ML
MindLucid纯前端本地运行
技术博客
网络与隐私诊断
零服务器上传(纯前端本地处理)
本地执行引擎: Browser Web API

IPv4 / IPv6 子网掩码与 CIDR 计算器

在浏览器内存中快速进行位运算子网计算。即时计算 CIDR 前缀(/0 至 /32)、可用主机池、网络号、反掩码及 VLSM 多级子网切分,100% 离线计算。

网络前缀: /240-32 bits
常用规格:
网络地址 (Network ID)
192.168.1.0
CIDR: /24
广播地址 (Broadcast)
192.168.1.255
反掩码 (Wildcard): 0.0.0.255
子网掩码 (Netmask)
255.255.255.0
0xFFFFFF00
可用主机容量
254总 IP 容量: 256
2 reserved
可用主机地址池
192.168.1.1192.168.1.254
Class C私网专用 (RFC 1918) (Private Network (RFC 1918 Class C))
32 位二进制位矩阵
网络位 (24 bits)主机位 (8 bits)
IP:
11000000
10101000
00000001
00000001
子网掩码 (Netmask):
11111111
11111111
11111111
00000000

VLSM 多级子网切分方案 (/24)

切分子网详情:
#网络地址 (Network ID)可用主机地址池广播地址 (Broadcast)可用主机容量
1192.168.1.0/26192.168.1.1 – 192.168.1.62192.168.1.6362
2192.168.1.64/26192.168.1.65 – 192.168.1.126192.168.1.12762
3192.168.1.128/26192.168.1.129 – 192.168.1.190192.168.1.19162
4192.168.1.192/26192.168.1.193 – 192.168.1.254192.168.1.25562
关于子网划分、CIDR 掩码与 RFC 1918 私有网段规范

CIDR(无类域间路由)打破了传统固定分类方式,允许任意长度的前缀掩码。前缀长度决定了网络路由位,其余位分配给独立主机设备。本工具所有网段运算均在浏览器内存中采用 32 位位运算符毫秒级本地计算,完全不涉及后端网络交互。

IPv4 / IPv6 子网掩码与 CIDR 计算器 如何保护您的隐私安全?

与将您的敏感文件或图片上传到不可信远程服务器的传统在线工具不同,MindLucid 100% 在您本地浏览器安全沙箱内执行。

  • 纯内存极速解析: 数据仅通过原生 Web API(HTML5 Canvas、Web Crypto、WebAssembly)在本地 RAM 中读取。
  • 零追踪与遥测监控: 无跟踪 Cookie,无服务器日志记录,更绝无对您机密文件属性的扫描或收集。
  • 瞬时本地生成与保存: 处理完成后,数据将在本地直接生成为 Blob 对象并即时保存至您的设备存储中。
客户端沙箱认证

100% 离线可用处理

您可以立即断开网络连接,此工具依然能够正常运行,因为所有的执行代码已完整加载至您的浏览器中。

状态:纯前端安全沙箱已验证

IPv4 / IPv6 子网掩码与 CIDR 计算器 使用指南(图文步骤)

1

输入 IPv4 地址

输入标准 IP 地址,亦可包含掩码(如 10.0.0.1/24)。

2

调整 CIDR 前缀

通过拖动滑块在 /0 至 /32 之间自由切换。

3

查看二进制图解

直观查看网络位(高位)与主机位(低位)的位图分布。

4

VLSM 多级子网切分

一键将现有网络切分为多组小型子网并复制清单。

2,780 Words (Technical Handbook)~16 Min ReadRFC 4632 (CIDR) / RFC 791 (IPv4) / RFC 4291 (IPv6)

IPv4 & IPv6 Subnetting, Classless Inter-Domain Routing (CIDR) & VLSM Engineering Handbook

An exhaustive, production-grade architectural guide covering formal specifications, internal algorithmic execution, time and space complexity, multi-language code snippets, cryptographic security hardening, and real-world enterprise design patterns.

01
Specification Standards

Architectural Foundations, Address Space Exhaustion & Bitmasking Mechanics

Subnetting is the architectural division of a single physical or logical IP network into multiple smaller, independent sub-networks (subnets). Formalized under IETF RFC 4632 (Classless Inter-Domain Routing - CIDR) and RFC 950, subnetting is the foundational mechanism that prevents the global Internet routing table from collapsing under exponential growth. In legacy IPv4 networking (RFC 791, 1981), addresses were rigidly partitioned into arbitrary classes: Class A (/8, 16.7M hosts), Class B (/16, 65,536 hosts), and Class C (/24, 256 hosts). This rigid allocation caused catastrophic address space exhaustion: an organization requiring 300 IP addresses was forced to consume a full Class B block, wasting over 65,000 routable public IPv4 addresses.

