FAQ & GLOSSARY

A browser-based network diagnostic tool. Paste an IP address, subnet, MAC address, domain, port number or ASN into the search box, and it identifies what you entered and reports everything it can:

• IP addresses — subnet math, ownership (WHOIS/RDAP), ASN, and reputation against Spamhaus ZEN, SpamCop, and Barracuda.
• Subnets — split, aggregate, compare, range conversion, and the interactive subnet planner.
• Domains — full DNS zone, SOA, email authentication (SPF/DMARC/DKIM), WHOIS/RDAP registration, TLS certificate details, DNS propagation across four resolvers, and domain reputation against Spamhaus DBL, SURBL, and URIBL.
• MAC addresses — vendor lookup from the IEEE OUI database.
• Ports — service name, transport protocol, and IANA registration status.
• ASNs — operator name, description, and announced IPv4/IPv6 prefixes.

Not persistently. All subnet and address math runs entirely in your browser. Looked-up IPs and domains may be briefly held in server memory to avoid redundant external fetches (anonymous — no attribution to you, cleared on restart); nothing is written to a database or file. Standard web-server access logs capture each request as with any website. Your recent lookups are kept only in your own browser's local storage for the history dropdown — clear your browser data and they're gone.

Every successful lookup is saved to your browser's local storage. Click the ▼ arrow at the right side of the search box to open the history dropdown and re-run a previous entry. You can also press Arrow Up / Arrow Down while the search box is focused to scroll through past entries, and Escape to dismiss. History is stored only in your own browser; clear browser data to remove it.

It depends on the lookup type:

• In your browser (no server involved): all subnet and address math; DNS record lookups (via DNS-over-HTTPS to Google or Cloudflare); IP and domain blocklist checks (DNSBL via DoH); DNS propagation checks.
• Via the Palantiri server (anonymously proxied): IP WHOIS/RDAP (to registry servers such as ARIN, RIPE, APNIC); domain RDAP/WHOIS; TLS certificate fetching; ASN data from RIPEstat; MAC vendor lookups from the local IEEE OUI database.

In all cases the tool simply formats what those authoritative sources return. No results are stored beyond the short-lived in-memory cache described above.

An Internet Protocol (IP) address is the numeric identifier a device uses to send and receive data on a network. Every packet carries a source and destination IP, much like a postal address on an envelope. There are two versions in use today: IPv4 and IPv6.

The original, still-dominant format: a 32-bit number written as four decimal octets (0–255) separated by dots, e.g. 192.168.1.10. That gives roughly 4.3 billion possible addresses — not enough for the modern internet, which is why IPv6 exists and why techniques like private addressing and NAT are used.

The newer format: a 128-bit number written as eight groups of four hexadecimal digits separated by colons, e.g. 2001:0db8:0000:0000:0000:0000:0000:0001. Long runs of zeros can be compressed to :: once per address, shortening that to 2001:db8::1. The address space is effectively inexhaustible.

The reverse of a normal lookup: instead of turning a name into an IP, it turns an IP back into a hostname using a special PTR record. Mail servers and logs often use it to attach a human-readable name to an address. Many IPs have no PTR record at all.

Yes, for every public IP address. Three DNS-based blocklists (DNSBLs) are queried directly from your browser via DNS-over-HTTPS, so nothing goes through the Palantiri server:

• Spamhaus ZEN — the combined Spamhaus list. A hit can mean a direct spam sender (SBL), an infected/proxied host (XBL), or a dynamic/consumer IP that shouldn't send email directly (PBL). PBL listings are common and are not a sign of compromise — they simply mean the IP is in a range ISPs have declared is not a mail server. SBL and XBL hits are the ones to investigate.
• SpamCop — spam reports submitted by users and traps.
• Barracuda — Barracuda Networks' IP reputation service.

A Clean result means the address was not found in that list at query time. These lists change frequently; a result reflects the current state, not a permanent verdict.

A subnet is a block of consecutive IP addresses treated as one network. An address is split into a network part (shared by every host in the block) and a host part (unique to each device). Subnetting is how a large address range is divided into manageable, isolated segments.

