c000:0201::1).

Teredo address decoder?Decode and encode IPv6 addresses in the 2001:0::/32 Teredo prefix (RFC 4380). Decode mode extracts the server IPv4 (raw), 16-bit flags (cone bit = 0x8000), de-XOR'd UDP port (XOR 0xFFFF), and de-XOR'd client IPv4 (each byte XOR 0xFF). Encode mode rebuilds the address from those parts. Microsoft retired the public Teredo service for consumer Windows in 2019; this tool is provided for analysis of legacy traffic captures and address audits.

Mode?Decode: Teredo IPv6 → server v4, client v4, port, flags. Encode: parts → Teredo IPv6 in 2001:0::/32.

Teredo IPv6 address?Any IPv6 literal under 2001:0::/32. Example: 2001:0:4136:e378:8000:63bf:3fff:fdd2 (RFC 4380 §4 worked example).

ISATAP interface-ID helper?Build and decode the 64-bit ISATAP interface ID (RFC 5214). Encode mode wraps an IPv4 in `0:5efe:V4` (locally-administered) or `200:5efe:V4` (globally-unique, u-bit set); the universal/local bit is auto-detected from the IPv4 (private/reserved → local; public → global) but you can force either side. Decode mode recognises both forms and pulls the embedded IPv4 back out. Append the resulting IID to any /64 prefix to get a complete IPv6 address.

Mode?Encode: IPv4 → ISATAP IID. Decode: IID → IPv4 + globally-unique flag.

IPv4 address?Any IPv4 literal. The encoder packs it into the bottom 32 bits of the IID.

Universal/local bit?Auto: infer from the IPv4 (public → globally-unique, private/reserved → local). True: force globally-unique (200:5efe). False: force local (0:5efe).

6rd address tool?Compute the customer IPv6 prefix delegated by a 6rd service provider per RFC 5969. Encode mode takes the SP IPv6 prefix, the SP IPv4 mask length (bits stripped from the high end of the customer v4), and the customer IPv4, and emits the delegated IPv6 prefix. Decode mode reverses: SP params + a 6rd IPv6 address → the customer IPv4 (the masked-off region is treated as zero since it is SP-side configuration).

Mode?Encode: customer IPv4 → delegated IPv6 prefix. Decode: 6rd IPv6 address → customer IPv4.

SP IPv6 prefix?The service provider's globally-routed 6rd IPv6 prefix in CIDR form, e.g. 2001:db8::/32. Provided by the SP via DHCPv6 OPTION_6RD or out-of-band configuration.

SP IPv4 mask length?How many leading bits of the customer IPv4 the SP discards before embedding (0..32). Typically 0 to embed the full v4. The remaining (32 − mask_len) bits are appended to the SP prefix.

Customer IPv4?The customer's WAN IPv4 address. After stripping the top mask-length bits, the remaining bits are appended to the SP prefix to form the delegated IPv6 prefix.

IPv6 prefix-delegation planner?Slice a delegated parent prefix (e.g. /48) into nibble-aligned child prefixes (e.g. /56) and report how much of the parent space is left over. GMP throughout — counts that overflow signed 64-bit ints (e.g. /32 → /128) print as "2^N".

Parent IPv6 prefix?The delegated parent prefix in CIDR form, e.g. 2001:db8::/48. Host bits are zeroed before slicing.

Child length?Prefix length for each child block (1..128). Must be greater than the parent length. With nibble-align on, non-nibble values snap up to the next multiple of 4.

Count?How many child prefixes to allocate (≥ 1). Bounded by the parent: start_offset + count must not exceed the total available children.

Start offset?Skip the first N child prefixes before allocating. Default 0. Useful for resuming an in-progress delegation plan.

Nibble-align child length?When on, snap the child prefix length up to the next multiple of 4 so each child is a clean nibble boundary in the IPv6 address (easier for humans to read and DNS reverse-zones).

IPv6 nibble-boundary helper?For any IPv6 prefix, surface the nibble-aligned neighbours: above (≤ input length, less specific) and below (≥ input length, more specific). Useful for ip6.arpa reverse-zone delegation planning where non-nibble lengths require an explicit nibble-boundary decision.

IPv6 prefix?Any IPv6 prefix in CIDR form, e.g. 2001:db8::/49. Host bits beyond the prefix length are zeroed before the neighbours are computed.

RFC 3531 sparse allocation?Apply an RFC 3531 bit-reservation strategy (centermost / leftmost / rightmost) to a parent IPv6 prefix. Centermost bisects outward from the middle so future growth has room either side; leftmost is dense sequential; rightmost mirrors leftmost from the top down.

Parent IPv6 prefix?The parent prefix in CIDR form, e.g. 2001:db8::/48. Host bits are zeroed before allocation.

Reservation bits?Number of bits in the reservation field (1..8 by default; operators can raise to 12). Each child block has prefix length parent_length + reservation_bits.

Strategy?Centermost: bisect outward from the middle (RFC 3531 §3 — best for growth). Leftmost: monotonic 0..N. Rightmost: reverse of leftmost.

IPv6 multicast scope decoder?Front door for the v3.6.0 multicast tools. Decodes any FF00::/8 address into scope, flags, scheme hint, and 112-bit group ID. Looks up well-known groups (RFC 4291 / 7761 / 5905). Deep-links to the SSM and embedded-RP tools when the P or R flag is set.

