CIDR Containment Checker
Check full IPv4 address or subnet containment against a parent CIDR.
Verify complete subnet containment
A child subnet is contained only when both its first and last addresses fall within the parent, not merely when its typed address happens to match the parent prefix. This checker normalizes both CIDR inputs to start and end ranges, or treats a target without a slash as one address, then compares the complete interval with exact unsigned arithmetic.
The default confirms that 10.1.0.0/16 is fully contained by 10.0.0.0/8 and prints both ranges for inspection. A target spanning beyond the parent boundary returns no even if its first address is inside. Host-bit text in either CIDR is masked to the real network before the comparison.
Why checking one address is not enough
Containment is a mathematical range result, not authorization, reachability, or route precedence. A contained public or private block can still be denied by policy, shadowed by a more specific route, or unavailable in a given environment. The checker runs in your browser without querying a network. Use it to validate scopes, then review firewall and routing rules separately.
Frequently Asked Questions
Can the target be one IPv4 address?
Yes. Enter an address without a slash and it is treated as a one-address interval.
Does the checker compare the whole child CIDR?
Yes. Both the child start and child end must be inside the parent range.
Does containment mean traffic is allowed?
No. It only compares address ranges and says nothing about firewall, routing, or authorization policy.
Browse the full set of free, private, in-browser tools.