Verify RFC compliance, flag CGNAT/bogons/multicast, detect risks before deploying.
Paste multiple CIDRs (one per line) to validate them all at once.
This is the safety check that catches the boring-but-painful bugs. The validator inspects a CIDR against a battery of RFC compliance rules and well-known reserved-range checks. It flags:
192.168.1.5/24 when they meant 192.168.1.0/24. The validator normalizes and warns.The single-CIDR validator is for spot-checking. The bulk validator takes a list of CIDRs and runs every check against each one — useful for auditing an existing network design, validating a firewall rule import, or screening an IP allowlist before deployment. Paste a list, get back a pass/warn/fail per line.
If you find conflicts between subnets (overlap, containment), the overlap tool in the main calculator handles pairwise checks, and the IPAM tool tracks an inventory and flags new conflicts as you add allocations.
For the differences between the RFC 1918 private ranges and RFC 6598 CGNAT space (a common source of validation failures), see RFC 1918 vs RFC 6598. For the more obscure reserved ranges that show up in surprising places, bogon IP ranges covers the lot. If your validation surfaced a real overlap in production, troubleshooting overlapping CIDRs is the recovery playbook.
The validator runs each CIDR through a battery of RFC compliance checks: host bits set in the input, reserved ranges (Class E, multicast, loopback, link-local), private vs public classification, CGNAT detection, TEST-NET ranges, and edge cases like /31 and /32. The bulk validator runs the same checks against an entire list at once.
Because 100.64.0.0/10 is the CGNAT range reserved under RFC 6598 for Internet Service Providers, not for enterprise networks. Using CGNAT space in your own network can collide with your ISP's NAT and cause unpredictable routing. The validator flags it so you do not deploy a network that may conflict in production.
A bogon is an IP address that should not appear on the public internet — including unallocated ranges, reserved ranges, and addresses from RFC 1918 private space. A martian is a stricter category: an IP that should not appear as a packet source or destination in normal routing. All martians are bogons; not all bogons are martians. The validator flags both categories.
Yes. The bulk validator on this page accepts a newline-separated list and returns pass/warn/fail results for each entry. Use it for auditing firewall rule imports, validating IP allowlists before deployment, or screening a network design.