Is IP in Subnet? Checker

The IP in Subnet Checker verifies whether a given IP address falls within a specific CIDR block or subnet. Enter any IP address and a CIDR range to instantly determine if the address belongs to that network -- essential for debugging connectivity, validating firewall rules, and troubleshooting routing.

Understanding Subnet Membership

Checking whether an IP address belongs to a particular subnet is one of the most common tasks in network troubleshooting, and it is also one of the easiest to get wrong when doing it mentally. For a /24 subnet, the check is trivial: if the first three octets match, the IP is in the subnet. But for non-octet-boundary prefixes like /20 or /26, the boundary falls in the middle of an octet, and eyeballing it leads to mistakes. Is 172.16.20.1 inside 172.16.0.0/20? The answer is no -- the /20 covers 172.16.0.0 through 172.16.15.255, and .20 in the third octet is outside that range. But you would not know that without doing the binary math or using this tool.

The underlying operation is a bitwise AND. You apply the subnet mask to the IP address being tested, and if the result matches the network address of the subnet, the IP is in the subnet. Routers perform this exact calculation millions of times per second when forwarding packets. It is the foundation of IP routing, ACL matching, and every network device's ability to determine where traffic should go.

This checker is particularly useful when debugging firewall rules that do not match the traffic you expect, verifying that DHCP-assigned addresses fall within the correct scope, confirming that a static route covers the destination you intend, or investigating whether a suspicious IP in your logs belongs to your internal network or to an external range.

How to Check if an IP Is in a Subnet

1. Enter the IP address to check (e.g., 192.168.1.100)
2. Enter the CIDR block to check against (e.g., 192.168.1.0/24)
3. The tool applies the subnet mask to the IP and compares the result to the network address
4. If the masked IP matches the network address, the IP is in the subnet
5. Results show whether the IP is inside or outside, along with the full subnet range

IP in Subnet Check Examples

When to Use This Tool

• Debugging connectivity issues -- verify that a device's IP is actually within the expected subnet
• Validating firewall rules -- confirm that an ACL or security group correctly matches the intended traffic
• Troubleshooting routing -- check whether a destination IP falls within a specific route's prefix
• DHCP verification -- ensure assigned addresses are within the configured scope
• Security incident analysis -- quickly determine if a suspicious IP belongs to your network or an external range
• Cloud networking -- confirm that EC2 instances, pods, or VMs are in the correct VPC subnet
• Auditing network segmentation -- verify that hosts are on the intended VLAN subnets

How the Subnet Membership Check Works

The Bitwise AND Comparison

To check if an IP belongs to a subnet, apply the subnet mask to both the IP and the network address. If the results match, the IP is in the subnet.

Check: Is 192.168.1.100 in 192.168.1.0/24?

IP Address:  192.168.1.100  → 11000000.10101000.00000001.01100100
Subnet Mask: 255.255.255.0  → 11111111.11111111.11111111.00000000
             AND ─────────────────────────────────────────────────
Result:      192.168.1.0    → 11000000.10101000.00000001.00000000

Network:     192.168.1.0    → 11000000.10101000.00000001.00000000

Result matches network address → IP IS in the subnet

A Non-Match Example

Check: Is 172.16.20.1 in 172.16.0.0/20?

IP Address:  172.16.20.1    → 10101100.00010000.00010100.00000001
Subnet Mask: 255.255.240.0  → 11111111.11111111.11110000.00000000
             AND ─────────────────────────────────────────────────
Result:      172.16.16.0    → 10101100.00010000.00010000.00000000

Network:     172.16.0.0     → 10101100.00010000.00000000.00000000

Result (172.16.16.0) ≠ network (172.16.0.0) → IP is NOT in the subnet

The third octet 20 (binary 00010100) masked with 240 (binary 11110000) gives 16 (binary 00010000), which does not match the network's third octet of 0.

Range-Based Intuition

An equivalent way to think about it: an IP is in a subnet if it falls between the network address and the broadcast address (inclusive).