IPv6 multicast address?Any IPv6 multicast literal (FF00::/8). Examples: FF02::1 (all nodes), FF02::1:FF12:3456 (solicited-node), FF3E::1234:5678 (SSM global), FF7E:140:2001:db8:cafe::1234 (embedded-RP).

SSM / unicast-prefix-based multicast (RFC 3306)?Build and decode FF3x::/12 multicast group addresses with an embedded unicast prefix. RFC 3306 § 4 / RFC 4607. Encode mode composes a group address from a unicast prefix (0..64), scope (1..15), and 32-bit group ID. Decode mode reverses the process; it requires the flag nibble to be exactly 0x3 (P+T) — embedded-RP groups (R+P+T = 0x7) belong in the embedded-RP tool.

Mode?Encode: unicast prefix + scope + group ID → FF3x:: SSM group. Decode: SSM group → unicast prefix + scope + group ID.

Unicast prefix?IPv6 unicast prefix to embed, in <code>address/length</code> form. Length must be 0..64 — only the upper 64 bits of the prefix fit in an SSM group address. Host bits are masked automatically. Examples: <code>2001:db8::/32</code>, <code>fd00::/8</code>, <code>::/0</code>.

Scope?Multicast scope (1..15). Common values: 2 (link-local), 5 (site-local), 8 (organization-local), 14 / 0xE (global). RFC 4291 §2.7 + RFC 7346.

Group ID?32-bit unsigned group ID (0..4294967295). Accepts decimal or hex (<code>0x12345678</code>). RFC 3306 §4 places this in the low 32 bits of the multicast address.

Embedded-RP multicast (RFC 3956)?Build and decode FF7x::/12 multicast group addresses with the Rendezvous Point address embedded directly in the group address. RFC 3956. Encode mode composes a group from an RP address (whose host suffix is replaced by the explicit RIID), RP prefix length (0..64), 4-bit RIID, scope (1..15), and 32-bit group ID. Decode mode reverses the process; it requires the flag nibble to be exactly 0x7 (R+P+T) — SSM groups (P+T = 0x3) belong in the SSM tool.

Mode?Encode: RP parts → FF7x:: embedded-RP group. Decode: FF7x:: group → RP address, prefix length, RIID, scope, and group ID.

RP address?Rendezvous Point IPv6 address. Only the upper bits selected by the prefix length are encoded into the multicast group; the host suffix is ignored and replaced by the explicit RIID. Example: <code>2001:db8:cafe::1</code>.

RP prefix length?Length of the RP prefix in bits (0..64). RFC 3956 caps this at 64 because only the upper 64 bits of the RP prefix fit in the multicast address. Typical values: 32 (provider prefix), 48 (site prefix), 56 / 64 (subnet).

RIID?4-bit RP interface ID (0..15). Selects which interface on the RP terminates the shared tree. The canonical RP address is reconstructed as <code><rp-prefix>::<riid></code>.

Scope?Multicast scope (1..15). Common values: 2 (link-local), 5 (site-local), 8 (organization-local), 14 / 0xE (global). RFC 4291 §2.7 + RFC 7346.

Group ID?32-bit unsigned group ID (0..4294967295). Accepts decimal or hex (<code>0x12345678</code>). RFC 3956 places this in the low 32 bits of the multicast address.

IPv6 PMTU helper?Compute the effective payload and per-fragment breakdown for an IPv6 packet over a path with the given MTU and extension-header overhead. Surfaces RFC 8200 §5 minimum link MTU (1280) warnings, the rule that routers do not fragment IPv6, and the RFC 8200 §3 fixed 40-byte header. Per-fragment payload is rounded down to an 8-byte boundary; the last fragment carries the remainder with M=0.

Path MTU (bytes)?Path MTU in bytes. The IPv6 minimum link MTU is 1280 (RFC 8200 §5); values below that are flagged but still computed. Common values: 1280 (IPv6 minimum), 1500 (Ethernet), 9000 (jumbo frame).

Payload size (bytes)?Upper-layer payload to send (bytes). Zero is allowed. If the payload exceeds the effective per-packet payload, the helper computes the per-fragment breakdown.

Extension headers (bytes, comma-separated)?Optional list of extension-header sizes in bytes, separated by commas. Each value must be a positive multiple of 8. Example: <code>8,8</code> for Hop-by-Hop + Routing. The 8-byte Fragment header (RFC 8200 §4.5) is added automatically per fragment when fragmentation is needed.

Parent Network

Prefix

Name Hosts Needed

Tool

Save & Restore Session?Saves your VLSM inputs to the server so you can restore them later via a short link. Sessions expire after the configured TTL. No account required.

Saved sessions expire after 365 days.

Subnet Overlap Checker?Compares two CIDRs and reports whether they overlap, one contains the other, are identical, or have no relationship. Supports both IPv4 and IPv6.

Multi-CIDR Overlap Check?Enter up to 50 IPv4 or IPv6 CIDRs, one per line. The tool reports any pairs that overlap, are identical, or where one contains the other.

Parent Network

Prefix

Name Hosts Needed?Enter a positive integer (e.g. 50) or a power-of-two expression (e.g. 2^64) for very large IPv6 sizings.

Tool

Save & Restore IPv6 Session?Saves your IPv6 VLSM inputs to the server so you can restore them later via a short link. Sessions expire after the configured TTL.

Saved sessions expire after 365 days.

GitHub · Docs