Host bits set
10.0.0.5/24 is not a network address, and tools disagree about what it means
10.0.0.5/24
VPC Subnet & CIDR Calculator
Paste one CIDR block or your whole allocation table. Get the network, broadcast, masks and usable host counts, including the AWS figure that is five lower than the standard one, plus a check for overlaps between everything you pasted.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Calculate. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
One range inside another
An overlap that a route table or security group will resolve by specificity, not by order
10.0.0.0/16 10.0.1.0/24
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Writing a CIDR with host bits set
10.0.0.5/24 is not a network address. Some tools silently mask it to 10.0.0.0/24, some reject it, and some treat it as a host route.
Instead:Write the network address, 10.0.0.0/24, and let the tool tell you the usable range.
Expecting AWS to give you all the addresses
AWS reserves five addresses in every subnet: network, VPC router, DNS, future use, and broadcast. A /28 gives eleven usable addresses, not sixteen.
Instead:Size subnets with the five reserved addresses subtracted.
Overlapping ranges across VPCs you may later peer
VPC peering and transit gateways refuse overlapping CIDRs, and the discovery usually happens at the moment two teams need to connect.
Instead:Allocate from one plan up front, even for environments that seem unrelated.
What it checks
Any calculator can divide by two. The parts worth having are the rules that make a block usable in a real VPC, and the overlap check you can only run when you paste the whole plan at once.
The arithmetic, both ways
Network, broadcast, netmask, wildcard mask, host range and total addresses. Usable hosts are given twice: the standard figure, and the AWS one, which is five lower because AWS reserves the first four addresses and the last in every subnet. A /28 has 11 usable addresses, not 16, and that catches people out.
Overlap detection
Paste a whole allocation table and every pair is checked. Two networks that overlap can never be peered, joined by a transit gateway, or reached across a VPN at the same time, and the only fix once they exist is to rebuild one. Nesting is reported separately, since a subnet inside its VPC is correct.
Host bits left set
10.0.0.1/24 is a host, not a block. Every cloud provider rejects it, Terraform passes it straight through, so the failure lands at apply time. The canonical form is shown next to what you wrote.
Ranges that are legal and still wrong
172.31.0.0/16 is the AWS default VPC in every region, so anything there can never be peered with a default VPC. 172.17.0.0/16 is Docker's default bridge, which produces intermittent host-specific connectivity failures. Both are private, both look fine, both cause trouble later.
Provider limits
A VPC cannot be larger than /16 or a subnet smaller than /28 on any major cloud. Link-local is flagged specially because 169.254.169.254 is the instance metadata endpoint, so a VPC there breaks credential retrieval.
How it splits
For each block, the next three prefix lengths with how many subnets that gives and how many usable addresses each. This is the question immediately after 'how big is it', and it is the one that decides your AZ layout.
What is CIDR, and how is a block calculated?
CIDR: Classless Inter-Domain Routing: replaced the old class A, B and C networks in 1993. The idea behind it is small: instead of fixed-size networks, you say how many bits at the front of the address are fixed, and everything after them is yours to hand out.
The slash is a count of fixed bits
An IPv4 address is 32 bits, written as four bytes so humans can read it. The number after the slash says how many of those bits are the network part, identical for every address in the block. Whatever is left over are host bits, free to take any value. That is the whole of the notation: /24 fixes 24 bits and leaves 8, /20 fixes 20 and leaves 12.
10.0.0.0/20 in binary
00001010 00000000 0000 0000 00000000
|______________________| |_____________|
20 network bits 12 host bits
identical for every 2^12 = 4,096
address in the block possible valuesWorking out the range
Set every host bit to zero and you have the network address, which is the first address in the block. Set every host bit to one and you have the broadcast address, the last one. That is the entire calculation: there is no lookup table and nothing to memorise, which is why the same arithmetic works for any prefix length.
10.0.0.0/20
netmask 255.255.240.0 20 ones, then 12 zeros
network 10.0.0.0 host bits all 0 -> first address
broadcast 10.0.15.255 host bits all 1 -> last address
range 10.0.0.0 to 10.0.15.255
addresses 2^12 = 4,096How many addresses you actually get
The total is 2 to the power of the host bits. Two of those are never usable on a normal network: the network address itself and the broadcast address. In a cloud VPC subtract five instead of two, because AWS, Azure and GCP each reserve three more in every subnet for the router, DNS and future use. This is the step that catches people out: a /28 gives you eleven usable addresses, not sixteen.
prefix total usable usable
(standard) (AWS / Azure / GCP)
/16 65,536 65,534 65,531
/20 4,096 4,094 4,091
/24 256 254 251
/26 64 62 59
/28 16 14 11 <- smallest AWS allowsWhy two blocks can never partly overlap
Because the network address has zeros in every host bit, a block always begins on a multiple of its own size, and its length is always a power of two. Two ranges shaped like that either miss each other completely or one sits wholly inside the other. A partial overlap is arithmetically impossible, which is why the checker above reports containment rather than a percentage, and why a subnet inside its VPC is the only kind of intersection there is.
10.0.0.0/16 covers 10.0.0.0 to 10.0.255.255
10.0.1.0/24 covers 10.0.1.0 to 10.0.1.255
entirely inside the /16 above
192.168.0.0/16 covers 192.168.0.0 to 192.168.255.255
no intersection at all
there is no third caseChoosing a size in the cloud
A VPC is usually a /16. That is not because it is needed: it is 65,536 addresses, but because the space costs nothing in private ranges and renumbering a running VPC means rebuilding it. Subnets are commonly a /24 per tier per availability zone. Go smaller only on purpose: EKS assigns pod IPs from the subnet, so one busy node can exhaust a /28 by itself. AWS accepts VPC prefixes from /16 to /28 and nothing either side of that.
Overlaps are permanent
Almost every mistake in cloud infrastructure is a config change away from being fixed. Address ranges are the exception. Two VPCs whose CIDRs overlap cannot be peered, cannot both be reached over the same VPN, and cannot be joined by a transit gateway, and no setting anywhere changes that.
The fix is to renumber one of them, which means new subnets, new route tables, and moving every running workload. Teams put it off for years, and it usually surfaces at the worst moment: during an acquisition, or the week a partner integration is due.
The check costs nothing while the ranges are still lines in a config file. That is the entire argument for pasting the whole table here rather than one block at a time.
More general tools
Cron Expression Explainer What it means, and when it next runs VPC Subnet Planner Lay out the whole VPC at once Cron Expression Generator Pick a schedule, get the expression