IPv6 Support

The same logic applies to IPv6 addresses. For example, 2001:db8::100 is within 2001:db8::/32 because masking the 128-bit address with a /32 prefix yields 2001:db8::, which matches the network prefix.

Subnet Membership Checks in Practice

The most common scenario for this check is firewall rule debugging. You write a rule that should allow traffic from 10.0.0.0/24, but a host at 10.0.1.50 is being blocked. The issue is obvious once you check: 10.0.1.50 is not in 10.0.0.0/24 -- it is in 10.0.1.0/24. You either need to change the rule to 10.0.0.0/23 (which covers both 10.0.0.0 and 10.0.1.0) or add a second rule for the second subnet. This kind of off-by-one-subnet error is extremely common, especially with non-octet boundaries.

Another frequent use case is verifying network segmentation. In a well-designed network, different departments or security zones are on separate subnets. If a host that should be on the accounting VLAN (192.168.5.0/24) shows up with an address like 192.168.6.15, it is either on the wrong VLAN or its DHCP scope is misconfigured. A quick subnet membership check confirms whether the address belongs where you expect it.

In security incident response, one of the first questions about a suspicious IP is "is this ours?" If your organization uses 10.0.0.0/8 internally, a quick check tells you whether 10.50.200.15 is an internal address or not. For external IPs, you might check them against known ranges for cloud providers, CDNs, or threat intelligence feeds. This tool handles both IPv4 and IPv6, making it useful for dual-stack environments where you need to verify addresses in both protocols.

Frequently Asked Questions

Is 10.0.1.50 in the subnet 10.0.0.0/24?

No. The subnet 10.0.0.0/24 covers addresses from 10.0.0.0 to 10.0.0.255. The address 10.0.1.50 is in the 10.0.1.0/24 range, which is a different subnet. However, 10.0.1.50 is within 10.0.0.0/16, which covers 10.0.0.0 to 10.0.255.255.

How do I check if two IPs are on the same subnet?

Apply the subnet mask to both IPs using a bitwise AND. If the resulting network addresses match, both IPs are on the same subnet. For example, 192.168.1.10 and 192.168.1.200 both mask to 192.168.1.0 with a /24 prefix, so they are on the same subnet.

Can I check IPv6 addresses with this tool?

Yes. The checker supports both IPv4 and IPv6 addresses with any valid prefix length. For IPv6, enter the address and prefix in standard notation, such as checking whether 2001:db8:abcd::1 belongs to 2001:db8::/32.

Why does my firewall rule not match the traffic I expect?

A common mistake is using the wrong prefix length. For example, a rule for 10.0.0.0/24 only matches 10.0.0.0 through 10.0.0.255. If your traffic comes from 10.0.1.100, it falls outside this range. Use this checker to verify that your source or destination IPs actually fall within the CIDR blocks specified in your rules.

How do I find the smallest subnet that contains two specific IPs?

Find the network address for each IP at progressively shorter prefix lengths until both IPs produce the same network address. For example, 192.168.1.10 and 192.168.2.20 are not in the same /24, but they are both in 192.168.0.0/22 (which covers 192.168.0.0 through 192.168.3.255). The tool can help you verify each candidate prefix until you find the match.

Can the network or broadcast address be "in" the subnet?

Yes. The network address and broadcast address are both part of the subnet -- they are the first and last addresses in the range. They are within the subnet; they just cannot be assigned to hosts. The checker will correctly report these addresses as being inside the subnet.

Related Tools

• IPv4 Subnet Calculator - Calculate network, broadcast, and host range from CIDR notation
• Network Address Calculator - Find the network address for any IP and subnet mask
• Subnet Contains Subnet? Checker - Check if one CIDR block contains another
• Subnet Overlap Checker (Two CIDRs) - Check if two CIDR blocks overlap
• First/Last Usable Host Calculator - Find the first and last usable host addresses in a subnet
• Broadcast Address Calculator - Find the broadcast address for any subnet