In 1993, CIDR abolished class boundaries, introducing arbitrary variable-length bitmasks designated by a suffix notation (e.g., 192.168.1.0/26). An IPv4 address is an unsigned 32-bit integer typically expressed in dot-decimal notation across four 8-bit octets (e.g., 255.255.255.0). The subnet mask contains a contiguous sequence of binary 1s representing the Network Prefix, followed by a contiguous sequence of binary 0s representing the Host Identifier.

Modern enterprise network engineering relies heavily on Variable Length Subnet Masking (VLSM, RFC 1878). VLSM allows network architects to recursively partition an allocated address block into subnets of differing sizes to match physical host topologies (such as allocating a /30 or /31 point-to-point link between routers, while allocating /24 subnets to engineering clusters). In IPv6 (RFC 4291), the 128-bit address space expands available addresses to 3.4 × 10^38, with standard end-site subnets allocated as /64 blocks, containing 18.4 quintillion addresses per local subnet.

Historical Engineering Context

Introduced by Vince Fuller and the IETF in RFC 1519 (1993) to stave off the imminent exhaustion of the 32-bit IPv4 address pool, CIDR enabled prefix aggregation (supernetting) and scalable hierarchical BGP routing.

Standards & RFC Compliance:
IETF RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan
IETF RFC 791: Internet Protocol (IPv4 Specification)
IETF RFC 4291: IP Version 6 Addressing Architecture
IETF RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links
02
Algorithmic Mechanics

Bitwise Logical Operations, Wildcard Calculations & Host Ranges

Time Complexity

O(1) Constant Time - All conversions execute in a single CPU cycle via bitwise shifting and masking.

Space / Memory Complexity

O(1) Constant Space - Flat 32-bit or 128-bit integer registers.

Calculating an IPv4 subnet operates through fast bitwise 32-bit unsigned integer operations.

Step 1: IP to 32-bit Integer Conversion. The four octets [A, B, C, D] are packed into an unsigned 32-bit integer: ip32 = ((A << 24) | (B << 16) | (C << 8) | D) >>> 0. (The unsigned right shift >>> 0 is mandatory in JavaScript to avoid signed 32-bit negative integer representation).

Step 2: Subnet Mask Calculation from Prefix Length P (0 to 32). The bitmask is generated by shifting: mask32 = P === 0 ? 0 : (~0 << (32 - P)) >>> 0. The dotted decimal mask is extracted by taking each byte: [(mask >> 24) & 255, (mask >> 16) & 255, (mask >> 8) & 255, mask & 255].

Step 3: Network Address Calculation. The network address is computed using bitwise AND: network32 = (ip32 & mask32) >>> 0. This zeros out all host bits, yielding the base routing boundary.

Step 4: Wildcard Mask and Broadcast Address. The wildcard mask (used in Cisco ACLs and OSPF) is the bitwise NOT of the subnet mask: wildcard32 = (~mask32) >>> 0. The directed broadcast address is computed using bitwise OR: broadcast32 = (network32 | wildcard32) >>> 0.

Step 5: Usable Host Count and Range. The total addresses in the subnet is 2^(32 - P). In standard subnets (P ≤ 30), two addresses are reserved by RFC 791: the network identifier (all 0s in host portion) and the broadcast address (all 1s in host portion). Thus, usableHosts = 2^(32 - P) - 2. The first usable host is network32 + 1, and the last usable host is broadcast32 - 1. (Special exception: RFC 3021 defines /31 prefixes for point-to-point links with 2 usable hosts and zero broadcast overhead).

Core Data Structures & Memory Layout:
32-bit Unsigned Integer (Uint32)IPv6 128-bit BigInt / Uint8Array (16 bytes)Radix / Patricia Trie for routing table prefix lookups
03
Comparative Analysis

Common Subnet Prefix Reference & Host Allocations

CIDR PrefixSubnet MaskTotal AddressesUsable Usable HostsTypical Architecture Role
/24255.255.255.0256 addresses254 usable hostsStandard office LAN, default home Wi-Fi routers, small Kubernetes pod CIDRs.
/26255.255.255.19264 addresses62 usable hostsDepartmental subnetting; isolating database clusters from DMZ web tiers.
/28255.255.255.24016 addresses14 usable hostsSmall public server rack, isolated staging VPC subnets in AWS/GCP.
/30255.255.255.2524 addresses2 usable hostsLegacy router-to-router point-to-point serial links.
/31 (RFC 3021)255.255.255.2542 addresses2 usable hosts (zero broadcast)Modern data center leaf-spine router interconnects, eliminating address waste.
04
Production Code Blueprints

