Subnet Calculator

What a prefix is

An IPv4 address is 32 bits. The prefix length after the slash says how many of those bits identify the network, leaving the rest to identify a host within it. A /24 fixes the first 24 bits, leaving 8 for hosts and therefore 256 addresses; every step down the prefix doubles the block, so a /23 is 512 addresses and a /16 is 65,536.

The netmask is the same information written as an address: 24 ones followed by 8 zeros is 255.255.255.0. It must be a contiguous run of ones - that is what makes the split a single boundary rather than scattered bits - which is why 255.255.0.255 is not a mask at all, and why a calculator that silently rounds it to the nearest valid one hides the misconfiguration you were looking for.

The wildcard mask is the netmask inverted, and it exists because Cisco access lists and OSPF are written in terms of the bits that may vary rather than the bits that are fixed. 0.0.0.255 is the wildcard for a /24. Both are shown here because which one you need depends entirely on what you are configuring.

The binary row is worth reading at least once. Subnetting is one boundary drawn through 32 bits, and seeing it drawn is usually faster than reasoning about dotted decimal.

The ranges you should recognise

Three IPv4 blocks are reserved by RFC 1918 for private use and are not routed on the internet: 10.0.0.0/8, 172.16.0.0/12 - note it is 172.16 through 172.31, not all of 172 - and 192.168.0.0/16. Almost every internal network you will meet is carved out of one of these.

Several others turn up often enough to know on sight. 100.64.0.0/10 is carrier-grade NAT, used between an ISP's customers and its own routers, and it appears in home networks more often than people expect. 169.254.0.0/16 is link-local, self-assigned when DHCP fails, so an address in that range is usually a symptom rather than a configuration. 127.0.0.0/8 is loopback - the whole /8, not just 127.0.0.1. 224.0.0.0/4 is multicast, and 255.255.255.255 is the limited broadcast address.

For documentation and examples there are three blocks reserved by RFC 5737 - 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 - which is what to use in a diagram or a blog post instead of picking an address that belongs to somebody.

Splitting a network

Dividing a block means moving the boundary right. A /24 split into four gives four /26s of 64 addresses each; split into two, two /25s of 128. The arithmetic is always the same because the prefix is always a power of two, which is also the constraint: you cannot have a subnet of 100 addresses, only 64 or 128.

Variable-length subnet masking is the practice of sizing each subnet to what it holds rather than cutting everything the same. A point-to-point link between two routers needs two addresses, so it gets a /31 or a /30; a user VLAN with 60 devices gets a /26; a server segment expecting growth gets a /24. Doing this well is mostly about leaving room - renumbering a subnet that has outgrown its prefix means touching every device, every firewall rule and every static entry that refers to it.

It helps to allocate on boundaries that summarise. If everything in a site sits inside one /20, the rest of the network needs one route to reach it rather than sixteen, and that difference compounds across a large estate.

IPv6 is not IPv4 with more digits

The arithmetic is the same and the design assumptions are not, so habits carried over from IPv4 tend to produce awkward IPv6 networks.

A /64 is the standard subnet size, always, regardless of how many hosts are on it. Stateless address autoconfiguration depends on 64 host bits, so subnetting below /64 breaks it and is worth doing only for point-to-point links where you know what you are giving up. Sites are normally allocated a /48 or a /56, which is 65,536 or 256 subnets - the intent being that you never have to think about conserving addresses again, and can allocate a /64 per VLAN without counting.

There is no broadcast address; its jobs are done by multicast. Nothing in a prefix is reserved, so a /64 really does contain 18,446,744,073,709,551,616 usable addresses, and the subtract-two habit does not apply. And NAT is not part of the model: hosts have globally routable addresses and reachability is a firewall decision, which is a change of mindset rather than of arithmetic.

Carving up a /24 for a small office

Suppose you have 192.168.10.0/24 and four things to accommodate: about 50 staff devices, a dozen servers, a handful of printers and cameras, and two point-to-point links to branch routers. The instinct is to split the block into four equal /26s, which wastes most of it and leaves no room where it is needed.

