CIDR to IP Range
Turn a CIDR block into its address range — or a range into the smallest blocks that cover it exactly.
The prefix is how many bits are fixed. Every bit after it varies.
Covers
10.0.0.0 – 10.0.3.255
1,024 addresses in total.
First address
10.0.0.0
Last address
10.0.3.255
Total addresses
1,024
Subnet mask
255.255.252.0
Usable for hosts
1,022
First and last are the network and broadcast addresses.
Next block starts at
10.0.4.0
Useful when carving a larger block into consecutive allocations.
The alignment rule, which explains everything else
One constraint governs CIDR: a block of 2n addresses must begin at a multiple of 2n. A /24 covers 256 addresses, so it can only start where the last octet is 0. A /26 covers 64, so it can only start at .0, .64, .128 or .192.
This is not bureaucracy. It is what makes routing fast: a router decides where a packet goes by masking the destination and comparing, which is a couple of instructions. Arbitrary ranges would require comparing every address against a lower and upper bound, on every packet.
The practical consequence is the one this tool exists for. Human ranges do not respect power-of-two boundaries, so converting one to CIDR usually produces several blocks — small ones at each ragged end, larger ones through the aligned middle.
A worked example
192.168.1.10 to 192.168.1.20 is eleven addresses. Eleven is not a power of two, so it cannot be one block. The greedy cover works forwards from .10:
| Block | Covers | Why that size |
|---|---|---|
192.168.1.10/31 | .10 – .11 | .10 is even, so a 2-address block starts there; a 4-address one could not. |
192.168.1.12/30 | .12 – .15 | .12 is a multiple of 4. |
192.168.1.16/30 | .16 – .19 | .16 is a multiple of 16, but only 5 addresses remain, so 4 is the largest that fits. |
192.168.1.20/32 | .20 | One address left. |
Four blocks for eleven addresses. Every block is fully inside the range, and nothing outside it is included.
Where this comes up
- Firewall and security-group rules. AWS, Azure and GCP all express source ranges in CIDR, so an allow-list handed to you as “10.20.30.40 through 10.20.31.200” has to be converted before it can be entered.
- Routing statements. A static route needs a prefix, not a range.
- Reading a block someone quoted at you. A hosting provider says your allocation is
203.0.113.64/29; the first direction of this tool tells you that is .64 to .71, with .65 to .70 assignable. - Checking whether two blocks overlap. Convert both to ranges and compare the numbers — far easier than reasoning about prefixes.
Notation worth being precise about
10.0.0.5/24 and 10.0.0.0/24 are both valid and mean different things. The second names a network. The first names a host within that network, and is how interface configuration is written — one line carrying both the address and the block it belongs to. If you paste the first into something expecting a network, most tools will silently mask it down to 10.0.0.0/24, which is usually what you wanted and occasionally is not.
0.0.0.0/0 is the whole internet. It is the correct way to write a default route and a serious thing to leave in an inbound firewall rule.
Related
For the full breakdown of a single block — network, broadcast, host range, binary — the subnet calculator is the tool. For converting between /24 and 255.255.255.0, there is a dedicated converter with the whole table.
CIDR questions
Why does my range need several CIDR blocks instead of one?
Because CIDR blocks have to be aligned: a block of 2ⁿ addresses must start at a multiple of 2ⁿ. 192.168.1.10 to 192.168.4.200 is 959 addresses, but it starts at .10 rather than on a power-of-two boundary and ends mid-block, so it gets covered by progressively larger blocks working in from each end. The smallest single block containing the whole range is a /21 spanning 2,048 addresses — 1,089 of which you did not ask for.
Could you just round up to one bigger block?
It would be tidier and it is usually the wrong answer. The reason people convert a range to CIDR is almost always to write a firewall rule, a security group, or a routing statement, and rounding up silently grants access to addresses nobody intended. This tool produces an exact cover: every address in the output is inside your range, and every address in your range is in the output.
What does the number after the slash mean?
How many bits, from the left, are fixed. /24 fixes twenty-four of the thirty-two bits and leaves eight free, which is 256 addresses. Each increment halves the block: /25 is 128 addresses, /26 is 64. Working the other way, subtract the prefix from 32 and raise 2 to that power.
Is 10.0.0.5/24 a valid CIDR block?
It is valid notation and it appears constantly, but it does not describe a block starting at .5 — it describes the host 10.0.0.5 inside the block 10.0.0.0/24. Interface configurations are written this way deliberately, because one line then carries both the address and the network it belongs to. If you meant a block, the address part has to be the network address.
How large is a /0?
The entire IPv4 address space, all 4,294,967,296 addresses. It fixes no bits at all. You will see it as a default route — 0.0.0.0/0 means "everything", which is why it is the last-resort entry in a routing table and why it is a dangerous thing to type into a firewall rule by accident.
Last reviewed . Found something out of date? Tell us.