Core Concepts

How IPCraft organizes your network data.

Organizations

Every IPCraft account belongs to an organization. Your organization is your tenant boundary. All subnets, addresses, and settings are scoped to your organization and completely isolated from other tenants at the database level using PostgreSQL row-level security.

Folders

Folders are top-level groups that group your subnets by purpose, location, or environment. Examples:

Production — production network infrastructure
Development — dev/staging environments
Office — corporate LAN, WiFi, VPN
Datacenter US-East — grouped by physical location

Folders are optional. Subnets can exist without a folder assignment.

Subnets

Subnets represent CIDR blocks in your network. They form a hierarchy: a /16 can contain multiple /24s, which can contain /28s, and so on.

Automatic nesting: When you create a new subnet, IPCraft automatically finds its parent in the tree. Adding 10.1.1.0/24 when 10.1.0.0/16 already exists will nest the /24 under the /16. Any addresses already recorded in the /16 that fall inside the new /24 move into it, and so does the /16's gateway if it's one of them.

One record per address: An address is recorded on the most specific subnet that contains it, so each IP has exactly one record in its VRF. Once the /24 exists, 10.1.1.5 can only be recorded in the /24: the /16's address list shows the /24's range as a single child subnet row (click it to open the /24) instead of listing those IPs as available, and assigning one on the /16 is refused with a message that names the /24. The same goes for a gateway: a subnet's gateway can't sit inside one of its children.

Overlap detection: Subnets are CIDR blocks, so any two either nest — one fully contains the other — or occupy entirely separate space. Containment is expected and auto-nested; creating an exact duplicate of a subnet already in the same VRF is rejected.

Splitting: You can split any subnet into equal parts (powers of 2). Splitting a /24 into 4 creates four /26 subnets. Address records in the original subnet are moved into whichever new subnet contains them, so hostnames, MACs, and statuses survive the split. If you'd rather start clean, the split dialog has an option to discard the records instead.

Utilization: Each subnet shows what percentage of its usable addresses are assigned. The tree view color-codes this: green (<70%), yellow (70-85%), red (>85%).

Roll-up counts: A parent subnet's usage includes the addresses recorded in its child subnets, so a /16 whose /24s are filling up doesn't read as empty. Wherever a count includes descendants — like the dashboard's IP Address Footprint — it's marked with an asterisk (230/65534*). The subnet's own detail view shows only the addresses recorded directly in it, with a separate note for how many live in its children.

Container subnets: Some large subnets exist only to give your address plan structure — a 10.10.0.0/16 that designates "corp" space while its child /24s hold the actual assignments. Nobody reserves IPs out of the /16 itself, so measuring its utilization is meaningless: at /16 scale it reads as a permanent <1%, and its 65,000+ addresses of phantom capacity dilute your dashboard's overall utilization into a rounding error. Untick Track IP usage in the subnet's edit dialog to mark it as a container: the tree shows a Container badge instead of a utilization bar, and the subnet drops out of the dashboard's capacity, utilization, and status-mix numbers. Child subnets are unaffected — they keep their own bars and stats — and you can still record addresses in a container if you need to. New subnets are tracked by default.

Carving out child subnets: To allocate new space inside a parent, use the + action on its row in the subnet tree. Pick a size (say, a /24) and IPCraft computes the free blocks that don't collide with any existing subnet in the same VRF, shows how many remain, and pre-fills the create dialog with the block you choose — no manual CIDR math, no after-the-fact overlap surprises. The same computation is available to scripts via the free-blocks endpoint.

Gateway: A subnet's gateway field and an address record with the gateway status are kept in sync: setting one updates the other. Set the gateway on the subnet and IPCraft creates (or re-flags) the matching address record; mark an address as gateway and the subnet's gateway field follows.

Addresses

Addresses represent individual IP assignments within a subnet. Each address tracks:

IP — the IPv4 or IPv6 address
Hostname — the device or service name
Status — Assigned, Reserved, D-DHCP (dynamic DHCP), M-DHCP (manual DHCP reservation), or Gateway
MAC Address — the hardware address
Owner — person or team responsible
Description — notes about the assignment

For subnets /22 and smaller, the UI shows all usable IPs with available addresses highlighted for easy assignment.

VLANs, VRFs & Locations

Beyond folders, three optional dimensions help model real networks:

VLANs — tag subnets with a VLAN number (1–4094) and name so layer-2 segmentation is visible next to your addressing plan.
VRFs — virtual routing and forwarding instances. Overlap detection is scoped per VRF, so the same CIDR (e.g. 10.0.0.0/24) can exist once per VRF — useful for multi-tenant networks and overlapping RFC 1918 space.
Locations — physical sites (offices, datacenters) that subnets and VLANs can be tagged with. The Locations page lists each site with its address and how many subnets and VLANs are assigned to it.

Each has its own page in the app sidebar and full CRUD support in the API. When importing CSVs, VLANs, VRFs, and locations referenced by name are created automatically.

Overlaps

The Overlaps page surfaces subnets that share address space but are not in a direct parent/child relationship in the tree — the cases worth a second look. Because subnets are CIDR blocks, an overlap is always one of two kinds: a duplicate (two subnets with the exact same CIDR in different VRFs) or a containment (one subnet fully inside another without being its tree child). Normal nesting never appears here. A healthy address plan shows an empty Overlaps page.

Activity Log

Every change — create, update, delete, split, import, export — is recorded in the Activity log with a timestamp, the acting user, the source (web or API key), and a field-level diff of what changed. How far back the log retains depends on your plan (7 days on Free, up to 730 on Enterprise).

Entries are chained with a SHA-256 tamper-evidence hash. Each entry's hash covers the action and resource, the recorded changes, the acting user and their email, the source IP address, and the timestamp, plus the previous entry's hash, so an edited, deleted, or reordered entry breaks the chain at that point. Entries recorded before the hash covered all of these fields are checked against the fields they were hashed with: the action and resource.

Click Verify integrity on the Activity page to re-check the chain; IPCraft reports how many entries verified and skips any that predate hashing.

The Hierarchy

IPCraft's data model follows a natural network hierarchy:

Organization
  └── Folder (Production)
        ├── Subnet (10.0.0.0/16 — US East)
        │     ├── Subnet (10.0.1.0/24 — Web)
        │     │     ├── 10.0.1.1 — gateway-01 (Gateway)
        │     │     ├── 10.0.1.2 — web-01 (Assigned)
        │     │     ├── 10.0.1.3 — web-02 (Assigned)
        │     │     └── 10.0.1.4 — (Available)
        │     └── Subnet (10.0.2.0/24 — Database)
        └── Subnet (10.0.0.0/24 — Management)

Plan Limits

Each plan has limits on how many resources you can create:

Free ($0/mo): 1 user, 5 folders, 100 subnets, 1,500 IPs, read-only API, 10 req/s, 7 day activity log
Pro ($29/mo): 2 users, unlimited folders & subnets, 5,000 IPs, read/write API, 50 req/s per user, 30 day activity log
Teams ($199/mo): 10 users, unlimited folders & subnets, 10,000 IPs, read/write API, 50 req/s per user, 90 day activity log
Enterprise (Contact Us): Custom users, folders, subnets, and IPs, read/write API, custom rate limit, custom activity log

Plans also set limits on VLANs, VRFs, locations, webhooks, and API keys — see the full limits table in the API reference. When you hit a limit, the API returns 402 Payment Required with a message to upgrade.