Subnet Calculator: IPv4 & IPv6 CIDR, VLSM and route aggregation
Paste one network or a hundred. Every line returns its network and broadcast address, usable host range, subnet and wildcard mask, host count and address type, recalculated as you type, then exports to CSV or JSON.
- Bulk modeone network per line, IPv4 and IPv6 mixed freely, every line calculated at once, not one subnet at a time.
- Exact IPv6 maths128-bit integer arithmetic, so a /48 or /64 reports its true address count instead of an approximation.
- VLSM splitterdivides a parent block into right-sized child subnets from a list of host counts, packed largest-first.
- CIDR aggregationcollapses a route list into the fewest supernets covering exactly the same addresses.
- CSV, JSON and share linksexport the whole result table, or send a link that reloads the exact same list.
- Nothing leaves your browserall maths runs client-side. No upload, no account, and it keeps working offline.
Also here: an access list matcher for Cisco and Juniper ACLs, MAC address lookup for resolving hardware vendors in bulk, and a data unit converter for bits, bytes and transfer times.
IP address pool reference
The reserved IPv4 and IPv6 ranges, with what each one is for and whether it routes on the public internet. Select any block to load it into the calculator above. Values are taken from the IANA special-purpose address registries.
Private / internal
| block | addresses | purpose | reference |
|---|---|---|---|
| 16,777,216 | Private-UseInternal networks. The largest RFC 1918 block, usual choice for data centres and large campuses. | RFC 1918not routed | |
| 1,048,576 | Private-UseInternal networks. Covers 172.16.0.0 to 172.31.255.255, which is the range most often mis-stated as 172.16 to 172.16. | RFC 1918not routed | |
| 65,536 | Private-UseInternal networks. The default on home and small office routers. | RFC 1918not routed | |
| ≈2.65 × 10³⁶ | Unique-LocalIPv6 equivalent of RFC 1918. In practice only fd00::/8 is used, with a randomly generated 40-bit global ID; fc00::/8 is unassigned. | RFC 4193not routed |
Shared address space
| block | addresses | purpose | reference |
|---|---|---|---|
| 4,194,304 | Shared Address SpaceCarrier-grade NAT between subscriber and provider. Not private space: do not use it as extra RFC 1918 room, because your ISP may already be using it. | RFC 6598not routed |
Loopback
| block | addresses | purpose | reference |
|---|---|---|---|
| 16,777,216 | LoopbackThe host itself. The whole /8 loops back, not just 127.0.0.1. | RFC 1122not routed | |
| 1 | Loopback AddressThe host itself. IPv6 spends a single address here rather than a whole block. | RFC 4291not routed |
Link-local
| block | addresses | purpose | reference |
|---|---|---|---|
| 65,536 | Link LocalSelf-assigned when DHCP fails (APIPA). An address from here usually means the DHCP server did not answer. | RFC 3927not routed | |
| ≈3.32 × 10³⁵ | Link-Local UnicastAutomatically configured on every IPv6 interface and required for neighbour discovery. Always present, never routed off the link. | RFC 4291not routed |
Multicast
| block | addresses | purpose | reference |
|---|---|---|---|
| 268,435,456 | MulticastIPv4 multicast, the old class D. 224.0.0.0/24 is link-local control traffic such as OSPF and VRRP. | RFC 5771not routed | |
| ≈1.32 × 10³⁶ | MulticastIPv6 multicast. The next 4 bits are flags and the 4 after that are scope, so ff02:: is link-local and ff0e:: is global. | RFC 4291not routed |
Documentation and examples
| block | addresses | purpose | reference |
|---|---|---|---|
| 256 | Documentation (TEST-NET-1)Examples and documentation. Safe to print, never routed. | RFC 5737not routed | |
| 256 | Documentation (TEST-NET-2)Second documentation block, for examples needing two distinct networks. | RFC 5737not routed | |
