Subnet Calculator

How subnetting actually works

Every IPv4 address is 32 bits. A subnet mask divides those 32 bits into two parts: the network portion (left side, fixed within the subnet) and the host portion (right side, varies per device). CIDR notation is shorthand for "how many of those bits are network."

The math, demystified

Take 192.168.1.50/24. The /24 says the first 24 bits are network — that's the first three octets, 192.168.1. The last 8 bits (.50) identify the specific host on that subnet.

Two specific addresses in every subnet are reserved:

• Network address — all host bits are 0 (e.g. 192.168.1.0). This identifies the subnet itself; you can't assign it to a device.
• Broadcast address — all host bits are 1 (e.g. 192.168.1.255). Sending here reaches every host on the subnet.

Everything in between is usable for hosts. So a /24 has 256 total addresses but only 254 usable host addresses.

Full CIDR ↔ subnet mask reference (/0 through /32)

Every valid IPv4 prefix length and its corresponding subnet mask. Common sizes admins actually use are highlighted in teal — the rest are mostly RIR allocations and theoretical edge cases. Click any row to load it into the calculator.

How I actually work with subnets

Subnet calculations show up constantly in network administration. Every VLAN plan needs subnet sizing. Every firewall rule needs a source and destination block. Every route entry needs a network and mask. Every VPN configuration needs matching subnets on both ends. The math is simple once you internalize it, but internalizing it takes a while and having a tool that shows all the derivations at once accelerates the learning.

The core insight of CIDR is that any prefix length from /0 to /32 (or /128 for IPv6) is a valid subnet size. This lets you allocate exactly the addresses you need, no more. Old class-based networking wasted enormous amounts of address space by forcing everyone into /8, /16, or /24 boundaries. CIDR lets you carve /27s and /29s and /30s where they're the right size.

Subnet sizes I use routinely

/24 for typical LANs

The default size for essentially every small-to-medium office network. 254 usable hosts, which handles most workgroups with headroom to grow. Simple math: the first three octets are the network, the fourth octet is the host. Any user can look at 192.168.1.42 and 192.168.1.87 and immediately know they're on the same network.

/23 when /24 isn't quite enough

510 usable hosts, spanning two consecutive /24 blocks. Useful for offices in the 250-400 device range where a single /24 gets crowded but a /22 is more than needed.

/22 for larger sites

1022 usable hosts. Common for larger office buildings or campus segments. Also common as the "user network" size in many corporate networks that segment by function.

/25 through /27 for subdivided VLANs

When you're splitting a /24 into smaller pieces for VLAN isolation — a /25 gives you two subnets of 126 hosts each; a /26 gives four subnets of 62 hosts each; a /27 gives eight subnets of 30 hosts each. These are common for isolating different types of traffic (VoIP, IoT, guest, servers) inside a smaller network.

/28 for small isolated segments

14 usable hosts. Good for security cameras on their own segment, small server pools, DMZ hosts.

/29 for point-to-point links or tiny pools

6 usable hosts. Traditionally used for point-to-point links between routers (with router IPs on each end). Also used for very small IPv4 allocations from ISPs to business customers.

/30 for point-to-point

2 usable hosts. Exactly enough for one router at each end of a link. The classic size for router-to-router interconnects.

/31 for modern point-to-point

2 usable hosts with no network/broadcast reservation, per RFC 3021. Modern routers support this and it saves address space compared to /30. Not universally supported by every device.

/32 for host routes

One host. Used in access control lists to reference a single IP, or as "loopback" addresses on routers.

The math being done for you

Network address

The first address in the block. All host bits are zero. This address represents the network itself and traditionally isn't assigned to a device. For a /24 block starting at 192.168.1.0, the network address is 192.168.1.0.

Broadcast address

The last address in the block. All host bits are one. Sending a packet to this address delivers it to every host in the subnet. Historically important; less used today because many applications have moved to multicast, but still standard in DHCP and some legacy protocols.

Usable host range

All addresses between the network and broadcast, exclusive. For a /24, that's the second address (.1) through the second-to-last address (.254). This is the range you can actually assign to devices.

Total addresses vs usable hosts

Total addresses = 2^(32 - prefix). Usable hosts = total - 2 (subtracting network and broadcast). For /24: 256 total, 254 usable. For /30: 4 total, 2 usable. For /31: 2 total, 2 usable (RFC 3021 exception).

