ML
MindLucidCôté Client Uniquement
Réseau & Diagnostic IP
Zéro Téléchargement Serveur
Moteur d’Exécution Local: Browser Web API

Calculateur de Sous-Réseaux IPv4 / IPv6 et CIDR

Calculs binaires instantanés de masques et préfixes CIDR (/0 à /32) exécutés en mémoire locale. Identifiez les adresses réseau, broadcast, la matrice binaire 32 bits et le découpage VLSM hors ligne.

Préfixe : /240-32 bits
Préréglages :
Adresse réseau (ID)
192.168.1.0
CIDR: /24
Adresse de diffusion (Broadcast)
192.168.1.255
Masque générique (Wildcard): 0.0.0.255
Masque de sous-réseau
255.255.255.0
0xFFFFFF00
Hôtes exploitables
254Total des adresses IP: 256
2 reserved
Plage d’hôtes utilisables
192.168.1.1192.168.1.254
Class CPrivée (RFC 1918) (Private Network (RFC 1918 Class C))
Matrice binaire de 32 bits
Bits réseau (24 bits)Bits hôtes (8 bits)
IP:
11000000
10101000
00000001
00000001
Masque de sous-réseau:
11111111
11111111
11111111
00000000

Découpage de sous-réseaux VLSM (/24)

Sous-réseaux découpés:
#Adresse réseau (ID)Plage d’hôtes utilisablesAdresse de diffusion (Broadcast)Hôtes exploitables
1192.168.1.0/26192.168.1.1 – 192.168.1.62192.168.1.6362
2192.168.1.64/26192.168.1.65 – 192.168.1.126192.168.1.12762
3192.168.1.128/26192.168.1.129 – 192.168.1.190192.168.1.19162
4192.168.1.192/26192.168.1.193 – 192.168.1.254192.168.1.25562
À propos du découpage en sous-réseaux, du CIDR et de la RFC 1918

Le routage CIDR supprime le partitionnement rigide en classes au profit de préfixes modulables. Le préfixe délimite les bits réseau face aux bits hôtes disponibles. Toutes les opérations de masque sont exécutées localement en mémoire via opérateurs bit à bit sans aucun transfert externe.

Comment Calculateur de Sous-Réseaux IPv4 / IPv6 et CIDR protège votre vie privée

Contrairement aux outils en ligne traditionnels qui téléchargent vos documents ou images sur des serveurs distants, MindLucid fonctionne à 100% dans votre navigateur.

  • Traitement Direct en Mémoire RAM: Les données sont traitées uniquement via les API Web natives (Canvas, Web Crypto, WebAssembly).
  • Zéro Télémétrie & Aucun Traçage: Aucun cookie de suivi, aucun journal serveur et aucune analyse de vos fichiers confidentiels.
  • Téléchargement Direct sur l’Appareil: Dès que le traitement est terminé, les fichiers sont créés localement sous forme de Blobs et enregistrés sur votre disque.
Sceau de Bac à Sable Client

Traitement 100% Fonctionnel Hors-Ligne

Vous pouvez couper votre connexion internet dès maintenant. Cet outil continuera de fonctionner parfaitement car le moteur d’exécution est déjà chargé dans votre navigateur.

Statut : 100% Isolé Côté Client

Comment Utiliser Calculateur de Sous-Réseaux IPv4 / IPv6 et CIDR (Guide pas à pas)

1

Saisie de l’adresse IP

Renseignez l’adresse IPv4.

2

Choix du préfixe

Ajustez le curseur CIDR de /0 à /32.

2,780 Words (Technical Handbook)~16 Min ReadRFC 4632 (CIDR) / RFC 791 (IPv4) / RFC 4291 (IPv6)

IPv4 & IPv6 Subnetting, Classless Inter-Domain Routing (CIDR) & VLSM Engineering Handbook

An exhaustive, production-grade architectural guide covering formal specifications, internal algorithmic execution, time and space complexity, multi-language code snippets, cryptographic security hardening, and real-world enterprise design patterns.

01
Specification Standards

Architectural Foundations, Address Space Exhaustion & Bitmasking Mechanics

Subnetting is the architectural division of a single physical or logical IP network into multiple smaller, independent sub-networks (subnets). Formalized under IETF RFC 4632 (Classless Inter-Domain Routing - CIDR) and RFC 950, subnetting is the foundational mechanism that prevents the global Internet routing table from collapsing under exponential growth. In legacy IPv4 networking (RFC 791, 1981), addresses were rigidly partitioned into arbitrary classes: Class A (/8, 16.7M hosts), Class B (/16, 65,536 hosts), and Class C (/24, 256 hosts). This rigid allocation caused catastrophic address space exhaustion: an organization requiring 300 IP addresses was forced to consume a full Class B block, wasting over 65,000 routable public IPv4 addresses.

