Subnet Vault User Guide
Calculate IPv4 and IPv6 subnets, plan VLSM networks, and diagnose networks with 20 built-in tools — ping, traceroute, DNS, WHOIS, LAN scanning, speed tests, Wake-on-LAN, Bluetooth and NFC.
Table of Contents
Getting Started
How is the app organized?
Subnet Vault has three tabs. Calculate holds the Address calculator and the VLSM planner. Tools holds 20 network tools. Learn holds the OSI Model page, a tutorial, a glossary and reference tables. The gear button at the top right of each tab opens Settings.
Can I choose which screen the app opens to?
Yes. Open Settings and use Launch Screen to pick the tab, and for Calculate or Tools the panel, that the app opens to.
What else is in Settings?
Settings lets you turn haptic feedback on or off, see the iCloud sync status of your saved results, export all saved results, and turn on "Show network owner" for traceroute (see Section 5). It also shows the date of the built-in MAC address maker database.
Subnet Calculations
How do I calculate a subnet?
On the Calculate tab, choose Address and type an address into the field. Results appear as you type; there is no Calculate button. The field accepts a prefix (192.168.1.10/24), a subnet mask (192.168.1.10 255.255.255.0), a wildcard mask (192.168.1.10 0.0.0.255) or an IPv6 address (2001:db8::1/48). If you leave the prefix off, the app assumes /24 for IPv4 or /64 for IPv6 and tells you so.
What do the results include?
The Network section shows the network in CIDR form and whether it is public, private or reserved. Address shows the first and last host, broadcast, usable hosts and total addresses. Masks shows the subnet mask, wildcard mask and prefix. Formats shows the address in hex, as an integer, as a reverse-DNS (PTR) name and, for IPv6, expanded. Binary shows the address and mask bit by bit, color-coded by network and host part; tap its chevron to fold it away.
Can I change the prefix without retyping?
Yes. Use the − and + buttons under the field to shorten or lengthen the prefix one bit at a time. The caption shows how many hosts (or /64s for IPv6) each size holds.
Can I split a network into smaller subnets?
Yes. The Split section divides the network into equal subnets. Use its stepper to choose the subnet size, then tap any subnet in the list to open it. For very large splits, type a subnet number to jump straight to it. The trail above the results takes you back to the network you started from.
Can I check whether an address belongs to a network, or combine two networks?
Yes. In the Contains section, type an address or network to see whether it is inside the current one. In the Supernet section, type another address or network to find the smallest network that holds both.
Does the app support IPv6?
Yes. Type an IPv6 address into the same Address field. IPv6 results add the address scope, embedded IPv4 forms (IPv4-mapped, 6to4 and NAT64) and the number of /64 subnets. If an IPv6 address was built from a MAC address (EUI-64), Inside This Address shows that MAC with an Open in MAC Lookup button.
Can I calculate the network I'm connected to?
Yes. Tap Use My Network under the field to fill in your device's current address and prefix. This needs a Wi-Fi connection.
VLSM Planning
What is VLSM and how do I use it?
Variable Length Subnet Masking (VLSM) divides one network into subnets of different sizes, each just big enough for its hosts. On the Calculate tab, choose VLSM. Enter a base IPv4 network such as 10.20.0.0/22. Under Subnets, type a name and the number of hosts it needs, then tap Add; repeat for each subnet. Tap Calculate to build the plan. The largest subnets are placed first, and each keeps its name.
What does the plan show?
The Plan section shows a color-coded map of the base network, with each subnet numbered to match the legend below it, and how much of the address space is used. Fold the map away with the chevron in the Plan header. The Allocations list shows each subnet's network, and its usable hosts against the hosts you asked for. Tap an allocation to see its masks, ranges and more.
How do I remove a subnet or start over?
Tap a subnet's chip under Subnets to remove it. Clear removes the base network, the subnets and the plan after you confirm.
Does VLSM work with IPv6?
No. The VLSM planner works with IPv4 networks. To divide an IPv6 prefix, use the Split section of the Address calculator.
Using the Network Tools
How do I choose a tool?
On the Tools tab, tap the tool name at the top of the card (marked Change) to open the tool list. Search by name or purpose (for example "tls" or "hops"), tap the Tools title to jump to a category, or pick from Recent, which lists the tools you used last.
How do I run, stop or clear a tool?
Fill in the tool's fields and tap its run button (for example Start, Trace or Look Up). While a tool runs, a second button lets you end it. It reads Stop for tools that keep what they have found so far, such as Ping, Traceroute and LAN Scanner, and Cancel for tools that discard an unfinished run. Clear removes the current tool's results only; other tools keep theirs.
Do results stay when I switch tools?
Yes. Each tool keeps its last result until you clear it or run it again. Switching tools stops anything still running. Tools that take a host name share one host field, so you can ping a host and then trace it without retyping.
Reachability and DNS Tools
How do I test if a host is reachable?
