NetDevKit: Network & Developer Calculators
Fast, Private, Browser-Only Network & Developer Calculators. Every tool runs locally inside your browser for instant speed and complete privacy.
Networking
IPv4 Subnet & CIDR Calculator
Calculate network address, broadcast, usable host range, wildcard mask, and binary representation instantly.
Open Tool →
Networking
IPv6 Subnet & Compression Calculator
Compress or expand 128-bit IPv6 addresses (RFC 5952), compute /64 SLAAC subnet counts, and generate ip6.arpa PTR zones.
Open Tool →
Networking
VLSM Subnet Splitter
Allocate variable-length subnet masks efficiently across departments or cloud VPCs without wasting IPs.
Open Tool →
VPN & Routing
MTU, TCP MSS & VPN Overhead Calculator
Compute exact tunnel MTU and TCP MSS clamping values for WireGuard, IPsec, GRE, VXLAN, and PPPoE links.
Open Tool →
VPN & Routing
WireGuard AllowedIPs & Config Generator
Calculate split-tunnel AllowedIPs CIDRs excluding local LANs and generate client/peer configs with WebCrypto PSKs.
Open Tool →
Cloud & Security
SPF & DMARC DNS Record Generator
Generate RFC-compliant SPF and DMARC TXT records while tracking the strict 10-DNS-lookup limit.
Open Tool →
Cloud & Infra
Bandwidth & File Transfer Time Calculator
Estimate exact download/upload durations across Mbps, Gbps, MB/s, and cloud link overheads.
Open Tool →
DevOps
Cron Expression Explainer & Simulator
Translate 5-field Linux/Kubernetes cron schedules into plain English and preview upcoming UTC execution times.
Open Tool →
DevOps
Linux Chmod, Symbolic & Umask Calculator
Convert octal modes (755, 644, 4755) to symbolic permissions, SetUID/SetGID/Sticky bits, and session umask values.
Open Tool →
Developer
Private JSON & Base64 Formatter
Format, minify, validate JSON and encode/decode UTF-8 Base64 100% locally in your browser with zero server uploads.
Open Tool →IPv4 CIDR Subnet Mask Quick Reference (/8 to /32)
Select any CIDR prefix below for its exact subnet mask, wildcard mask, usable host count, and binary layout.
| CIDR | Subnet Mask | Wildcard Mask | Total IPs | Usable Hosts | Common Use |
|---|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 | Legacy Class A supernets, large ISP backbones, and private 10.0.0.0/8 enterprise allocation. |
| /9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 | Custom CIDR block with 8,388,608 total IPv4 addresses (8,388,606 usable host IPs) for VLSM allocation. |
| /10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 | Custom CIDR block with 4,194,304 total IPv4 addresses (4,194,302 usable host IPs) for VLSM allocation. |
| /11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 | Custom CIDR block with 2,097,152 total IPv4 addresses (2,097,150 usable host IPs) for VLSM allocation. |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 | Custom CIDR block with 1,048,576 total IPv4 addresses (1,048,574 usable host IPs) for VLSM allocation. |
| /13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 | Custom CIDR block with 524,288 total IPv4 addresses (524,286 usable host IPs) for VLSM allocation. |
| /14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 | Custom CIDR block with 262,144 total IPv4 addresses (262,142 usable host IPs) for VLSM allocation. |
| /15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 | Custom CIDR block with 131,072 total IPv4 addresses (131,070 usable host IPs) for VLSM allocation. |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 | Class B networks, major cloud VPC primary blocks (e.g., AWS/GCP 10.0.0.0/16), and university campuses. |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 | Custom CIDR block with 32,768 total IPv4 addresses (32,766 usable host IPs) for VLSM allocation. |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 | Custom CIDR block with 16,384 total IPv4 addresses (16,382 usable host IPs) for VLSM allocation. |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 | Custom CIDR block with 8,192 total IPv4 addresses (8,190 usable host IPs) for VLSM allocation. |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 | Medium-to-large regional VPC subnets supporting up to 4,094 hosts per availability zone. |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 | Custom CIDR block with 2,048 total IPv4 addresses (2,046 usable host IPs) for VLSM allocation. |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 | Corporate office floors or Kubernetes pod CIDRs requiring ~1,000 IP addresses. |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 | Custom CIDR block with 512 total IPv4 addresses (510 usable host IPs) for VLSM allocation. |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 | Standard Class C LAN subnet, home/office routers, and typical production microservice tiers (254 hosts). |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 | Half of a /24 block—ideal for splitting a standard office LAN into two isolated VLANs. |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 | Quarter of a /24 block (62 usable hosts)—common for DMZs or small department VLANs. |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 | Small server rack or Kubernetes node pool (30 usable hosts). |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 | Cloud NAT gateways, bastion subnets, or small database tiers (14 usable hosts). |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 | Tiny firewall transit segments or multi-router HA VIP pools (6 usable hosts). |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 | Traditional point-to-point WAN router links (2 usable hosts). |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 | Modern RFC 3021 point-to-point router interconnect link (2 usable hosts, zero wasted broadcast). |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 | Single host route, loopback interface, or exact firewall /32 allowlist rule. |
Network Port & Cloud Firewall Quick Reference
Click any port below for transport protocol rules (TCP vs. UDP), RFC standards, cloud Security Group hardening guidance, and CLI verification commands.
