Network & Security Tools — IP, Headers, TLS & CIDR
Four tools for the questions that come up when something works locally and fails in production.
4 tools · Reviewed by Mimamsa, Founder & Engineer, CodeLint.Dev
Network problems are mostly problems of visibility. The request leaves your machine and something between here and there changes it — a proxy strips a header, a certificate chain is missing an intermediate, a subnet mask is one bit off and half your hosts are unreachable.
The header checker takes raw response headers you have captured — from curl -I, your browser devtools, or a server log — and grades the security-relevant ones against current practice: HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and the rest. Because you paste what you actually observed, it works on staging, on an internal host, and on any response behind authentication, none of which a fetch-based checker can reach.
The certificate decoder parses a PEM certificate and shows the subject, issuer, validity window, SANs and key details — most usefully, whether the chain is complete. An incomplete chain is the classic "works in my browser, fails in curl and on Android" bug, because desktop browsers often cache a missing intermediate from an earlier visit and other clients do not.
The CIDR calculator converts prefix notation into the numbers you actually need: network and broadcast address, usable host range, and total count. Subnet arithmetic in your head is a reliable way to introduce an outage.
Inspection
Addressing
IPv4 subnet quick reference
The prefixes that come up most often, with usable host counts:
| CIDR | Subnet mask | Usable hosts | Typical use |
|---|---|---|---|
| /32 | 255.255.255.255 | 1 | A single host — firewall rules, allow-lists |
| /30 | 255.255.255.252 | 2 | Point-to-point link between two routers |
| /29 | 255.255.255.248 | 6 | A very small device segment |
| /24 | 255.255.255.0 | 254 | The classic office or VLAN subnet |
| /16 | 255.255.0.0 | 65,534 | A large private network or a whole VPC |
| /8 | 255.0.0.0 | 16,777,214 | The 10.0.0.0/8 private range in full |
In-depth guides
Long-form articles covering the standards and formulas behind these tools.
Frequently asked questions
- Why does my certificate work in Chrome but fail in curl?
- Almost always an incomplete chain. Your server is serving the leaf certificate without the intermediate that links it to a trusted root. Desktop browsers frequently paper over this — they cache intermediates from previous sites or fetch them via the AIA extension — while curl, Java, Python and Android clients do not. Serve the full chain: leaf first, then intermediates, root omitted.
- Which security headers actually matter?
- In rough order of impact: Content-Security-Policy, which is the main defence against cross-site scripting and also the hardest to get right; Strict-Transport-Security, which stops downgrade attacks after the first visit; X-Content-Type-Options: nosniff, which is a one-line header with no downside; and Referrer-Policy, which prevents URLs — often containing tokens or IDs — leaking to third parties. X-Frame-Options is now largely superseded by CSP frame-ancestors, though sending both remains harmless.
- How accurate is IP geolocation?
- Reliable at country level, roughly right at city level, and not meaningful below that. It resolves the network operator’s registered location, not the device — so a VPN, a mobile carrier’s central gateway, or a corporate network can place a user hundreds of miles away. Never use it as an authentication or fraud signal on its own.
- Why are two addresses unusable in an IPv4 subnet?
- The first address identifies the network itself and the last is the broadcast address, so a /24 has 256 addresses but 254 usable hosts. IPv6 drops this convention entirely — it has no broadcast address, and all addresses in a subnet are assignable.