Use Ping. Enter a host name or IP address and tap Start. Tap Options to set the count (4, 10, 50 or Nonstop), the interval (0.2 to 10 seconds), the timeout, the payload size and the IP version. Results update live with the latest reply time and loss. When the run ends you get the minimum, median, maximum, average, standard deviation and jitter, a chart, and the full list of replies; turn on Problems Only to see just the lost or slow ones.
How do I see the path to a host?
Use Traceroute. Enter a host and tap Trace. Each hop shows its address and reply times, up to 30 hops. To see the network operator (autonomous system) that owns each hop, turn on "Show network owner" in Settings. It is off by default because it sends each hop's address to Team Cymru's lookup service.
How do I check which ports are open?
Use Port Scanner. Enter a host, choose Quick (9 of the most common ports, such as 22, 80 and 443) or Common (20 ports), and tap Scan Ports. Results list the open ports by service, with closed and filtered ports folded below. Only scan hosts you own or have permission to test.
What DNS records can I look up?
Use DNS Lookup. Enter a domain and choose the record types: A, AAAA, MX, CNAME, TXT, NS, SOA, SRV and PTR. All are selected to start with. Each record shows its type, name, time to live (TTL) and value.
How do I find the host name for an IP address?
Use Reverse DNS. Enter an IP address and tap Look Up to see the host name registered for it, if there is one.
How do I check whether a DNS change has spread?
Use DNS Propagation. Enter a domain and tap Compare. The app asks four public resolvers (Google, Cloudflare, AdGuard and AliDNS) for the domain's A records and shows whether they agree. A resolver that still has an older answer is marked as differing.
Web, Ownership and Location Tools
How do I check a website's response?
Use HTTP Headers. Enter a URL or host and tap Check. You'll see the status code, the final URL after any redirects, the redirect chain, timing (DNS lookup, connection, TLS handshake and time to first byte) and every response header. This tool checks HTTPS addresses.
How do I inspect a site's SSL/TLS certificate?
Use SSL Certificate. Enter a host or URL and tap Inspect. The result shows whether the certificate is valid, expiring soon or expired, how many days are left, who issued it, the names it covers, the TLS protocol, the key and the full certificate chain. The check uses port 443 unless you add another, like mail.example.com:993.
How can I look up domain information?
Use WHOIS. Enter a domain, an IP address or an AS number (such as AS15169) and tap WHOIS. Results show the registrar or network owner, registration and expiry dates, name servers, status and abuse contacts, from the registry's RDAP service. The raw response is available below.
How do I find where an IP address is located?
Use IP Geolocation. Enter a public IP address or host name and tap Locate, or leave the field empty to locate your own public IP address. Results show the country, region, city, coordinates, time zone and the network provider. Private and local addresses can't be located.
Your Network
How do I see details about my connection?
Use My Network. It runs when you open it and updates when your connection changes. It shows your device, router and internet path, your public IPv4 and IPv6 addresses, NAT type, DNS servers, proxy, and a card for each active connection with its address, subnet mask, router and traffic. From here you can tap Calculate This Subnet, Find Devices in LAN Scanner, or Look Up in MAC Lookup for the Wi-Fi access point. To show your Wi-Fi network's name, tap Allow Location Access; iOS requires location permission for this, and the app never records or sends your location.
How do I test my internet speed?
Use Speed Test and tap Start. Tests run on Measurement Lab (M-Lab), which publishes each test's IP address and results as open data, so the first test asks you to agree before it starts. You can read M-Lab's privacy policy from that screen and withdraw your agreement later. Results show download and upload speed and latency. On cellular or Low Data Mode the app warns you first, because a test uses a lot of data. Your last 50 results are kept on this device under History. If you stop a test, it keeps what was measured so far, but it isn't added to History.
How do I find devices on my network?
Use LAN Scanner and tap Scan. It finds devices on the network your iPhone or iPad is connected to, using Wi-Fi or Ethernet, and shows each device's address, name, maker and the services it offers. Filter by All, Named, With services or New; devices seen for the first time are marked New. Tap a device to name it or to open it in Ping, Port Scanner, MAC Lookup or Wake-on-LAN. Networks larger than a /22 are scanned around your device first, with a button to scan the wider /22. Results stay on your device; use Forget Earlier Scans of This Network in the Export menu to remove them. The scan needs Local Network permission.
How do I discover services like printers and AirPlay devices?
Use Network Services. Choose Quick (3 seconds) or Full (10 seconds) and tap Discover. Services found through Bonjour are grouped by category; tap one to see its address, port and host name.
How do I identify a device from its MAC address?
Use MAC Lookup. Type or paste a MAC address in any common format, or tap the camera button to read it from the device's label. Results appear as you type: the maker, whether the address is private (randomized), what the address bits mean and what the address is known to be used for. You can also wake the device or give it a name. Names you give devices sync through iCloud and appear in Wake-on-LAN, LAN Scanner and My Network. With the field empty, Your Devices lists the devices you have named.
