Last reviewed: May 2026
You have an IP from a firewall log, a packet capture, or an alert — and a subnet inventory somewhere in a spreadsheet. Paste both here and get the answer immediately, resolved by longest prefix match, the same rule a router uses.
Open the full subnet calculator →In any sensible address plan an IP sits inside several nested blocks at once. 10.2.16.5 is legitimately inside 10.0.0.0/8, 10.2.0.0/16, and 10.2.16.0/20 — these are not conflicts, they are hierarchy.
The rule for picking between them is simple: the longest prefix wins, because a longer prefix describes a smaller, more specific network. A /20 is more specific than a /16, which is more specific than a /8. Routers apply exactly this rule on every forwarding decision, which is why matching it here gives you the answer that reflects real traffic behaviour.
If two subnets of identical prefix length both contain the address, that is not hierarchy — it is an overlap, and it is a defect in the address plan. It causes unpredictable routing, blocks VPC peering, and breaks route propagation. This tool flags that case explicitly rather than silently picking one. If you see it, run your full inventory through the summarization tool or the conflict checker on the main calculator to find every overlapping pair.
Compare the IP against every subnet in your inventory: it belongs to a subnet if it falls between that subnet's network and broadcast addresses. If several subnets contain the address, the correct answer is the one with the longest prefix — the most specific match — which is the same rule a router uses when forwarding.
Longest prefix match is the rule routers use to choose between overlapping routes. When an address matches more than one prefix, the one with the largest prefix length wins because it describes the most specific network. For example, 10.2.16.5 matches both 10.0.0.0/8 and 10.2.16.0/20, but the /20 is used.
In a hierarchical address plan, yes — an address is normally inside a large supernet and a smaller subnet at the same time, which is expected and correct. What is not expected is two subnets of the same size containing the same address, which indicates an overlap in your address plan and should be corrected.