In 1993, CIDR abolished class boundaries, introducing arbitrary variable-length bitmasks designated by a suffix notation (e.g., 192.168.1.0/26). An IPv4 address is an unsigned 32-bit integer typically expressed in dot-decimal notation across four 8-bit octets (e.g., 255.255.255.0). The subnet mask contains a contiguous sequence of binary 1s representing the Network Prefix, followed by a contiguous sequence of binary 0s representing the Host Identifier.

Modern enterprise network engineering relies heavily on Variable Length Subnet Masking (VLSM, RFC 1878). VLSM allows network architects to recursively partition an allocated address block into subnets of differing sizes to match physical host topologies (such as allocating a /30 or /31 point-to-point link between routers, while allocating /24 subnets to engineering clusters). In IPv6 (RFC 4291), the 128-bit address space expands available addresses to 3.4 × 10^38, with standard end-site subnets allocated as /64 blocks, containing 18.4 quintillion addresses per local subnet.

Historical Engineering Context

Introduced by Vince Fuller and the IETF in RFC 1519 (1993) to stave off the imminent exhaustion of the 32-bit IPv4 address pool, CIDR enabled prefix aggregation (supernetting) and scalable hierarchical BGP routing.

Standards & RFC Compliance:
IETF RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan
IETF RFC 791: Internet Protocol (IPv4 Specification)
IETF RFC 4291: IP Version 6 Addressing Architecture
IETF RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links
02
Algorithmic Mechanics

Bitwise Logical Operations, Wildcard Calculations & Host Ranges

Time Complexity

O(1) Constant Time - All conversions execute in a single CPU cycle via bitwise shifting and masking.

Space / Memory Complexity

O(1) Constant Space - Flat 32-bit or 128-bit integer registers.

Calculating an IPv4 subnet operates through fast bitwise 32-bit unsigned integer operations.

Step 1: IP to 32-bit Integer Conversion. The four octets [A, B, C, D] are packed into an unsigned 32-bit integer: ip32 = ((A << 24) | (B << 16) | (C << 8) | D) >>> 0. (The unsigned right shift >>> 0 is mandatory in JavaScript to avoid signed 32-bit negative integer representation).

Step 2: Subnet Mask Calculation from Prefix Length P (0 to 32). The bitmask is generated by shifting: mask32 = P === 0 ? 0 : (~0 << (32 - P)) >>> 0. The dotted decimal mask is extracted by taking each byte: [(mask >> 24) & 255, (mask >> 16) & 255, (mask >> 8) & 255, mask & 255].

Step 3: Network Address Calculation. The network address is computed using bitwise AND: network32 = (ip32 & mask32) >>> 0. This zeros out all host bits, yielding the base routing boundary.

Step 4: Wildcard Mask and Broadcast Address. The wildcard mask (used in Cisco ACLs and OSPF) is the bitwise NOT of the subnet mask: wildcard32 = (~mask32) >>> 0. The directed broadcast address is computed using bitwise OR: broadcast32 = (network32 | wildcard32) >>> 0.

Step 5: Usable Host Count and Range. The total addresses in the subnet is 2^(32 - P). In standard subnets (P ≤ 30), two addresses are reserved by RFC 791: the network identifier (all 0s in host portion) and the broadcast address (all 1s in host portion). Thus, usableHosts = 2^(32 - P) - 2. The first usable host is network32 + 1, and the last usable host is broadcast32 - 1. (Special exception: RFC 3021 defines /31 prefixes for point-to-point links with 2 usable hosts and zero broadcast overhead).

Core Data Structures & Memory Layout:
32-bit Unsigned Integer (Uint32)IPv6 128-bit BigInt / Uint8Array (16 bytes)Radix / Patricia Trie for routing table prefix lookups
03
Comparative Analysis

Common Subnet Prefix Reference & Host Allocations

CIDR PrefixSubnet MaskTotal AddressesUsable Usable HostsTypical Architecture Role
/24255.255.255.0256 addresses254 usable hostsStandard office LAN, default home Wi-Fi routers, small Kubernetes pod CIDRs.
/26255.255.255.19264 addresses62 usable hostsDepartmental subnetting; isolating database clusters from DMZ web tiers.
/28255.255.255.24016 addresses14 usable hostsSmall public server rack, isolated staging VPC subnets in AWS/GCP.
/30255.255.255.2524 addresses2 usable hostsLegacy router-to-router point-to-point serial links.
/31 (RFC 3021)255.255.255.2542 addresses2 usable hosts (zero broadcast)Modern data center leaf-spine router interconnects, eliminating address waste.
04
Production Code Blueprints

