cidrcalc

Subnet calculator, IP range expander, and CIDR notation tool

v1.0.1

Linux

Quick Start

Install cidrcalc (one-liner)

curl -fsSL https://cli.johlem.net/tools/cidrcalc/install.sh | bash

This drops a single Rust binary at ~/.local/bin/cidrcalc and verifies its SHA-256 (and Ed25519 signature, if signify is installed).

Inspect a network

cidrcalc info 192.168.1.0/24             # full network properties
cidrcalc info 2001:db8::/32 --format json # IPv6, pipe-clean JSON
echo 10.0.0.0/24 | cidrcalc info          # stdin pipe

Expand, split, aggregate

cidrcalc expand 10.0.0.0/30 --usable          # list usable IPs
cidrcalc expand 10.0.0.0/24 --count           # just the count
cidrcalc split 10.0.0.0/24 --into 26          # four /26 subnets
cidrcalc aggregate 192.168.0.0/24 192.168.1.0/24
cidrcalc range2cidr 10.0.0.5 10.0.0.19        # minimal CIDR cover

Membership and comparison

cidrcalc contains 10.0.0.0/8 10.5.3.1     # exit 0 if inside, 1 otherwise
cidrcalc compare 10.0.0.0/8 10.1.0.0/16   # subnet / supernet / overlap / adjacent
cidrcalc table                            # IPv4 prefix reference table
cidrcalc table --ipv6                     # same, 129 rows

Uninstall

rm ~/.local/bin/cidrcalc ~/.local/bin/cidrcalc.bak 2>/dev/null
rm -rf ~/.local/share/cidrcalc/

What it does

cidrcalc is the everyday IP-math CLI: pretty-printing a network's properties, expanding a range into discrete addresses, converting an arbitrary start/end pair into the minimal set of CIDR blocks, splitting a network into smaller subnets, aggregating adjacent prefixes, and the simple contains / compare predicates scripts reach for.

IPv4 and IPv6. Same subcommands, same flags, both address families — the type system unifies them so /32-vs-/128 is never a special case on the surface.
RFC 3021 aware. /31 and /32 networks treat the full range as usable (no network/broadcast carve-out) — matches the Python original.
Scope classification. Every info result is tagged Public, Private, Loopback, Link-local, Multicast, Reserved, or Unspecified — IPv6 documentation prefix (2001:db8::/32) included.
Three output formats. Text (default, colour TTY), JSON (--format json) for SIEM ingest, CSV (--format csv) for spreadsheet drop-in.
Safety guard on expand. Refuses to enumerate >65536 addresses unless you pass --limit N or --force — protects scripts from accidentally listing a /16.
Stdin friendly. info and aggregate both fall back to stdin when no positional args are given.

Subcommands

Command	What it does
`info <cidr>`	Network properties: prefix, mask, wildcard, broadcast, hosts, scope
`expand <cidr> [--usable] [--count] [--limit N] [--force]`	List addresses (or print count) with safety guard
`range2cidr <start> <end>`	Minimal CIDR cover for a start/end range
`split <cidr> --into <N>`	Split into smaller subnets at prefix /N
`aggregate <cidrs...> [--file F]`	Collapse adjacent CIDRs into minimal supernet set
`contains <cidr> <ip>`	Exit 0 if inside, 1 if outside
`compare <left> <right>`	Relationship: subnet / supernet / equal / overlaps / adjacent / disjoint
`table [--ipv6]`	Prefix-length reference table (33 v4 rows / 129 v6 rows)

Global flags

--format text|json|csv — output format (default text)
--quiet — suppress headers and decoration in text mode
--no-color — disable ANSI colours (auto when stdout is not a TTY)

On-disk layout

~/.local/bin/cidrcalc        # the static binary itself
~/.local/bin/cidrcalc.bak    # previous version (rollback target)
~/.local/share/cidrcalc/     # installed-version marker

Security model: cidrcalc refuses to install a binary whose SHA-256 doesn't match the manifest. If signify is available, Ed25519 signature verification is mandatory — a tampered binary is rejected loudly before being placed. The tool itself does zero network I/O at runtime; every calculation is local.

Review every script before piping into bash: install.sh · cidrcalc/install.sh