| 256 | Documentation (TEST-NET-3)Third documentation block. | RFC 5737not routed | |
| ≈7.92 × 10²⁸ | DocumentationThe IPv6 documentation prefix, seen in nearly every IPv6 example ever written. | RFC 3849not routed | |
| ≈3.24 × 10³² | DocumentationAdded in 2024 because a single /32 was too small for realistic multi-site examples. | RFC 9637not routed |
Globally routable
| block | addresses | purpose | reference |
|---|---|---|---|
| ≈4.25 × 10³⁷ | Global UnicastThe whole publicly routable IPv6 range. Every address an RIR assigns comes from here, which is one eighth of the address space. | RFC 4291routes globally |
IPv4 / IPv6 transition
| block | addresses | purpose | reference |
|---|---|---|---|
| 4,294,967,296 | IPv4-mapped AddressCarries an IPv4 address inside an IPv6 socket, so ::ffff:192.0.2.1 is 192.0.2.1. Appears in logs on dual-stack hosts. | RFC 4291not routed | |
| 4,294,967,296 | IPv4-IPv6 TranslationThe well-known prefix for NAT64, letting IPv6-only clients reach IPv4 servers. | RFC 6052routes globally | |
| ≈5.19 × 10³³ | 6to4Legacy automatic tunnelling. Deprecated in practice; reachability depends on a relay. | RFC 3056depends on relay | |
| ≈7.92 × 10²⁸ | TeredoTunnels IPv6 over UDP through NAT. Reachability depends on the relay. | RFC 4380depends on relay |
Benchmarking
| block | addresses | purpose | reference |
|---|---|---|---|
| 131,072 | BenchmarkingReserved for testing network devices. Traffic must not leave the test rig. | RFC 2544not routed | |
| ≈1.20 × 10²⁴ | BenchmarkingIPv6 equivalent for device testing. | RFC 5180not routed |
Other reserved
| block | addresses | purpose | reference |
|---|---|---|---|
| 16,777,216 | This networkSource address only, and only before the host knows its own address. 0.0.0.0/32 alone means this host. | RFC 791not routed | |
| 268,435,456 | ReservedThe old class E. Reserved indefinitely and dropped by most stacks, so it is not the spare space it looks like. | RFC 1112not routed | |
| 1 | Limited BroadcastBroadcast to the local link only. Never forwarded by a router. | RFC 8190not routed | |
| 256 | IETF Protocol AssignmentsReserved for protocol machinery, including the 192.0.0.0/29 DS-Lite range. | RFC 6890not routed | |
| 1 | Unspecified AddressNo address yet. Seen as the source during duplicate address detection. | RFC 4291not routed | |
| ≈5.19 × 10³³ | Segment Routing (SRv6) SIDsSegment identifiers for SRv6, allocated in 2024. Forwardable inside an operator's domain but not globally reachable. | RFC 9602not routed | |
| ≈1.84 × 10¹⁹ | Discard-Only Address BlockA managed black hole: routes here are meant to be discarded, which is used for remotely triggered filtering. | RFC 6666not routed |
TCP and UDP port reference
133 ports engineers actually look up, with the IANA service name, what the port is used for in practice, and a warning where the protocol sends credentials in the clear. Search by number, by service, or by what a firewall log called it.
133 of 133 ports
Web and proxies8
| port | proto | service | used for |
|---|---|---|---|
| 80 | tcp/udp/sctp | httpWorld Wide Web HTTP | HTTPUnencrypted. Use 443 (HTTPS) in production. |
| 443 | tcp/udp/sctp | httpshttp protocol over TLS/SSL | HTTPS |
| 631 | tcp/udp | ippIPP (Internet Printing Protocol) | IPP printing |
| 1080 | tcp/udp | socksSocks | SOCKS proxy |
| 3128 | tcp/udp | ndl-aasActive API Server Port | Squid proxynot the IANA assignment |
| 8080 | tcp/udp | http-altHTTP Alternate (see port 80) | HTTP alternateCommon for proxies, app servers and containers behind a reverse proxy. |
| 8443 | tcp/udp | pcsync-httpsPCsync HTTPS | HTTPS alternatenot the IANA assignmentWidely used as a second HTTPS port; IANA assigns it to PCsync. |
