Subnet Calculator
v3.9.1
Tool
Split Subnet
Supernet & Route Summarisation
IP Range → CIDREnter a start and end IPv4 address to get the minimal set of CIDR blocks that exactly covers that range using the greedy largest-aligned-block algorithm.
Subnet Allocation Tree
Subnet Tree EditorInteractive subnet planner. Click a node to split it. Drag onto a sibling to merge. Edits autosave to your browser; use Save Session to share across devices.
Split
Choose how many equal children to create.
Edit
Compare two trees
Pick two saved trees and compare added, removed, and changed subnets.
added
removed
changed
Apply Template
Pick a preset, then confirm or customise the root CIDR before it's applied to the editor.
Drop a JSON file into data/tree-presets/ to add your own.
Schema reference.
Node
Wildcard ↔ CIDRBidirectional Cisco-style converter. Enter a wildcard mask (e.g. 0.0.0.255) to get its CIDR prefix, or a prefix (/24 or 24) to get the wildcard. Non-contiguous masks are rejected.
IP LookupFor each IP, finds every CIDR that contains it. The "Deepest" column is the longest-prefix (most specific) match. Mixed IPv4/IPv6 inputs are allowed; CIDRs only match IPs of the same family. Caps: 100 CIDRs, 1000 IPs.
Subnet DiffCompares two CIDR lists. Inputs are canonicalised (host bits zeroed, IPv6 lowercased) before comparison. Reports added, removed, unchanged, and changed (same network address but different prefix length). Mixed IPv4/IPv6 inputs are allowed. Cap: 1000 entries per side.
Tool
Split Subnet
IPv6 ULA Prefix Generator (RFC 4193)
IPv6 Range → CIDREnter a start and end IPv6 address to get the minimal set of CIDR blocks that exactly covers that range. Uses GMP arithmetic so /128-wide ranges work without overflow. Output is capped (default 256 blocks); the cap is configurable via $range_max_cidrs.
IPv6 Supernet & Route SummarisationIPv6 counterpart to the IPv4 Supernet tool. Find returns the smallest CIDR enclosing all listed IPv6 prefixes; Summarise reduces the list to the minimal covering IPv6 prefixes. Pure GMP — works for /128-wide inputs. Maximum 50 CIDRs per check.
Zone ID ParserZone identifiers (RFC 4007) scope an IPv6 address to a specific interface. They are written after a percent sign — e.g. fe80::1%eth0 — and are only meaningful on link-local (fe80::/10) addresses; most operating systems ignore zones supplied on global addresses.
Derive AddressDerives the IPv6 forms generated from a 48-bit MAC address per RFC 4291 §2.5.1: the modified EUI-64 interface identifier (with the U/L bit flipped), the link-local address (fe80:: + EUI-64), and the solicited-node multicast address (ff02::1:ff + the low 24 bits of the unicast address). Accepts colon, hyphen, Cisco dotted, or bare-hex MAC formats.
SLAAC PrivacyGenerates an RFC 8981 privacy interface identifier inside the supplied /64 prefix. The 64-bit interface ID is cryptographically random (PHP random_bytes), with the U/L bit cleared so it cannot be confused with an EUI-64 address derived from a real MAC. Production hosts should leave the seed blank; the seed input is provided only for reproducible documentation/testing output.
IP LookupFor each IP, finds every CIDR that contains it. The "Deepest" column is the longest-prefix (most specific) match. Mixed IPv4/IPv6 inputs are allowed; CIDRs only match IPs of the same family. Caps: 100 CIDRs, 1000 IPs.
Subnet DiffCompares two CIDR lists. Inputs are canonicalised (host bits zeroed, IPv6 lowercased) before comparison. Reports added, removed, unchanged, and changed (same network address but different prefix length). Mixed IPv4/IPv6 inputs are allowed. Cap: 1000 entries per side.
Reverse DNS (rdns6)Generates the ip6.arpa zone-delegation name for an IPv6 address per RFC 3596. With no prefix (or /128) returns the full reverse name. The prefix length must be a multiple of 4 — that is the nibble boundary required for delegation.
IPv4-mapped / NAT64 (mapped6)Bidirectional convert between IPv4, IPv4-mapped IPv6 (::ffff:0:0/96, RFC 4291) and NAT64 IPv6 (64:ff9b::/96 default, RFC 6052). Accepts any of the three forms; renders all four representations. Custom NAT64 prefix supported via the Advanced disclosure (must be /96).
NAT64 / DNS64 (any RFC 6052 prefix length)Open for prefix-length-aware NAT64 (RFC 6052 §2.2 — /32, /40, /48, /56, /64, /96) and DNS64 AAAA synthesis (RFC 6147). The well-known prefix 64:ff9b::/96 is rejected for non-globally-unique IPv4 per RFC 6052 §3.1.
Embedded IPv4 detectorFront door for v3.5.0 transition tools. Detects whether an IPv6 address embeds an IPv4 via IPv4-mapped, IPv4-compatible (deprecated), 6to4, Teredo, NAT64 well-known, or ISATAP — and extracts the embedded IPv4. Per-scheme deep-link buttons activate as their drawers ship.
