SubnetPilot helps cloud teams and network engineers turn vague IP address space into auditable segments, policy zones, routing notes, and change-review evidence — entirely in the browser, before a single subnet ships to production.
SubnetPilot takes a plain-language network design goal (for example: segmented VPC for prod, staging, data, admin, and vendor access) and returns a structured segmentation plan:
- CIDR planning — splits address space by environment, sensitivity, and expected growth.
- Zone intent — states explicitly what each subnet is allowed to talk to, so allowed traffic is a design decision, not an accident.
- Blast radius analysis — shows what fails or leaks if a given zone is compromised, ranked by risk (public edge, private app, data tier, admin zone).
- Export path — frames the plan for Terraform export, review notes, and change records.
- Design confidence score — a scored output with a remediation queue and contributor missions for extending the planner (Terraform export, cloud import, policy simulation, capacity forecasting).
- Built on Next.js App Router with TypeScript and Tailwind CSS 4, deployed as Vercel serverless functions, entirely client-driven with no account or stored infrastructure state.
app/components/subnetMath.tsdoes the real work: parses a CIDR block into network/broadcast/first-host/last-host addresses and IP class using bitwise integer math, and splits a block into smaller subnets.CidrCalculatorPanel.tsxandSubnetSplitterPanel.tsxare the two real tools; the homepage "intelligence" score is a separate decorative widget, not part of the calculator.
The real problem: CIDR math is simple in theory (bitmasks) and easy to get wrong in practice under time pressure — an off-by-one on a broadcast address during an incident is exactly the kind of mistake this tool exists to prevent.
The approach: every address is converted to a 32-bit integer (ipToInt) using real bitwise operators (<<, >>>, |) rather than string manipulation, so network/broadcast/host-range calculations are exact integer math, not approximations — then converted back to dotted-decimal for display.
One real number: IP class detection reads the first octet directly (<128 → A, <192 → B, <224 → C, <240 → D/multicast, else E/reserved) — the same boundaries from the original classful addressing scheme, still useful context even in a CIDR-only world.
Not handled yet: IPv6 isn't supported — this is an IPv4-only calculator, and the homepage "intelligence" score is unrelated decorative copy, not a feature of the calculator.
| Layer | Technology |
|---|---|
| Framework | Next.js (App Router) |
| UI | React 19, Tailwind CSS 4 |
| Language | TypeScript |
| Planning engine | Deterministic segmentation and scoring model |
| Deployment | Vercel serverless functions |