| 9100 | tcp/udp | pdl-datastreamPrinter PDL Data Stream | Printer raw / JetDirect |
Mail7
| port | proto | service | used for |
|---|---|---|---|
| 25 | tcp/udp | smtpSimple Mail Transfer | SMTP relayUnencrypted. Use 587 with STARTTLS, or 465 implicit TLS. |
| 110 | tcp/udp | pop3Post Office Protocol - Version 3 | POP3Unencrypted. Use 995 (POP3S). |
| 143 | tcp | imapInternet Message Access Protocol | IMAPUnencrypted. Use 993 (IMAPS). |
| 465 | tcp | submissionsMessage Submission over TLS protocol | SMTP submission over TLS |
| 587 | tcp/udp | submissionMessage Submission | SMTP submission |
| 993 | tcp | imapsIMAP over TLS protocol | IMAP over TLS |
| 995 | tcp/udp | pop3sPOP3 over TLS protocol | POP3 over TLS |
File transfer and sharing13
| port | proto | service | used for |
|---|---|---|---|
| 20 | tcp/udp/sctp | ftp-dataFile Transfer [Default Data] | FTP dataUnencrypted. Use SFTP over 22, or FTPS on 989/990. |
| 21 | tcp/udp/sctp | ftpFile Transfer Protocol [Control] | FTP controlUnencrypted. Use SFTP over 22, or FTPS on 989/990. |
| 69 | tcp/udp | tftpTrivial File Transfer | TFTPUnencrypted. No authentication at all. Keep it off routable networks. |
| 139 | tcp/udp | netbios-ssnNETBIOS Session Service | NetBIOS sessionLegacy SMB transport. |
| 445 | tcp/udp | microsoft-dsMicrosoft-DS | SMB / CIFSWindows file sharing. Never expose to the internet. |
| 548 | tcp/udp | afpovertcpAFP over TCP | AFP |
| 873 | tcp/udp | rsyncrsync | rsync |
| 989 | tcp/udp | ftps-dataftp protocol, data, over TLS/SSL | FTPS data |
| 990 | tcp/udp | ftpsftp protocol, control, over TLS/SSL | FTPS control |
| 2049 | tcp/udp/sctp | nfsNetwork File System - Sun Microsystems | NFS |
| 3260 | tcp/udp | iscsi-targetiSCSI port | iSCSI target |
| 3690 | tcp/udp | svnSubversion | Subversion |
| 9418 | tcp/udp | gitgit pack transfer service | Git protocolUnencrypted. Unauthenticated and unencrypted; prefer SSH or HTTPS. |
Remote access and management9
| port | proto | service | used for |
|---|---|---|---|
| 22 | tcp/udp/sctp | sshThe Secure Shell (SSH) Protocol | SSH / SFTP / SCP |
| 23 | tcp/udp | telnetTelnet | TelnetUnencrypted. Credentials sent in the clear. Use 22 (SSH). |
| 623 | udp | asf-rmcpASF Remote Management and Control Protocol | IPMI / BMCOut-of-band server management. Keep it on an out-of-band management network. |
| 2000 | tcp/udp | cisco-sccpCisco SCCP | Cisco SCCP |
| 3389 | tcp/udp | ms-wbt-serverMS WBT Server | RDPMicrosoft Remote Desktop. A top ransomware entry point when exposed. |
| 5555 | tcp/udp | personal-agentPersonal Agent | Android ADBnot the IANA assignmentIANA assigns this to personal-agent. |
| 5900 | tcp/udp | rfbRemote Framebuffer | VNCUnencrypted. VNC auth is weak; tunnel it over SSH. |
| 5985 | tcp/udp | wsmanWBEM WS-Management HTTP | WinRM HTTPUnencrypted. Use 5986 for WinRM over TLS. |
| 5986 | tcp/udp | wsmansWBEM WS-Management HTTP over TLS/SSL | WinRM HTTPS |
Directory and authentication11
| port | proto | service | used for |
|---|---|---|---|
| 49 | tcp/udp | tacacsLogin Host Protocol (TACACS) | TACACS+ |
| 88 | tcp/udp | kerberosKerberos | Kerberos |
| 113 | tcp/udp | authAuthentication Service | ident |
| 389 | tcp/udp | ldapLightweight Directory Access Protocol | LDAPUnencrypted. Use 636 (LDAPS) or StartTLS. |
| 464 | tcp/udp | kpasswdkpasswd | Kerberos password change |
| 636 | tcp/udp | ldapsldap protocol over TLS/SSL (was sldap) | LDAPS |
| 1645 | tcp/udp | sightlineSightLine | RADIUS (legacy)not the IANA assignmentPre-standard RADIUS port, still seen on older kit. IANA assigns it to SightLine. |
| 1812 | tcp/udp | radiusRADIUS | RADIUS authentication |
| 1813 | tcp/udp | radius-acctRADIUS Accounting | RADIUS accounting |
| 3268 | tcp/udp | msft-gcMicrosoft Global Catalog | Global Catalog |
