Zero-Dependency Subnet Math & IP Engineering in TypeScript
Demystifying bitwise operators, unsigned 32-bit integer conversions, CIDR prefix masking, and fast subnet membership tests in high-throughput edge environments.
Key Architectural Takeaways
>>> 0).ipInSubnet() in < 0.001ms.1. The 32-Bit Integer Representation of IPv4
Every standard IPv4 address (e.g., 192.168.1.1) is merely a human-readable representation of a 32-bit unsigned integer. Each of the four octets represents an 8-bit byte ($2^8 = 256$ values, from 0 to 255).
In JavaScript/TypeScript, bitwise operators operate on 32-bit signed two’s complement integers. To prevent negative numbers when the most significant bit (MSB) is 1 (e.g., in 192.x.x.x), we use the zero-fill right shift operator (>>> 0) to force an unsigned 32-bit integer:
// Convert IPv4 String to Unsigned 32-bit Integer
export function ipToInt(ip: string): number {
const [o1, o2, o3, o4] = ip.split('.').map(Number);
return ((o1 << 24) | (o2 << 16) | (o3 << 8) | o4) >>> 0;
}
// Convert Unsigned 32-bit Integer back to IPv4 String
export function intToIp(int: number): string {
return [
(int >>> 24) & 255,
(int >>> 16) & 255,
(int >>> 8) & 255,
int & 255,
].join('.');
}2. Subnet Mask & Wildcard Mask Arithmetic
In Classless Inter-Domain Routing (CIDR), the prefix length denotes how many bits from the left are fixed for the network identifier. For example, a /24 prefix indicates that the first 24 bits are 1s and the remaining 8 bits are 0s.
// CIDR Prefix to Subnet Mask (e.g., 24 -> "255.255.255.0")
export function cidrToSubnetMask(cidr: number): string {
if (cidr === 0) return '0.0.0.0';
const maskInt = ((0xffffffff << (32 - cidr)) >>> 0);
return intToIp(maskInt);
}
// Wildcard (Inverse) Mask (e.g., 24 -> "0.0.0.255")
export function cidrToWildcardMask(cidr: number): string {
const maskInt = cidr === 0 ? 0 : ((0xffffffff << (32 - cidr)) >>> 0);
const wildcardInt = (~maskInt) >>> 0;
return intToIp(wildcardInt);
}3. Computing Network Boundaries & Usable Host Ranges
Given any IP address and its subnet mask:
- Network Address:
ipInt & maskInt(the lowest address in the block). - Broadcast Address:
networkInt | wildcardInt(the highest address in the block). - First Usable Host:
networkInt + 1. - Last Usable Host:
broadcastInt - 1. - Total Usable Hosts:
2^(32 - cidr) - 2(excluding network and broadcast addresses).
// Full Subnet Calculator Pipeline
export function calculateSubnet(ipOrCidr: string): SubnetCalculationResult {
const [ip, cidrStr] = ipOrCidr.split('/');
const cidr = parseInt(cidrStr, 10);
const ipIntVal = ipToInt(ip);
const maskIntVal = ((0xffffffff << (32 - cidr)) >>> 0);
const wildcardIntVal = (~maskIntVal) >>> 0;
const networkIntVal = (ipIntVal & maskIntVal) >>> 0;
const broadcastIntVal = (networkIntVal | wildcardIntVal) >>> 0;
return {
ip,
cidr,
subnetMask: intToIp(maskIntVal),
wildcardMask: intToIp(wildcardIntVal),
networkAddress: intToIp(networkIntVal),
broadcastAddress: intToIp(broadcastIntVal),
firstUsableIp: intToIp(networkIntVal + 1),
lastUsableIp: intToIp(broadcastIntVal - 1),
totalHosts: Math.pow(2, 32 - cidr),
usableHosts: Math.pow(2, 32 - cidr) - 2,
isPrivate: isPrivateIp(ip),
};
}4. High-Throughput Subnet Membership Queries
In security firewalls, edge rate-limiters, or proxy handlers, verifying whether a client IP belongs to a trusted CIDR block can be done in 3 integer comparisons:
export function ipInSubnet(targetIp: string, networkCidr: string): boolean {
const subnet = calculateSubnet(networkCidr);
const targetInt = ipToInt(targetIp);
const networkInt = ipToInt(subnet.networkAddress);
const broadcastInt = ipToInt(subnet.broadcastAddress);
return targetInt >= networkInt && targetInt <= broadcastInt;
}
// Usage:
ipInSubnet('192.168.1.150', '192.168.1.0/24'); // true
ipInSubnet('10.0.0.1', '192.168.1.0/24'); // falseAvailable Open Source on npm & GitHub
Install @epheos/network-tools with zero external dependencies for Node.js, Deno, Bun, or Cloudflare Workers.