How it works
The check is done by applying the subnet mask (derived from the CIDR prefix) to both the network address and the given IP, and comparing the result — if the two resulting "network addresses" match, the IP belongs to the subnet.
Common use
Useful for quickly checking whether a server, device or firewall range is within the expected reach of a subnet, without doing the binary math by hand.
Frequently asked questions
Do the network address and broadcast count as "belonging"?
Yes, they technically belong to the subnet range, though they aren't addresses assignable to a host (they're reserved to identify the network and for broadcast).
Does it work with any prefix, from /0 to /32?
Yes — including /32 (a single host) and /31 (used in point-to-point links, with no reserved network/broadcast addresses).