| 3269 | tcp/udp | msft-gc-sslMicrosoft Global Catalog with LDAP/SSL | Global Catalog over TLS |
Databases and caches10
| port | proto | service | used for |
|---|---|---|---|
| 1433 | tcp/udp | ms-sql-sMicrosoft-SQL-Server | Microsoft SQL Server |
| 1434 | tcp/udp | ms-sql-mMicrosoft-SQL-Monitor | SQL Server Browser |
| 1521 | tcp/udp | ncube-lmnCube License Manager | Oracle DB listenernot the IANA assignmentUniversally used by Oracle; IANA assigns it to nCube License Manager. |
| 2379 | tcp | etcd-clientetcd client communication | etcd client |
| 3306 | tcp/udp | mysqlMySQL | MySQL / MariaDB |
| 5432 | tcp/udp | postgresqlPostgreSQL Database | PostgreSQL |
| 6379 | tcp | redisAn advanced key-value cache and store | RedisNo auth by default in older builds. Never expose it. |
| 9200 | tcp/udp | wap-wspWAP connectionless session service | Elasticsearch HTTPnot the IANA assignmentIANA assigns it to WAP session service. |
| 11211 | tcp/udp | memcacheMemory cache service | MemcachedUDP mode has been abused for reflection attacks; disable it. |
| 27017 | tcp | mongodbMongo database system | MongoDB |
Core network services21
| port | proto | service | used for |
|---|---|---|---|
| 53 | tcp/udp | domainDomain Name Server | DNSUDP for queries, TCP for zone transfers and large responses. |
| 67 | tcp/udp | bootpsBootstrap Protocol Server | DHCP server |
| 68 | tcp/udp | bootpcBootstrap Protocol Client | DHCP client |
| 111 | tcp/udp | sunrpcSUN Remote Procedure Call | RPC portmapperFronts NFS and other RPC services. |
| 123 | tcp/udp | ntpNetwork Time Protocol | NTP |
| 135 | tcp/udp | epmapDCE endpoint resolution | MS RPC endpoint mapper |
| 137 | tcp/udp | netbios-nsNETBIOS Name Service | NetBIOS name |
| 138 | tcp/udp | netbios-dgmNETBIOS Datagram Service | NetBIOS datagram |
| 161 | tcp/udp | snmpSNMP | SNMPUnencrypted. v1 and v2c community strings are plaintext. Use SNMPv3. |
| 162 | tcp/udp | snmptrapSNMPTRAP | SNMP trap |
| 427 | tcp/udp | svrlocServer Location | SLP |
| 514 | udp | syslog | SyslogUDP 514 is syslog; TCP 514 is the old rsh shell service. |
| 546 | tcp/udp | dhcpv6-clientDHCPv6 Client | DHCPv6 client |
| 547 | tcp/udp | dhcpv6-serverDHCPv6 Server | DHCPv6 server |
| 853 | tcp/udp | domain-sDNS query-response protocol run over TLS | DNS over TLS |
| 1900 | tcp/udp | ssdpSSDP | SSDP / UPnPReflection-attack amplifier. Block inbound at the edge. |
| 3702 | tcp/udp | ws-discoveryWeb Service Discovery | WS-Discovery |
| 5353 | tcp/udp | mdnsMulticast DNS | mDNS / Bonjour |
| 5355 | tcp/udp | llmnrLLMNR | LLMNRFrequently abused for credential relay; disable on Windows networks. |
| 6514 | tcp/udp | syslog-tlsSyslog over TLS | Syslog over TLS |
| 7547 | tcp/udp | cwmpBroadband Forum CWMP | TR-069 CWMPISP remote management of CPE. |
Routing and network control14
| port | proto | service | used for |
|---|---|---|---|
| 179 | tcp/udp/sctp | bgpBorder Gateway Protocol | BGP |
| 520 | udp | routerlocal routing process (on site); uses variant of Xerox NS routing information protocol - RIP | RIP |
| 521 | tcp/udp | ripngripng | RIPng |
| 646 | tcp/udp | ldpLDP | MPLS LDP |
| 830 | tcp/udp | netconf-sshNETCONF over SSH | NETCONF over SSH |
| 1985 | tcp/udp | hsrpHot Standby Router Protocol | HSRP |
| 2055 | tcp/udp | iopIliad-Odyssey Protocol | NetFlownot the IANA assignmentThe conventional NetFlow collector port; IANA assigns it to Iliad-Odyssey. |
| 2152 | tcp/udp | gtp-userGTP-User Plane (3GPP) | GTP user plane |
| 3784 | tcp/udp | bfd-controlBFD Control Protocol | BFD control |
| 4739 | tcp/udp/sctp | ipfixIP Flow Info Export | IPFIX |
| 4789 | udp | vxlanVirtual eXtensible Local Area Network (VXLAN) | VXLAN |
| 6081 | udp | geneveGeneric Network Virtualization Encapsulation (Geneve) | Geneve |
| 6343 | tcp/udp | sflowsFlow traffic monitoring | sFlow |