6to4 address toolBidirectional translation between public IPv4 addresses and 2002::/16 6to4 prefixes (RFC 3056). Encode mode produces 2002:WWXX:YYZZ::/48 from W.X.Y.Z; decode mode extracts the embedded IPv4, 16-bit Subnet/SLA ID, and 64-bit Interface ID from a 6to4 address. RFC 7526 deprecated the 6to4 anycast relay in 2015 — use this tool for analysis and migration audits, not for greenfield deployments.
Teredo address decoderDecode and encode IPv6 addresses in the 2001:0::/32 Teredo prefix (RFC 4380). Decode mode extracts the server IPv4 (raw), 16-bit flags (cone bit = 0x8000), de-XOR'd UDP port (XOR 0xFFFF), and de-XOR'd client IPv4 (each byte XOR 0xFF). Encode mode rebuilds the address from those parts. Microsoft retired the public Teredo service for consumer Windows in 2019; this tool is provided for analysis of legacy traffic captures and address audits.
ISATAP interface-ID helperBuild and decode the 64-bit ISATAP interface ID (RFC 5214). Encode mode wraps an IPv4 in `0:5efe:V4` (locally-administered) or `200:5efe:V4` (globally-unique, u-bit set); the universal/local bit is auto-detected from the IPv4 (private/reserved → local; public → global) but you can force either side. Decode mode recognises both forms and pulls the embedded IPv4 back out. Append the resulting IID to any /64 prefix to get a complete IPv6 address.
6rd address toolCompute the customer IPv6 prefix delegated by a 6rd service provider per RFC 5969. Encode mode takes the SP IPv6 prefix, the SP IPv4 mask length (bits stripped from the high end of the customer v4), and the customer IPv4, and emits the delegated IPv6 prefix. Decode mode reverses: SP params + a 6rd IPv6 address → the customer IPv4 (the masked-off region is treated as zero since it is SP-side configuration).
IPv6 prefix-delegation plannerSlice a delegated parent prefix (e.g. /48) into nibble-aligned child prefixes (e.g. /56) and report how much of the parent space is left over. GMP throughout — counts that overflow signed 64-bit ints (e.g. /32 → /128) print as "2^N".
IPv6 nibble-boundary helperFor any IPv6 prefix, surface the nibble-aligned neighbours: above (≤ input length, less specific) and below (≥ input length, more specific). Useful for ip6.arpa reverse-zone delegation planning where non-nibble lengths require an explicit nibble-boundary decision.
RFC 3531 sparse allocationApply an RFC 3531 bit-reservation strategy (centermost / leftmost / rightmost) to a parent IPv6 prefix. Centermost bisects outward from the middle so future growth has room either side; leftmost is dense sequential; rightmost mirrors leftmost from the top down.
IPv6 multicast scope decoderFront door for the v3.6.0 multicast tools. Decodes any FF00::/8 address into scope, flags, scheme hint, and 112-bit group ID. Looks up well-known groups (RFC 4291 / 7761 / 5905). Deep-links to the SSM and embedded-RP tools when the P or R flag is set.
SSM / unicast-prefix-based multicast (RFC 3306)Build and decode FF3x::/12 multicast group addresses with an embedded unicast prefix. RFC 3306 § 4 / RFC 4607. Encode mode composes a group address from a unicast prefix (0..64), scope (1..15), and 32-bit group ID. Decode mode reverses the process; it requires the flag nibble to be exactly 0x3 (P+T) — embedded-RP groups (R+P+T = 0x7) belong in the embedded-RP tool.
Embedded-RP multicast (RFC 3956)Build and decode FF7x::/12 multicast group addresses with the Rendezvous Point address embedded directly in the group address. RFC 3956. Encode mode composes a group from an RP address (whose host suffix is replaced by the explicit RIID), RP prefix length (0..64), 4-bit RIID, scope (1..15), and 32-bit group ID. Decode mode reverses the process; it requires the flag nibble to be exactly 0x7 (R+P+T) — SSM groups (P+T = 0x3) belong in the SSM tool.
IPv6 PMTU helperCompute the effective payload and per-fragment breakdown for an IPv6 packet over a path with the given MTU and extension-header overhead. Surfaces RFC 8200 §5 minimum link MTU (1280) warnings, the rule that routers do not fragment IPv6, and the RFC 8200 §3 fixed 40-byte header. Per-fragment payload is rounded down to an 8-byte boundary; the last fragment carries the remainder with M=0.
Tool
Save & Restore SessionSaves your VLSM inputs to the server so you can restore them later via a short link. Sessions expire after the configured TTL. No account required.
Saved sessions expire after 365 days.
Subnet Overlap CheckerCompares two CIDRs and reports whether they overlap, one contains the other, are identical, or have no relationship. Supports both IPv4 and IPv6.
Multi-CIDR Overlap CheckEnter up to 50 IPv4 or IPv6 CIDRs, one per line. The tool reports any pairs that overlap, are identical, or where one contains the other.
Tool
Save & Restore IPv6 SessionSaves your IPv6 VLSM inputs to the server so you can restore them later via a short link. Sessions expire after the configured TTL.
Saved sessions expire after 365 days.