Multi-Language Implementation Blueprints

Full Bitwise IPv4 Subnet Calculator in TypeScript
// Exact 32-bit Bitwise Subnet Calculator adhering to RFC 4632 & RFC 3021
export interface SubnetInfo {
  cidr: string;
  networkAddress: string;
  broadcastAddress: string;
  subnetMask: string;
  wildcardMask: string;
  firstUsableHost: string;
  lastUsableHost: string;
  totalAddresses: number;
  usableHosts: number;
}

export function calculateSubnet(ipStr: string, prefix: number): SubnetInfo {
  if (prefix < 0 || prefix > 32) throw new Error('Prefix must be between 0 and 32.');

  const octets = ipStr.split('.').map(Number);
  if (octets.length !== 4 || octets.some((o) => isNaN(o) || o < 0 || o > 255)) {
    throw new Error('Invalid IPv4 address format.');
  }

  // Convert IP to 32-bit unsigned int
  const ip32 = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;

  // Mask and wildcard
  const mask32 = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;
  const wildcard32 = (~mask32) >>> 0;

  // Network and broadcast boundaries
  const network32 = (ip32 & mask32) >>> 0;
  const broadcast32 = (network32 | wildcard32) >>> 0;

  const intToIp = (val: number) =>
    [(val >>> 24) & 255, (val >>> 16) & 255, (val >>> 8) & 255, val & 255].join('.');

  const total = Math.pow(2, 32 - prefix);
  let usable = 0;
  let firstHost = '';
  let lastHost = '';

  if (prefix === 32) {
    usable = 1;
    firstHost = intToIp(network32);
    lastHost = intToIp(network32);
  } else if (prefix === 31) {
    // RFC 3021 point-to-point links
    usable = 2;
    firstHost = intToIp(network32);
    lastHost = intToIp(broadcast32);
  } else {
    usable = Math.max(0, total - 2);
    firstHost = intToIp(network32 + 1);
    lastHost = intToIp(broadcast32 - 1);
  }

  return {
    cidr: `${intToIp(network32)}/${prefix}`,
    networkAddress: intToIp(network32),
    broadcastAddress: intToIp(broadcast32),
    subnetMask: intToIp(mask32),
    wildcardMask: intToIp(wildcard32),
    firstUsableHost: firstHost,
    lastUsableHost: lastHost,
    totalAddresses: total,
    usableHosts: usable
  };
}

Technical Note: Uses bitwise operators and unsigned right-shifts to compute RFC-accurate network bounds and host ranges.

05
Vulnerability Analysis & Hardening

Subnet Boundary Breaches, Directed Broadcast Attacks & VPC Isolation

CWE-200: Information Disclosure via Subnet Misconfigurations & Smurf Attacks

Smurf Attack via Directed Broadcasts: In legacy networks, an attacker sends ICMP echo requests (ping) to a subnet directed broadcast address (e.g., 192.168.1.255) with a spoofed source IP address corresponding to the victim. Every host in the subnet responds simultaneously to the victim, multiplying traffic by 254x and causing massive Denial of Service. Modern routers block directed broadcasts by default (RFC 2644).

VPC Lateral Movement via Over-Permissive CIDRs: In cloud infrastructures (AWS VPC, GCP Virtual Private Cloud), architects who deploy databases inside large /16 subnets without network security groups enable compromised edge web servers to port-scan and laterally compromise internal database instances.

Overlapping Subnet Routing Collisions in VPNs: When two corporate networks merge or connect via IPsec VPN while both using the default 192.168.1.0/24 subnet, routing tables become ambiguous, causing packet drops and broken connections.

Mandatory Security Countermeasures & Defensive Best Practices:
Disable directed broadcast forwarding on all edge routers (no ip directed-broadcast in Cisco IOS).
Follow Zero Trust Network Architecture: segment VPCs into tightly bound /28 or /26 micro-subnets isolated by Network ACLs.
Use Carrier-Grade NAT (RFC 6598 100.64.0.0/10) or unique RFC 1918 allocations (10.x.x.x) to avoid overlapping subnet collisions in enterprise VPNs.
06
High-Scale Distributed Systems

Enterprise Case Study: Multi-Region Cloud Kubernetes Cluster Architecture (AWS EKS & VPC)

Problem Statement:

An enterprise scaling a Kubernetes cluster to 10,000 microservice pods ran out of IP addresses in their AWS VPC because the initial cluster was provisioned on a narrow /24 subnet (maximum 254 IP addresses), halting automated deployments.

Architectural Solution Architecture:
1
Re-architected the VPC using secondary CIDR blocks adhering to RFC 6598 (100.64.0.0/10) dedicated exclusively to Kubernetes pods.
2
Allocated /28 subnets to cluster control plane nodes and /19 subnets (8,190 IPs) across three availability zones for worker nodes.
3
Configured AWS VPC CNI with custom prefix delegation (/28 chunks per ENI), multiplying pod density per EC2 instance by 16x without depleting primary corporate IP pools.
Measured Impact: Supported scaling to 15,000 simultaneous pods with zero subnet exhaustion; reduced cross-zone networking latencies.
07
Boundary Conditions

Edge Cases, Pitfalls & Troubleshooting Matrix

Point-to-Point router links with /31 prefixes

Pitfall: Assuming all subnets lose 2 addresses to network and broadcast.