Subnet mask (dotted decimal)

The prefix length translated to four octets. /24 becomes 255.255.255.0. /28 becomes 255.255.255.240. /16 becomes 255.255.0.0. Old Cisco and Microsoft configurations required subnet masks in dotted-decimal form; modern configs mostly use CIDR notation directly.

Wildcard mask (Cisco ACL format)

The inverse of the subnet mask. Used in Cisco ACLs where "match if these bits" is expressed as "match zeros here, anything in ones." /24's wildcard mask is 0.0.0.255. /28's is 0.0.0.15. Getting these backwards is a common source of ACL bugs.

Where subnet errors bite in the field

Mismatched masks on the same segment

Device A configured with /24, device B configured with /25 on the same physical wire. Traffic works in one direction but not the other because the two hosts have different opinions about who's local. Symptom: ping works from A to B but not from B to A, or vice versa. Diagnosis requires checking mask settings on both.

Overlap between planned subnets

The 192.168.0.0/16 range contains 256 /24 blocks. If two different sites both use 192.168.1.0/24, they can't communicate via VPN without NAT because the routing gets ambiguous. Planning subnet allocations to avoid overlap when sites might eventually interconnect is a small investment that saves large headaches.

Wrong DHCP scope boundaries

Configuring DHCP to lease addresses from 192.168.1.0 to 192.168.1.255 fails because .0 and .255 are reserved. The DHCP server will complain or lease the addresses and cause immediate conflicts. Right scope for a /24 is .1 through .254, with the router usually taking .1 or .254 and DHCP leasing the middle range.

Route ambiguity from overlapping supernets

A route to 10.0.0.0/8 with next hop A and a route to 10.5.0.0/16 with next hop B can coexist — the more specific route wins. But careless allocations can produce cases where two routes match the same destination with the same specificity, causing unpredictable path selection. Route review before adding is worth doing on complex networks.

IPv6 subnet math

IPv6 has vastly more address space, so subnet sizes are different. Common practice:

• /48: a customer allocation. A small business gets a /48 by default, which contains 65,536 /64 subnets. Even the smallest IPv6 customer has more subnets than most IPv4 networks have hosts.
• /56: sometimes assigned to residential customers. 256 /64 subnets, enough for any home network to have plenty of segmentation.
• /64: an individual subnet. This is the smallest routable IPv6 subnet in most contexts. SLAAC (stateless address autoconfiguration) requires /64. Anything smaller than /64 is unusual.
• /127: point-to-point link between two routers. Analogous to IPv4 /31.
• /128: a single IPv6 address. Analogous to IPv4 /32.

The internet-wide agreement that /64 is the smallest routable subnet takes some getting used to for admins coming from IPv4 where /30 point-to-point links are common. IPv6 has enough addresses that using a full /64 for a point-to-point link is considered fine.

Special-use subnets to remember

RFC 1918 private ranges

The classic private IPv4 ranges:

• 10.0.0.0/8 (16.7 million addresses)
• 172.16.0.0/12 (1 million addresses)
• 192.168.0.0/16 (65,536 addresses)

These are not routable on the public internet. Any organization can use them internally; they never conflict externally because they never reach externally.

Link-local (169.254.0.0/16)

Automatic private IP addressing (APIPA). If DHCP fails, Windows and many other systems assign an IP in 169.254.x.x. Devices with these addresses can talk to each other on the same segment but can't route anywhere. Seeing this address usually means DHCP is broken.

Loopback (127.0.0.0/8)

All addresses in 127.x.x.x refer back to the local host. 127.0.0.1 is the classic; the whole /8 is reserved.

CGNAT (100.64.0.0/10)

Reserved for Carrier-Grade NAT by RFC 6598. If your ISP puts you behind CGNAT, your router's WAN IP is likely in this range. See the CGNAT Detection tool for more.

Documentation (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24)

Reserved by RFC 5737 for use in documentation examples. Never routed on the internet. Using these in real configurations produces confusing bugs, so knowing they're documentation-only is useful.

Related tools

For converting between CIDR notation and a specific IP range (start, end, block size), use the CIDR Range Tool. For working with individual IPs in binary, hex, or integer form, use the IP Converter.

The Subnet Mask Table is a static reference showing every prefix length from /8 through /32 with dotted-decimal mask, wildcard mask, block size, and usable host count. Useful as a printable cheat sheet.

Privacy

All subnet math runs entirely in your browser. Nothing you enter is sent to any server. Subnet planning often involves internal IP allocations that shouldn't be exposed externally, so keeping everything local matters.