IP and network calculations
Is this IP inside the specified CIDR?
Tools to use
An allow rule is 192.0.2.128/25, while a log shows 192.0.2.127. Most digits match, but the address lies outside. String-prefix matching cannot establish IP membership. Testing one address on each side of a boundary produces a concrete explanation for a configuration review.
Use /32 to compare one IPv4 address
192.0.2.128/25
192.0.2.200/32The result says the left contains the right: .200 lies within .128–.255. Their intersection is 192.0.2.200/32 and the right-only difference is empty. Accidentally using /24 instead of /32 turns the right input into a 256-address block and asks a different question.
For one IPv6 address, use /128: 2001:db8:1::/64 contains 2001:db8:1::1234/128. Do not mix IPv4 and IPv6 in one comparison. Even an IPv6 representation containing IPv4-looking text needs an explicit address-family interpretation.
Test .127 and .128 separately
Keep the left /25 and test .127/32: disjoint. Test .128/32: contained. At the other end, .255 is contained but 192.0.3.0 is not. A representative host alone is insufficient; inspect just before the start, the start, the end, and just after the end.
This is numerical membership. A network-address role does not remove .128 from the CIDR range. Assignability, firewall matching behavior, and reachability are separate questions. The tool compares supplied ranges without consulting devices or rule engines.
Use directional differences to inspect expansion
192.0.2.0/25
192.0.2.0/24The right contains the left. Intersection is 192.0.2.0/25, left-only is empty, and right-only is 192.0.2.128/25: the newly added range. Reverse before and after and that same block becomes left-only, the removed range. Overlap is symmetric; the meaning of a difference is not.
For review, report added and removed blocks instead of only 'contained.' Expansion has different consequences for allow and deny rules, so do not label it inherently better. The result describes range changes, not the correctness of a security policy.
Different text can describe the same range
192.0.2.10/24 and .200/24 are equal ranges, both .0–.255. Host bits in the input are normalized to the prefix block. A changed last octet need not change coverage, while an unchanged address with /25 changed to /24 does.
Two normalized single CIDRs are equal, nested, or disjoint. They do not behave like arbitrary intervals whose ends partially cross. For a multi-entry allowlist, one pairwise comparison is not an evaluation of the whole list.
When membership is correct but the connection fails
Containment does not guarantee connectivity. Check whether the service sees the same source address shown on the local device. NAT, proxies, or VPNs can make those different. The tool does not investigate the network; compare authorized service records with the address you supplied.
Ports, protocols, rule precedence, other denials, and routes are outside this calculation. Record 'numerically contained' as one completed check, then inspect the environment's remaining conditions. This prevents repeatedly recalculating addresses when the unresolved cause is elsewhere.
Keep a before-and-after comparison
Fix the direction, such as before on the left and after on the right. Review common, added, and removed ranges, using the CIDR calculators for boundaries when needed. Documentation addresses are not entries to add to a real configuration. Make deployment decisions through the authorized configuration process.
Equal address coverage does not prove equal policy behavior
When allow and deny CIDRs coexist, evaluation order may affect access. This tool compares address sets, not a firewall's first-match behavior or routing selection. Overlap alone does not establish a policy conflict; action, order, port and protocol are separate conditions. Treat the output as a check of the address component only.
With old on the left and new on the right, new minus old is added coverage and old minus new is removed coverage. Reversing sides reverses the explanation. Changing 192.0.2.0/25 to /24 adds 192.0.2.128/25. Write that direction explicitly rather than reporting only 'contained.' Wider coverage is not automatically better; the difference helps assess whether expansion was intended.
Test a host just before, at and after the boundary using /32 for IPv4 or /128 for IPv6. One interior member does not verify the endpoints. These arithmetic checks need no network traffic. Actual reachability testing is a separate authorized diagnostic, not something this calculator has performed.