IP / CIDR Range Checker

How a CIDR match works

A CIDR block such as 10.0.32.0/20 means "every address whose first 20 bits equal those of 10.0.32.0". To test an address, the checker masks off the host bits and compares what is left, exactly like a router or firewall does. Under the hood each address is a number (32 bits for IPv4, 128 bits for IPv6, handled here with JavaScript BigInt), and a block is simply the inclusive range from its network address to its last address: 10.0.32.0 to 10.0.47.255 in this case.

When an address matches several ranges, the most specific one (the longest prefix) is listed first. That is the rule routers use to pick a route, and it's how AWS route tables decide between a 10.0.0.0/16 local route and a more specific 10.0.32.0/20 route to a peering connection.

Common use cases

• Security groups and firewall rules. Check which of your servers, VPN users or partner IPs a rule like 203.0.113.0/24 really covers before you deploy it.
• Allowlists and blocklists. Paste the client IPs from a log file and your allowlist to see which requests would have been blocked, or whether an IP from an abuse report belongs to a cloud provider's published range.
• VPC peering and Transit Gateway. AWS refuses to peer two VPCs whose CIDR blocks overlap, and overlapping on-premises ranges make VPN routing ambiguous. Paste every VPC, subnet and office network into the ranges box to spot conflicts early.
• Subnet audits. Confirm that subnets really sit inside their VPC block, and that no two subnets claim the same space.
• Turning ranges into rules. Many tools only accept CIDR notation. The range converter turns "10.0.0.5 to 10.0.1.130" into the smallest exact set of blocks, ready for a security group or iptables.

Overlapping CIDR ranges

Two CIDR blocks are either completely separate or one contains the other; they can never partially overlap, because both are aligned on powers of two. So an "overlap" is always one of: the same block listed twice, or a larger block containing a smaller one (10.0.0.0/16 contains 10.0.32.0/20). Inside a single VPC that nesting is expected for subnets, but between two VPCs, or between a VPC and your office network, it means traffic cannot be routed unambiguously, and AWS VPC peering will reject the connection.

Input tips

• A bare address in the ranges box counts as a single host (/32 for IPv4, /128 for IPv6).
• Anything after the range on the same line is used as its label; text after # is treated as a comment label too.
• A block written with host bits set, such as 192.168.1.10/24, is accepted and normalised to its network address (192.168.1.0/24) with a warning, because most cloud consoles reject that form.
• You can put a CIDR block in the IP list too: it shows as inside when the whole block fits in a range, and partial when only part of it does.

IPv6 notes

An IPv6 address is 128 bits written as eight groups of four hex digits. Leading zeros in a group can be dropped, and one run of all-zero groups can be replaced with ::, so 2001:0db8:0000:0000:0000:0000:0000:0001 is the same as 2001:db8::1. The checker accepts any valid spelling, including upper case, zone IDs such as fe80::1%eth0 (the zone is ignored) and bracketed forms like [2001:db8::1], and shows the canonical RFC 5952 form next to anything written differently.

IPv4-mapped addresses (::ffff:192.0.2.1) are how dual-stack servers report IPv4 clients on an IPv6 socket, so they often turn up in application logs. With the option above switched on they are matched against IPv4 ranges as the IPv4 address they represent. Typical IPv6 allocations: AWS gives a VPC a /56 and each subnet a /64; 2001:db8::/32 is reserved for documentation, fc00::/7 is unique local (the IPv6 equivalent of private ranges) and fe80::/10 is link-local.