Multi-Language Implementation Blueprints

Full Bitwise IPv4 Subnet Calculator in TypeScript
// Exact 32-bit Bitwise Subnet Calculator adhering to RFC 4632 & RFC 3021
export interface SubnetInfo {
  cidr: string;
  networkAddress: string;
  broadcastAddress: string;
  subnetMask: string;
  wildcardMask: string;
  firstUsableHost: string;
  lastUsableHost: string;
  totalAddresses: number;
  usableHosts: number;
}

export function calculateSubnet(ipStr: string, prefix: number): SubnetInfo {
  if (prefix < 0 || prefix > 32) throw new Error('Prefix must be between 0 and 32.');

  const octets = ipStr.split('.').map(Number);
  if (octets.length !== 4 || octets.some((o) => isNaN(o) || o < 0 || o > 255)) {
    throw new Error('Invalid IPv4 address format.');
  }

  // Convert IP to 32-bit unsigned int
  const ip32 = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;

  // Mask and wildcard
  const mask32 = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;
  const wildcard32 = (~mask32) >>> 0;

  // Network and broadcast boundaries
  const network32 = (ip32 & mask32) >>> 0;
  const broadcast32 = (network32 | wildcard32) >>> 0;

  const intToIp = (val: number) =>
    [(val >>> 24) & 255, (val >>> 16) & 255, (val >>> 8) & 255, val & 255].join('.');

  const total = Math.pow(2, 32 - prefix);
  let usable = 0;
  let firstHost = '';
  let lastHost = '';

  if (prefix === 32) {
    usable = 1;
    firstHost = intToIp(network32);
    lastHost = intToIp(network32);
  } else if (prefix === 31) {
    // RFC 3021 point-to-point links
    usable = 2;
    firstHost = intToIp(network32);
    lastHost = intToIp(broadcast32);
  } else {
    usable = Math.max(0, total - 2);
    firstHost = intToIp(network32 + 1);
    lastHost = intToIp(broadcast32 - 1);
  }

  return {
    cidr: `${intToIp(network32)}/${prefix}`,
    networkAddress: intToIp(network32),
    broadcastAddress: intToIp(broadcast32),
    subnetMask: intToIp(mask32),
    wildcardMask: intToIp(wildcard32),
    firstUsableHost: firstHost,
    lastUsableHost: lastHost,
    totalAddresses: total,
    usableHosts: usable
  };
}

Technical Note: Uses bitwise operators and unsigned right-shifts to compute RFC-accurate network bounds and host ranges.

05
Vulnerability Analysis & Hardening

Subnet Boundary Breaches, Directed Broadcast Attacks & VPC Isolation

CWE-200: Information Disclosure via Subnet Misconfigurations & Smurf Attacks

Smurf Attack via Directed Broadcasts: In legacy networks, an attacker sends ICMP echo requests (ping) to a subnet directed broadcast address (e.g., 192.168.1.255) with a spoofed source IP address corresponding to the victim. Every host in the subnet responds simultaneously to the victim, multiplying traffic by 254x and causing massive Denial of Service. Modern routers block directed broadcasts by default (RFC 2644).

VPC Lateral Movement via Over-Permissive CIDRs: In cloud infrastructures (AWS VPC, GCP Virtual Private Cloud), architects who deploy databases inside large /16 subnets without network security groups enable compromised edge web servers to port-scan and laterally compromise internal database instances.

Overlapping Subnet Routing Collisions in VPNs: When two corporate networks merge or connect via IPsec VPN while both using the default 192.168.1.0/24 subnet, routing tables become ambiguous, causing packet drops and broken connections.

Mandatory Security Countermeasures & Defensive Best Practices:
Disable directed broadcast forwarding on all edge routers (no ip directed-broadcast in Cisco IOS).
Follow Zero Trust Network Architecture: segment VPCs into tightly bound /28 or /26 micro-subnets isolated by Network ACLs.
Use Carrier-Grade NAT (RFC 6598 100.64.0.0/10) or unique RFC 1918 allocations (10.x.x.x) to avoid overlapping subnet collisions in enterprise VPNs.
06
High-Scale Distributed Systems

Enterprise Case Study: Multi-Region Cloud Kubernetes Cluster Architecture (AWS EKS & VPC)

Problem Statement:

An enterprise scaling a Kubernetes cluster to 10,000 microservice pods ran out of IP addresses in their AWS VPC because the initial cluster was provisioned on a narrow /24 subnet (maximum 254 IP addresses), halting automated deployments.

Architectural Solution Architecture:
1
Re-architected the VPC using secondary CIDR blocks adhering to RFC 6598 (100.64.0.0/10) dedicated exclusively to Kubernetes pods.
2
Allocated /28 subnets to cluster control plane nodes and /19 subnets (8,190 IPs) across three availability zones for worker nodes.
3
Configured AWS VPC CNI with custom prefix delegation (/28 chunks per ENI), multiplying pod density per EC2 instance by 16x without depleting primary corporate IP pools.
Measured Impact: Supported scaling to 15,000 simultaneous pods with zero subnet exhaustion; reduced cross-zone networking latencies.
07
Boundary Conditions

Edge Cases, Pitfalls & Troubleshooting Matrix

Point-to-Point router links with /31 prefixes

Pitfall: Assuming all subnets lose 2 addresses to network and broadcast.