Wake-on-LAN
How do I wake up a device?
Choose Wake-on-LAN on the Tools tab. Enter the device's MAC address, or tap Devices to pick one you have named. The broadcast address is filled in from your current network. Tap Send WOL to send the magic packet to UDP port 9. A wake packet gets no reply, so the app confirms only that it was sent. You can also wake a device from LAN Scanner or MAC Lookup.
Why isn't Wake-on-LAN working?
Check that the device supports Wake-on-LAN and that it is turned on in the device's BIOS or network settings. Make sure the device is asleep or in a low-power state that allows waking, not fully unplugged. Double-check the MAC address and broadcast address, and make sure your iPhone or iPad is on the same network as the device. Wake-on-LAN also needs Local Network permission.
Bluetooth and NFC
How do I find nearby Bluetooth devices?
Use Bluetooth Scanner. Choose Quick (10 seconds) or Extended (30 seconds) and tap Scan. Each device shows its signal strength, and you can sort by signal, name or vendor and filter to named or connectable devices. Expand a device to see its signal history, advertised services and beacon details. iOS does not give apps Bluetooth MAC addresses, so devices are shown by name and identifier.
How do I see what a Bluetooth device offers?
Use Bluetooth Explorer, or tap Explore Services on a device in Bluetooth Scanner. Tap Scan, then tap a device to list its services and characteristics (its GATT profile). The app only reads; it never writes to the device, and it disconnects when done.
How do I read an NFC tag?
Use NFC Tag Reader and tap Read Tag, then hold the top of your iPhone near the tag. Results show the tag's technology, its unique ID, its capacity and every record stored on it.
How do I write to an NFC tag?
Use NFC Tag Writer. Choose a record type, URL, Text or Wi-Fi network, fill it in, and tap Write Tag. Erase Tag clears a tag. Lock Tag… makes a tag permanently read-only; this cannot be undone. NFC requires an iPhone with NFC; these tools aren't available on iPad.
Worldwide Checks
Can I test a host from other parts of the world?
Yes, with Ping, Traceroute, DNS Lookup and HTTP Headers. Set Run from to Worldwide under the host field and tap Run Worldwide. The check runs from up to six locations, one per continent, through the Globalping network, and each location's result is listed separately. Tap Stop to keep the locations that have already answered.
Why won't a worldwide check run?
Worldwide checks need a public host or address, because probes elsewhere can't reach your private network. Private, local and link-local addresses, and names such as .local, are refused. Globalping allows a limited number of free tests per hour from each network; each worldwide run uses up to six.
Saving, Sharing and Exporting
How do I save a calculation?
Tap Save in the Network header of an Address result, or in the Plan header of a VLSM plan. Open saved results with the Saved button under the field. You can search, sort by date, name or size, rename, share, and swipe to open or delete them. Opening a result loads it back into the calculator.
Do saved results sync between my devices?
Yes. Saved results sync through iCloud to every device signed in to the same Apple Account. If you're not signed in to iCloud, they are kept on the device and sync once you sign in. Saved results and glossary terms can also be found with Spotlight search on your device.
How can I share calculation results?
Tap Share in the Network header of an Address result to share everything shown, by Messages, Mail, AirDrop or Save to Files. For a VLSM plan, tap Share and choose Share Summary or Export CSV…. To export every saved result at once, use Export Results in Settings.
How do I export tool results?
Most tools have an Export menu above their results. Choose Text, CSV or JSON to share a file, or Copy as Text to copy the results to the clipboard.
Can I quickly copy specific values?
Yes. Tap the copy icon next to any value. A checkmark confirms the copy. You can also select and copy text from most results.
Learning and Reference
What's in the Learn tab?
OSI Model explains the seven layers of the OSI model and the four layers of TCP/IP, walks a web request down the layers step by step, and lists which protocols carry which. Each layer links to the tools that work at it. The Tutorial covers subnetting and how to use each part of the app. The Glossary defines networking terms. The Binary, IPv4 and Wireless tables are quick references. Learn also has links to rate and share the app, this guide, support, and the privacy policy.
Privacy and Permissions
What permissions does the app ask for?
Each permission is requested only when you use a feature that needs it. Local Network is used for ping, port scans, LAN Scanner, Network Services and Wake-on-LAN. Bluetooth is used for the Bluetooth tools. Location is used only to show your Wi-Fi network's name in My Network. Camera is used only to read a MAC address from a label. NFC is used by the NFC tools. If you turn a permission off, the tool explains what's missing and offers a button to Settings.
Does Subnet Vault collect my data?
No. The app has no analytics, advertising or tracking. Calculations, saved results and LAN scan history stay on your device and in your own iCloud. Some tools work by asking a public internet service, such as a DNS resolver, M-Lab or Globalping, and send only what you look up. The privacy policy lists each service and what it receives.