| 6653 | tcp/udp | openflowOpenFlow | OpenFlow |
VPN and tunnelling6
| port | proto | service | used for |
|---|---|---|---|
| 500 | tcp/udp | isakmpisakmp | IKE / ISAKMP |
| 1194 | tcp/udp | openvpnOpenVPN | OpenVPN |
| 1701 | tcp/udp | l2tpl2tp | L2TP |
| 1723 | tcp/udp | pptppptp | PPTPUnencrypted. PPTP is cryptographically broken. Use IPsec or WireGuard. |
| 4500 | tcp/udp | ipsec-nat-tIPsec NAT-Traversal | IPsec NAT traversal |
| 51820 | udp | not registered | WireGuardThe WireGuard default. Not registered with IANA. |
Messaging and queues9
| port | proto | service | used for |
|---|---|---|---|
| 1883 | tcp/udp | mqttMessage Queuing Telemetry Transport Protocol | MQTTUnencrypted. Use 8883 for MQTT over TLS. |
| 4369 | tcp/udp | epmdErlang Port Mapper Daemon | Erlang EPMD |
| 5222 | tcp | xmpp-clientXMPP Client Connection | XMPP client |
| 5269 | tcp | xmpp-serverXMPP Server Connection | XMPP server |
| 5671 | tcp/udp | amqpsamqp protocol over TLS/SSL | AMQP over TLS |
| 5672 | tcp/udp/sctp | amqpAMQP | AMQP / RabbitMQ |
| 6667 | tcp | ircuIRCU | IRC |
| 8883 | tcp/udp | secure-mqttSecure MQTT | MQTT over TLS |
| 9092 | tcp/udp | XmlIpcRegSvcXml-Ipc Server Reg | Apache Kafkanot the IANA assignmentThe Kafka default; IANA assigns it to Xml-Ipc. |
Containers and orchestration6
| port | proto | service | used for |
|---|---|---|---|
| 2181 | tcp/udp | eforwardeforward | Apache ZooKeepernot the IANA assignmentThe ZooKeeper default; IANA assigns it to eforward. |
| 2375 | tcp | dockerDocker REST API (plain text) | Docker APIUnencrypted. Unauthenticated root-equivalent access. Never expose. |
| 2376 | tcp | docker-sDocker REST API (ssl) | Docker API over TLS |
| 6443 | tcp/udp | sun-sr-httpsService Registry Default HTTPS Domain | Kubernetes API servernot the IANA assignmentThe kube-apiserver default; IANA assigns it to Sun Service Registry. |
| 10050 | tcp/udp | zabbix-agentZabbix Agent | Zabbix agent |
| 10051 | tcp/udp | zabbix-trapperZabbix Trapper | Zabbix trapper |
Voice and media5
| port | proto | service | used for |
|---|---|---|---|
| 554 | tcp/udp | rtspReal Time Streaming Protocol (RTSP) | RTSP |
| 3478 | tcp/udp | stunSession Traversal Utilities for NAT (STUN) port | STUN / TURN |
| 5060 | tcp/udp/sctp | sipSIP | SIPUnencrypted. Use 5061 for SIP over TLS. |
| 5061 | tcp/udp/sctp | sipsSIP-TLS | SIP over TLS |
| 32400 | tcp | plexPlex multimedia | Plex |
Industrial and SCADA5
| port | proto | service | used for |
|---|---|---|---|
| 102 | tcp/udp | iso-tsapISO-TSAP Class 0 | S7comm / ISO-TSAP |
| 502 | tcp/udp | mbapModbus Application Protocol | Modbus TCPUnencrypted. No authentication in the protocol. Segment it. |
| 2222 | tcp/udp | EtherNet-IP-1EtherNet/IP I/O IANA assigned this well-formed service name as a replacement for "EtherNet/IP-1". | EtherNet/IP implicit |
| 20000 | tcp/udp/sctp | dnpDNP | DNP3 |
| 44818 | tcp/udp | EtherNet-IP-2EtherNet/IP messaging IANA assigned this well-formed service name as a replacement for "EtherNet/IP-2". | EtherNet/IP explicit |
Legacy and diagnostics9
| port | proto | service | used for |
|---|---|---|---|
| 7 | tcp/udp | echoEcho | Echo |
| 13 | tcp/udp | daytimeDaytime | Daytime |
| 19 | tcp/udp | chargenCharacter Generator | ChargenReflection-attack amplifier. Disable it. |
| 37 | tcp/udp | timeTime | Time |
| 43 | tcp/udp | nicnameWho Is | WHOIS |
| 79 | tcp/udp | fingerFinger | Finger |
| 119 | tcp/udp | nntpNetwork News Transfer Protocol | NNTP |
| 194 | tcp/udp | ircInternet Relay Chat Protocol | IRC (original) |
| 515 | tcp/udp | printerspooler | LPD print |
Service names and descriptions come from the IANA Service Name and Transport Protocol Port Number Registry. Where the name in common use is not what IANA assigns, both are shown.