Consequence: Wasting 2 IP addresses on every router interconnect.

Engineering Solution: Implement RFC 3021 /31 subnets, which have zero broadcast addresses and provide exactly 2 usable host IPs.

Single Host /32 route entries

Pitfall: Attempting to calculate host ranges on a /32 prefix.

Consequence: Negative host count calculations or division-by-zero errors.

Engineering Solution: Treat /32 as a specific host route with exactly 1 total and usable address, where network and host are identical.

Classful assumptions in legacy software

Pitfall: Legacy accounting software assuming 10.x.x.x is always a /8 network.

Consequence: Incorrect subnet routing when 10.x.x.x is actually partitioned into /24 subnets.

Engineering Solution: Ensure all software explicitly configures CIDR prefixes rather than relying on automated classful deduction.

Bitwise signed integer overflow in 32-bit JavaScript

Pitfall: Performing (192 << 24) in JavaScript evaluates to a negative signed 32-bit number (-1073741824).

Consequence: Corrupt dotted decimal strings when formatting network addresses.

Engineering Solution: Always apply unsigned right shift (>>> 0) to force numbers into unsigned 32-bit integer ranges.

08
Engineering Knowledge Base

Deep Technical FAQs & Architectural Queries

What is the purpose of subnetting?
Subnetting breaks a large network into smaller, manageable, and secure subnetworks. It improves network performance by confining local broadcast traffic to individual subnets, enhances security by allowing firewalls and Access Control Lists (ACLs) to isolate sensitive servers (like databases) from public internet traffic, and conserves scarce IPv4 addresses by matching subnet sizes to actual host counts.
What do the numbers in CIDR notation (like /24) mean?
The number after the slash (e.g., /24) represents the prefix length—the number of consecutive binary 1s in the subnet mask. An IPv4 address has 32 bits total. A /24 prefix means the first 24 bits belong to the network identifier, leaving 8 bits (32 - 24 = 8) for host devices. With 8 bits, you have 2^8 = 256 total IP addresses, of which 254 are usable for computers and servers.
Why are two addresses subtracted from the usable host count in a subnet?
By internet standard (RFC 791), the very first address in a subnet (where all host bits are binary 0s) is reserved as the Network Address that identifies the subnet itself in router routing tables. The very last address (where all host bits are binary 1s) is reserved as the Directed Broadcast Address, used to broadcast packets to all devices on that local subnet simultaneously. Neither can be assigned to an individual computer.
What are the RFC 1918 Private IP Address ranges?
RFC 1918 reserves three blocks of IPv4 addresses for private local networks that are not routable on the public Internet: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8, 16.7 million IPs); 172.16.0.0 to 172.31.255.255 (172.16.0.0/12, 1 million IPs); and 192.168.0.0 to 192.168.255.255 (192.168.0.0/16, 65,536 IPs). Devices on private IPs access the Internet via Network Address Translation (NAT).
What is VLSM (Variable Length Subnet Masking)?
VLSM is the practice of dividing an allocated IP space into subnets of different sizes to match the exact requirements of different departments or links. For example, rather than assigning a large /24 subnet (254 hosts) to an office branch with only 10 computers, an engineer can assign a /28 subnet (14 hosts), preserving the remaining addresses for other uses.
What is a Wildcard Mask and where is it used?
A wildcard mask is the exact bitwise inverse of a subnet mask (wildcard = ~netmask). For example, a subnet mask of 255.255.255.0 has a wildcard mask of 0.0.0.255. Wildcard masks are used primarily in Cisco router Access Control Lists (ACLs) and routing protocols like OSPF to indicate which bits of an IP address must match (0 = must match, 1 = ignore).
How does IPv6 subnetting differ from IPv4?
IPv6 uses 128-bit addresses (compared to 32 bits in IPv4), eliminating the need for complex conservation subnetting. The standard allocation for any local IPv6 network or VLAN is a /64 prefix. A single /64 subnet contains 2^64 (approximately 18.4 quintillion) addresses—more than four billion times the entire IPv4 Internet. In IPv6, broadcast addresses do not exist; multicast is used instead.
What is a /31 subnet and can it really have zero broadcast addresses?
Yes. Standardized under RFC 3021, a /31 subnet uses a 31-bit mask (255.255.255.254), providing exactly two IP addresses. Designed specifically for point-to-point router links where only two interfaces exist, RFC 3021 eliminates the traditional network and broadcast address reservations, allowing both addresses to be assigned to the router interfaces and preventing massive address waste.