Consequence: Wasting 2 IP addresses on every router interconnect.

Engineering Solution: Implement RFC 3021 /31 subnets, which have zero broadcast addresses and provide exactly 2 usable host IPs.

Single Host /32 route entries

Pitfall: Attempting to calculate host ranges on a /32 prefix.

Consequence: Negative host count calculations or division-by-zero errors.

Engineering Solution: Treat /32 as a specific host route with exactly 1 total and usable address, where network and host are identical.

Classful assumptions in legacy software

Pitfall: Legacy accounting software assuming 10.x.x.x is always a /8 network.

Consequence: Incorrect subnet routing when 10.x.x.x is actually partitioned into /24 subnets.

Engineering Solution: Ensure all software explicitly configures CIDR prefixes rather than relying on automated classful deduction.

Bitwise signed integer overflow in 32-bit JavaScript

Pitfall: Performing (192 << 24) in JavaScript evaluates to a negative signed 32-bit number (-1073741824).

Consequence: Corrupt dotted decimal strings when formatting network addresses.

Engineering Solution: Always apply unsigned right shift (>>> 0) to force numbers into unsigned 32-bit integer ranges.

08
Engineering Knowledge Base

Deep Technical FAQs & Architectural Queries

What is the purpose of subnetting?
Subnetting breaks a large network into smaller, manageable, and secure subnetworks. It improves network performance by confining local broadcast traffic to individual subnets, enhances security by allowing firewalls and Access Control Lists (ACLs) to isolate sensitive servers (like databases) from public internet traffic, and conserves scarce IPv4 addresses by matching subnet sizes to actual host counts.
What do the numbers in CIDR notation (like /24) mean?
The number after the slash (e.g., /24) represents the prefix length—the number of consecutive binary 1s in the subnet mask. An IPv4 address has 32 bits total. A /24 prefix means the first 24 bits belong to the network identifier, leaving 8 bits (32 - 24 = 8) for host devices. With 8 bits, you have 2^8 = 256 total IP addresses, of which 254 are usable for computers and servers.
Why are two addresses subtracted from the usable host count in a subnet?
By internet standard (RFC 791), the very first address in a subnet (where all host bits are binary 0s) is reserved as the Network Address that identifies the subnet itself in router routing tables. The very last address (where all host bits are binary 1s) is reserved as the Directed Broadcast Address, used to broadcast packets to all devices on that local subnet simultaneously. Neither can be assigned to an individual computer.
What are the RFC 1918 Private IP Address ranges?
RFC 1918 reserves three blocks of IPv4 addresses for private local networks that are not routable on the public Internet: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8, 16.7 million IPs); 172.16.0.0 to 172.31.255.255 (172.16.0.0/12, 1 million IPs); and 192.168.0.0 to 192.168.255.255 (192.168.0.0/16, 65,536 IPs). Devices on private IPs access the Internet via Network Address Translation (NAT).
What is VLSM (Variable Length Subnet Masking)?
VLSM is the practice of dividing an allocated IP space into subnets of different sizes to match the exact requirements of different departments or links. For example, rather than assigning a large /24 subnet (254 hosts) to an office branch with only 10 computers, an engineer can assign a /28 subnet (14 hosts), preserving the remaining addresses for other uses.
What is a Wildcard Mask and where is it used?
A wildcard mask is the exact bitwise inverse of a subnet mask (wildcard = ~netmask). For example, a subnet mask of 255.255.255.0 has a wildcard mask of 0.0.0.255. Wildcard masks are used primarily in Cisco router Access Control Lists (ACLs) and routing protocols like OSPF to indicate which bits of an IP address must match (0 = must match, 1 = ignore).
How does IPv6 subnetting differ from IPv4?
IPv6 uses 128-bit addresses (compared to 32 bits in IPv4), eliminating the need for complex conservation subnetting. The standard allocation for any local IPv6 network or VLAN is a /64 prefix. A single /64 subnet contains 2^64 (approximately 18.4 quintillion) addresses—more than four billion times the entire IPv4 Internet. In IPv6, broadcast addresses do not exist; multicast is used instead.
What is a /31 subnet and can it really have zero broadcast addresses?
Yes. Standardized under RFC 3021, a /31 subnet uses a 31-bit mask (255.255.255.254), providing exactly two IP addresses. Designed specifically for point-to-point router links where only two interfaces exist, RFC 3021 eliminates the traditional network and broadcast address reservations, allowing both addresses to be assigned to the router interfaces and preventing massive address waste.