1
Enter the IP Address to Check
Type the IPv4 address (e.g. 192.0.2.1) or IPv6 address (e.g. 2001:db8::1) in the IP Address field.
IP CIDR Checker |
Enter any IPv4 or IPv6 address and a CIDR block to check whether the IP belongs to the subnet — result is instant.
IPv4 (e.g. 192.0.2.1) or IPv6 (e.g. 2001:db8::1)
Network/prefix (e.g. 192.0.2.0/24 or 2001:db8::/32)
More Tools
IP Address Validator
Subnet Calculator
IP Range to CIDR Converter
Is This a Public or Private IP?
IPv4 Class Checker
What Is an IP CIDR Checker?
IP CIDR checker determines whether an IPv4 or IPv6 address belongs to a specified CIDR block
by comparing the network portions of both addresses. CIDR notation (Classless Inter-Domain Routing,
RFC 4632) represents a subnet as a network address followed by a prefix length —
for example, 10.0.0.0/8 — where the prefix defines how many leading bits identify the network.
An IP address is inside the block when its network bits match the CIDR's network bits exactly.
The check supports any IPv4 prefix (/0–/32) and any IPv6 prefix (/0–/128).
IP CIDR Checker — Check Whether an IPv4 or IPv6 Address Falls Inside a CIDR Subnet Block
Enter an IP address and a CIDR block to instantly verify whether the IP belongs to that subnet — supports IPv4 and IPv6, any prefix length.
2
Enter the CIDR Block
Type the CIDR range in the CIDR Range field using network/prefix notation — for example, 192.0.2.0/24 for IPv4 or 2001:db8::/32 for IPv6.
3
Click Check Range
Click the Check Range button. The tool shifts both addresses right by the host-bit count and compares the resulting network portions.
4
Read the Result
MATCH means the IP falls inside the subnet. NO MATCH means it is outside. The IP and CIDR must use the same protocol — IPv4 with IPv4, IPv6 with IPv6.
CIDR Notation Reference
CIDR notation encodes both the network address and the prefix length in a single string. The prefix length determines the size of the subnet and therefore which IP addresses fall inside the block.
| CIDR Block | Prefix | Network Bits | Host Range | Total Addresses |
|---|---|---|---|---|
192.168.1.0/24 |
/24 | 24 bits fixed, 8 bits host | 192.168.1.0–192.168.1.255 | 256 |
10.0.0.0/8 |
/8 | 8 bits fixed, 24 bits host | 10.0.0.0–10.255.255.255 | ~16.7 million |
203.0.113.0/30 |
/30 | 30 bits fixed, 2 bits host | 203.0.113.0–203.0.113.3 | 4 |
2001:db8::/32 |
/32 | 32 bits fixed, 96 bits host | 2001:db8::0–2001:db8:ffff:… | 296 |
How the CIDR Membership Check Works
CIDR membership testing uses bit-shift arithmetic — the same algorithm used by operating system TCP/IP stacks, routing tables, and firewall ACL engines.
For a /24 IPv4 check: both the target IP and the CIDR network address are right-shifted
by 8 bits (32 − 24 = 8), discarding the host portion. If the resulting 24-bit integers
are equal, the IP is inside the block. For 192.0.2.5 against 192.0.2.0/24:
192.0.2.5 >> 8 = 12648450 and 192.0.2.0 >> 8 = 12648450 — MATCH.
For IPv6, the comparison uses JavaScript BigInt to handle the full 128-bit address space
without overflow. The tool accepts :: compressed notation and expands the elided groups
before computing the shift. All processing runs in the browser — no data leaves the device.
Common Uses for IP CIDR Checking
Firewall and ACL validation. Before committing a CIDR-based allow or deny rule to a production firewall, confirm that specific known IPs produce the expected result. A /30 misconfigured as /29 doubles the allowed range — validating against representative addresses before deployment catches this without a live incident.
Cloud security group debugging. AWS, GCP, and Azure security groups express permitted source ranges in CIDR notation. When a client IP that should be permitted is being blocked, confirming whether that IP actually falls inside the configured CIDR range isolates whether the issue is the CIDR definition or another policy.
Log analysis and IP attribution. A sysadmin reviewing access logs needs to determine whether a source IP belongs to an internal corporate range, a cloud provider subnet, or an external network. Checking the IP against known CIDR blocks for each segment identifies the traffic origin without a full WHOIS lookup.
Frequently Asked Questions
What is CIDR notation?
CIDR (Classless Inter-Domain Routing), defined in RFC 4632, represents a network as an IP address followed by a slash and a prefix length — for example, 192.168.1.0/24. The prefix length specifies how many leading bits of the address identify the network; the remaining bits identify individual hosts within it. A /24 on a 32-bit IPv4 address means 24 network bits and 8 host bits, giving 256 addresses (254 usable hosts).
How does the IP CIDR membership check work?
The check uses bit-shift arithmetic. The IP address and the CIDR base address are each right-shifted by the number of host bits (32 minus the prefix for IPv4, or 128 minus the prefix for IPv6). If the resulting integers are equal, the IP's network portion matches the CIDR block — MATCH. If they differ — NO MATCH. For IPv6, the comparison uses JavaScript BigInt to handle the full 128-bit address space without integer overflow.
Does the CIDR field need an exact network address?
No. The tool tolerates host bits in the CIDR field. Entering 192.168.1.1/24 produces the same result as 192.168.1.0/24, because the host bits (the last 8 bits) are discarded by the right-shift before comparison. This matches the behavior of firewall engines and routing tables, which also ignore host bits in the network prefix.
Can I check IPv6 addresses against IPv6 CIDR ranges?
Yes. The tool supports full IPv6 128-bit checking including compressed :: notation for both the IP and the CIDR block. Any IPv6 prefix from /0 to /128 is accepted. The IP and CIDR block must use the same protocol — an IPv4 address cannot be checked against an IPv6 CIDR block and will return a type-mismatch error.
How accurate is the result?
The check is mathematically exact for any well-formed input. The bit-shift algorithm is the same method used by operating system TCP/IP stacks, routing tables, and firewall ACL engines to evaluate subnet membership. Results are deterministic — the same IP and CIDR will always produce the same result regardless of when or how many times the check is run.
Do you store the IP addresses or CIDR ranges I enter?
No. All processing runs locally in the browser using JavaScript. No IP address or CIDR range is sent to any server, and nothing is stored or logged.
Related Guides
Guide
What is an IP address?
the 32-bit and 128-bit addressing structure that CIDR notation divides into network and host portions.
Guide
What is IPv4?
the full IPv4 addressing model, including address classes and the CIDR transition that replaced classful routing in 1993 (RFC 4632).