Both describe how many bits belong to the network part.

• A subnet mask writes it as an address, e.g. 255.255.255.0.
• CIDR / prefix length writes the same thing as a slash-number, e.g. /24 — meaning the first 24 bits are network, leaving 8 bits for hosts.

192.168.1.0/24 and 192.168.1.0 255.255.255.0 mean the same network.

Within a subnet:

• Network address — the first address; it names the subnet itself and isn't assigned to a host.
• Broadcast address (IPv4) — the last address; data sent here reaches every host on the subnet.
• Usable host range — everything in between, the addresses you can actually assign to devices.

A /32 in IPv4 (or /128 in IPv6) describes exactly one address — a single host with no surrounding network. When you enter an address with no prefix, Palantiri treats it as that one host. Add a prefix such as /24 to analyze the wider subnet around it.

Palantiri has a built-in subnet calculator: type a short expression into the same search box you use for everything else (or click one of the Subnet ops example buttons under the box) and press Analyze. It works out which operation you mean from the way you type it, and computes the answer entirely in your browser — nothing is sent anywhere. All four operations are IPv4 (IPv6 is planned).

1. Split a block into smaller subnets. Use this when you have one network and need to divide it into several. Three ways to ask:

• 10.0.0.0/22 split 4 — into 4 equal subnets (here, four /24s).
• 10.0.0.0/22 /24 — down to a target prefix (every /24 inside the /22).
• 10.0.0.0/24 hosts 50 — into subnets that each fit at least 50 devices (it picks /26, giving 62 usable each).

The result lists every subnet with its address range and usable-host count.

2. Turn an address range into CIDR blocks. Use this when something gives you a start–end range and you need the CIDR notation for a config or firewall rule. Type the two addresses with a dash:

• 10.0.0.0 - 10.0.3.255 → 10.0.0.0/22 (the minimal set of blocks that exactly covers the range).

3. Aggregate a list of blocks. Use this to summarise a messy routing table or allow-list into the fewest entries. Separate the blocks with commas:

• 10.0.0.0/24, 10.0.1.0/24 → 10.0.0.0/23.

4. Compare two blocks. Use this to check whether one network sits inside another, partly overlaps it, or is completely separate. Join the two with in or vs:

• 192.168.1.5 in 192.168.0.0/16 → reports contains, partial overlap, or disjoint, and shows the overlapping range if any.

Every result can be exported to JSON or CSV with the buttons at the top, just like any other lookup.

An interactive tool that lets you carve a parent IPv4 block into named subnets and see how space is used in real time. Unlike the split and aggregate operations, the planner is stateful — you build a layout by adding one subnet at a time, giving each a name and prefix length, and the planner keeps track of what is allocated and what remains free. All computation runs entirely in your browser; nothing is sent to a server.

Type a subnet followed by the word plan into the search box and press Analyze — for example 10.0.0.0/22 plan or 192.168.1.0/24 plan. You can also click the 10.0.0.0/22 plan example chip below the search box. Any valid IPv4 subnet works as the parent block.

Below the visual bar there is an Add subnet form with two fields:

• Name — a label for the subnet, e.g. LAN, DMZ, Management. Purely for readability; any text is accepted.
• Prefix — the size of the allocation as a CIDR prefix length, e.g. /26 for 64 addresses, /28 for 16 addresses. Must be more specific than the parent — i.e. a higher prefix number (e.g. /26 inside a /22).

Click Add and the subnet is placed at the next available aligned position inside the parent block. Each added subnet appears in the table below and in the visual bar.

IPv4 subnets must start on a natural boundary — an address whose numeric value is a multiple of the subnet size. For example, a /26 (64 addresses) must begin at a multiple of 64: 0, 64, 128, 192, and so on. The planner enforces this automatically — it advances past any existing allocations, then snaps to the next valid boundary for the requested prefix. This means small gaps may appear between allocations if the natural boundary falls a few addresses ahead of the current position; those gaps are shown as free space in the bar and count toward the remaining available addresses.

The bar is a proportional view of the entire parent block:

• Solid pink segments are allocated subnets. The subnet name and prefix appear as a label inside the segment when it is wide enough; hover the segment for the full range and usable host count.
• Diagonal-stripe segments are free (unallocated) address space. Hover for the address range and size.