Variable-length subnetting does better. Give the staff VLAN 192.168.10.0/26, which is 62 usable addresses. Give the servers 192.168.10.64/27, 30 usable, with room to double. Put the printers and cameras in 192.168.10.96/27, since keeping them off the user network makes firewall rules simpler. That leaves 192.168.10.128/25 entirely free, and the two links can take /30s from the top of it - 192.168.10.252/30 and 192.168.10.248/30 - leaving the middle open.

The reason to leave the gap rather than pack tightly is that renumbering later means touching every device, every DHCP scope, every firewall rule and every static entry. Address space inside a private range is free; a renumbering weekend is not.

What a router does with these prefixes

A routing table is a list of prefixes and next hops, and the rule for choosing among them is longest prefix match: the most specific route that contains the destination wins. A packet for 10.1.2.3 with routes for 10.0.0.0/8 and 10.1.0.0/16 in the table takes the /16, regardless of the order the routes were added.

The default route, 0.0.0.0/0, is simply the least specific prefix possible, which is why it is used only when nothing else matches. That single mechanism explains most routing behaviour people find surprising, including why adding a more specific route silently overrides a general one.

Summarisation is the same idea used deliberately. If every subnet at a site sits inside one /20, the rest of the network needs one entry instead of sixteen, which keeps tables small and means a flapping link inside the site does not propagate churn outward. Allocation that ignores summarisation produces routing tables that grow linearly with every new VLAN anyone creates.

The services that make a subnet usable

A subnet is not much on its own. DHCP hands out addresses from a pool inside it, and the pool should be a subset rather than the whole range, with space reserved for servers, printers and network gear that need fixed addresses. Reservations by MAC address give a device a stable address without configuring it on the device itself, which is usually the better of the two options.

The gateway is conventionally the first or last usable address, and consistency across sites matters more than which one you pick - a technician who knows that the gateway is always .1 troubleshoots faster.

NAT is what lets a private range reach the internet, and it is also why an address in 10.0.0.0/8 or 192.168.0.0/16 means nothing to anyone outside your network. When a log shows a private address as the source, you are looking at the inside of a NAT and you need the translation table to identify the actual host. Carrier-grade NAT in 100.64.0.0/10 means the same thing at the scale of an ISP, and is why subscriber identification increasingly needs a port number as well as an address.

Subnetting a cloud network

In AWS, Azure and Google Cloud the vocabulary is the same but the constraints differ. Each provider reserves several addresses in every subnet: AWS takes five - the network address, the gateway, two for DNS and future use, and the broadcast address - so a /28 gives eleven usable addresses rather than fourteen.

A VPC CIDR is usually chosen once and is painful to change, so it is worth picking with peering in mind: two networks with overlapping ranges cannot be connected without translation, and the most common cause is everyone defaulting to 10.0.0.0/16. Reserving a distinct range per environment and per region avoids a class of migration that has no good options.

Subnets are typically per availability zone, and splitting each zone's range into public and private tiers is the standard pattern. Leaving room between tiers for a third - a data tier, or a future zone - costs nothing at design time and avoids the awkward non-contiguous allocation that otherwise appears eighteen months in.

Reading the calculator's output when troubleshooting

The most common real question is whether two addresses are on the same subnet, because if they are not, the host sends the packet to its gateway rather than directly, and a firewall or routing problem enters the picture. Comparing the network address of each answers it immediately: same network address with the same mask means the same subnet.

A mismatched mask is the classic misconfiguration and produces asymmetric symptoms - one host reaches the other but not the reverse - because each side disagrees about whether the destination is local. Seeing both networks side by side makes it obvious in a way that reading two config files rarely does.

The scope label is the other fast answer. An address in 169.254.0.0/16 means DHCP failed, an address in 127.0.0.0/8 means something is bound to loopback rather than an interface, and an unexpected address in 100.64.0.0/10 usually means an ISP router is doing carrier-grade NAT in a place you assumed you had a public address.