| Port | Protocol | Service | Standard | Firewall Guidance Summary |
|---|---|---|---|---|
| Port 22 | TCP | SSH / SFTP / SCP | RFC 4251 / RFC 4253 | High if password auth is exposed publicly; restrict to bastion CIDRs or VPN. |
| Port 25 | TCP | SMTP Mail Relay | RFC 5321 | Frequently abused for spam; most cloud VPCs throttle or block outbound TCP/25 by default. |
| Port 53 | UDP & TCP | Domain Name System (DNS) | RFC 1035 / RFC 7766 | Open recursive resolvers are prime targets for DNS amplification DDoS attacks. |
| Port 67 | UDP | DHCPv4 Server | RFC 2131 | Internal LAN protocol only; never expose UDP/67 or UDP/68 across WAN boundaries. |
| Port 80 | TCP | HTTP Web Traffic | RFC 9110 | Plaintext transport; production sites should redirect TCP/80 to HTTPS TCP/443. |
| Port 123 | UDP | Network Time Protocol (NTP) | RFC 5905 | Legacy monlist commands on unpatched NTP daemons enable severe UDP amplification. |
| Port 161 | UDP | SNMP Polling | RFC 3411 (SNMPv3) | Critical exposure if SNMPv1/v2c default community string 'public' is reachable externally. |
| Port 179 | TCP | Border Gateway Protocol (BGP) | RFC 4271 | Core routing control plane; unauthorized TCP/179 access risks route hijacking or session resets. |
| Port 389 | TCP & UDP | LDAP Directory | RFC 4511 | Cleartext bind credentials unless StartTLS or LDAPS (636) channel binding is enforced. |
| Port 443 | TCP & UDP | HTTPS & HTTP/3 (QUIC) | RFC 9110 / RFC 9000 | Standard public web ingress; harden TLS 1.2/1.3 ciphers and WAF policies. |
| Port 445 | TCP | SMB Direct File Sharing | MS-SMB2 / SMB3 | Extreme ransomware & worm target; NEVER expose TCP/445 to the public internet. |
| Port 465 | TCP | SMTPS Implicit TLS Submission | RFC 8314 | Authenticated client mail submission; protect with rate limits and MFA/app tokens. |
| Port 500 | UDP | IPsec IKEv2 Key Exchange | RFC 7296 | VPN control-plane port; restrict site-to-site peers to known static gateway IPs where possible. |
| Port 514 | UDP & TCP | Syslog Telemetry | RFC 5424 | Unencrypted log transport; never send compliance or security logs over public networks on 514. |
| Port 587 | TCP | SMTP Mail Submission (STARTTLS) | RFC 6409 | Authenticated submission port; enforce mandatory STARTTLS before accepting AUTH credentials. |
| Port 636 | TCP | LDAPS (LDAP over TLS) | RFC 4513 | Internal identity infrastructure; expose only inside private VPCs or VPN tunnels. |
| Port 853 | TCP | DNS over TLS (DoT) | RFC 7858 | Safe outbound privacy protocol; enterprise networks should steer endpoints to approved resolvers. |
| Port 993 | TCP | IMAPS Encrypted Mailbox | RFC 8314 | Standard authenticated client mail retrieval; protect accounts with strong MFA/OAuth2. |
| Port 1194 | UDP & TCP | OpenVPN Tunnel | OpenVPN Protocol | Public VPN concentrator port; enable tls-crypt or tls-auth HMAC packet hardening. |
| Port 1433 | TCP | Microsoft SQL Server | MS-TDS Protocol | Critical database port; never expose TCP/1433 to 0.0.0.0/0. |
| Port 1812 | UDP | RADIUS Authentication | RFC 2865 | Internal AAA security plane; restrict strictly to NAS switches, Wi-Fi controllers, and VPN gateways. |
| Port 2049 | TCP | Network File System (NFSv4) | RFC 8881 | High data-exposure risk; confine strictly to private storage VLANs or cloud VPCs. |
| Port 2379 | TCP | etcd Client API (Kubernetes) | etcd gRPC / TLS | Crown-jewel cluster state store; exposing TCP/2379 leaks every Kubernetes Secret. |
| Port 3306 | TCP | MySQL & MariaDB | MySQL Wire Protocol | Critical relational database port; never expose publicly without private tunneling. |
| Port 3389 | TCP & UDP | Remote Desktop Protocol (RDP) | MS-RDPBCGR | Top brute-force & ransomware vector worldwide; NEVER expose raw 3389 to the internet. |
| Port 4500 | UDP | IPsec NAT Traversal (NAT-T) | RFC 3948 | Required companion port to UDP/500 for modern mobile and cloud IPsec VPNs. |
| Port 5432 | TCP | PostgreSQL Database | PostgreSQL v3 Protocol | High-value data store; restrict strictly to internal application tiers and connection poolers. |
| Port 6379 | TCP | Redis / Valkey In-Memory Store | RESP Protocol | Severe RCE/cryptomining target if exposed; historically designed for trusted private networks. |
| Port 6443 | TCP | Kubernetes API Server | HTTPS / Kubernetes REST | Cluster control-plane gateway; restrict public endpoint CIDRs and enforce RBAC + short-lived OIDC tokens. |
| Port 51820 | UDP | WireGuard VPN | WireGuard NoiseIK | Stealthy UDP listener—drops unauthenticated packets silently without replying to port scans. |