The bar is built with inline SVG, so it fills edge-to-edge and is pixel-accurate regardless of screen width. Start IP and end IP of the parent block are labelled beneath it.

Yes. Each row in the allocation table has a small × button on the right. Clicking it removes that subnet and frees its space immediately — the bar and the remaining free-space summary update straight away. Allocations are placed in address order, not necessarily the order you added them, so removing one from the middle returns its range to free space without affecting the others.

Below the allocation table, the planner lists each contiguous free block that remains inside the parent subnet. For each gap it shows the start address, end address, total size in addresses, and the equivalent CIDR notation. This makes it easy to see what sizes can still be allocated without manually subtracting ranges.

Public addresses are globally unique and routable across the internet. Private addresses (defined by RFC 1918) are reserved for internal networks and are not routable on the public internet — many separate networks reuse them behind a router. The private ranges are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Some ranges have dedicated purposes:

• Loopback (127.0.0.0/8, ::1) — refers to the device itself; traffic never leaves the machine.
• Link-local (169.254.0.0/16, fe80::/10) — auto-assigned, valid only on the local network segment.
• CGNAT (100.64.0.0/10) — carrier-grade NAT, used by ISPs to share public IPs among many customers.
• Multicast / reserved — addresses set aside for one-to-many delivery or future use.

A Media Access Control (MAC) address is the hardware identifier burned into a network interface (Wi-Fi, Ethernet, Bluetooth). It's a 48-bit value written as six hexadecimal pairs, e.g. B8:27:EB:12:34:56. Unlike an IP, which can change as a device moves between networks, a MAC identifies the physical adapter and operates only on the local network segment.

The first half of a MAC address (the first 24 bits) is the Organizationally Unique Identifier (OUI), assigned by the IEEE to the hardware manufacturer. Looking it up reveals which company made the adapter — Apple, Cisco, Raspberry Pi, etc. Palantiri matches it against a local IEEE database of 57k+ registered vendors.

A human-friendly name for a resource on the internet, e.g. example.com. Because people remember names more easily than numbers, the Domain Name System maps domains to the IP addresses that actually carry traffic.

The Domain Name System is the internet's directory. It translates domain names into IP addresses (and stores other information about a domain) through a distributed network of nameservers. Every time you visit a website, a DNS lookup happens first.

A domain's DNS "zone" holds several record types:

• A — maps the name to an IPv4 address.
• AAAA — maps the name to an IPv6 address.
• CNAME — an alias pointing one name at another.
• MX — mail exchanger; which servers receive email for the domain.
• TXT — free-form text, commonly holding SPF, DKIM and verification records.
• NS — the authoritative nameservers for the domain.
• SOA — "start of authority"; administrative details for the zone.
• PTR — reverse mapping from an IP back to a name.

A method of performing DNS lookups over an encrypted HTTPS connection instead of plain, unencrypted DNS. It keeps queries private from eavesdroppers on the network. Palantiri uses public DoH resolvers to fetch a domain's records directly from your browser.

Yes. For every domain lookup, the Palantiri server connects to the domain on port 443 and retrieves the active TLS certificate. The result shows the subject (CN), issuer, valid-from and expiry dates, days remaining, Subject Alternative Names (SANs), and the negotiated cipher suite. Expired or soon-to-expire certificates are highlighted in red or amber. Private or non-existent domains that do not serve TLS will show an error instead.

Three DNS-published mechanisms that receiving mail servers use to verify that an email genuinely came from the domain it claims:

• SPF (Sender Policy Framework) — a TXT record listing which IP addresses are authorised to send email for the domain. A receiving server rejects or marks mail from unlisted senders.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) — a TXT record at _dmarc.example.com that tells receivers what to do with messages that fail SPF or DKIM checks (none / quarantine / reject), and where to send aggregate reports.
• DKIM (DomainKeys Identified Mail) — a cryptographic signature added to outgoing messages. The public key is published as a TXT record; Palantiri checks for a key at the common default._domainkey selector.

Missing or misconfigured records are common causes of email being rejected as spam.

When a DNS record is created or changed, it takes time for the update to spread across the internet's resolver infrastructure. Palantiri queries the domain's A record from four independent public resolvers — Google (8.8.8.8), Cloudflare (1.1.1.1), Tiarap, and DNS.SB — and shows what each one currently returns. If they differ, propagation is still in progress. All four queries run directly from your browser via DNS-over-HTTPS.

For every domain lookup, three DNS-based domain blocklists (domain DBLs) are queried from your browser via DNS-over-HTTPS:

• Spamhaus DBL — domains actively used in spam, phishing, malware delivery, or botnet command-and-control. Also flags "abused legitimate" domains that have been hijacked or are hosting malicious content.
• SURBL — URI/domain reputation data aggregated from spam traps and honeypots; covers spam, phishing, malware, and abused registrations.
• URIBL — a real-time domain and URI blocklist used by spam filters worldwide; categories include black (confirmed spam), grey (suspicious), and red (recently observed in spam).

A Clean result means not currently listed. These lists update continuously; a clean result today does not guarantee future status.

A long-standing protocol and database for looking up who is responsible for a domain or IP address — the registered organization, contacts, allocation dates and so on. Modern privacy rules often redact personal details, but network-level ownership remains public.

The Registration Data Access Protocol is the modern, structured successor to WHOIS. It returns the same kind of registration data in a standardized JSON format that's easier and more reliable to parse. Where available, Palantiri prefers RDAP and falls back to other sources.

Every domain carries one or more EPP status codes (also shown by RDAP) that describe its state — whether it's locked, has pending changes, or has stopped resolving. Palantiri colours each one following ICANN's definitions, which distinguish codes set by your registrar (client…) from those set by the registry (server…):

• Green — healthy. active (no restrictions), or an owner-set protection lock that guards the domain against hijacking, transfer or deletion: clientTransferProhibited, clientDeleteProhibited, clientUpdateProhibited, clientRenewProhibited.
• Yellow — heads-up. A pending operation or grace period (pendingTransfer, pendingUpdate, autoRenewPeriod, redemption-adjacent grace windows…), or a registry-level lock (serverTransferProhibited and the other server…Prohibited codes), which ICANN notes can accompany a dispute or pending deletion — worth a closer look.
• Red — suspended or being lost. The domain isn't resolving or is heading for deletion: clientHold, serverHold, inactive, pendingDelete, redemptionPeriod.

The various …Prohibited locks are normal — most well-managed domains carry several. A hold is the one to worry about: it means the domain has been pulled from DNS and won't load.

Regional Internet Registries (RIRs) allocate IP addresses and ASNs within their region and publish the ownership records. There are five:

• ARIN — North America
• RIPE NCC — Europe, Middle East, Central Asia
• APNIC — Asia-Pacific
• LACNIC — Latin America & the Caribbean
• AFRINIC — Africa

The email address a network publishes for reporting malicious or abusive activity originating from its IP ranges — spam, attacks, or compromised hosts. It's the correct place to send a complaint about traffic from a given address.

An Autonomous System Number identifies a network operator on the global routing system. An Autonomous System is a collection of IP ranges under a single administrative control — an ISP, a cloud provider, a large company. ASNs are written as AS followed by a number, e.g. AS15169 (Google).

The specific IP ranges (prefixes) that an Autonomous System advertises to the rest of the internet via BGP, the protocol routers use to decide where to send traffic. Announcing a prefix is how a network tells the world "these addresses are reachable through me." Palantiri lists the IPv4 and IPv6 prefixes an ASN announces.

A port is a 16-bit number (0–65535) that identifies a specific service or application on a device. While an IP address gets data to the right machine, the port gets it to the right program — web traffic on 443, secure shell on 22, and so on. Ports are used by the TCP and UDP transport protocols.

The range is split by convention:

• Well-known (0–1023) — standard services such as HTTP, HTTPS, SSH, DNS.
• Registered (1024–49151) — assigned to specific applications.
• Dynamic / ephemeral (49152–65535) — temporary ports the operating system assigns to outgoing connections.