Subnet Calculator

CIDR (Classless Inter-Domain Routing), defined in RFC 4632 (1993), replaced the legacy classful system. A CIDR address has two parts — the IP address and a prefix length — separated by a slash, e.g., 192.168.1.0/24. The prefix length specifies how many leading bits identify the network; the remaining bits define hosts. A /32 is a single host (loopback or point-to-point endpoint), /31 covers two hosts (RFC 3021), /30 has four addresses with two usable, /24 the familiar 256 addresses with 254 usable, and /8 a full Class A-equivalent block of 16,777,216 addresses. CIDR enables flexible address allocation and route aggregation, making the global IPv4 routing table manageable.

Every IPv4 subnet has a network address (all host bits set to 0) and a broadcast address (all host bits set to 1). Neither can be assigned to a host; they bookend the usable range. For 10.20.30.40/26, the subnet mask is 255.255.255.192, the network address is 10.20.30.0, the broadcast is 10.20.30.63, and the usable range is 10.20.30.1 through 10.20.30.62 — 62 hosts. The network address identifies the subnet itself in routing tables; the broadcast address sends a Layer 3 packet to every host in the subnet. Modern Ethernet networks rely on these boundaries to scope ARP and DHCP traffic.

To convert a CIDR prefix to a dotted-decimal mask, write 32 bits with the first N bits set to 1 and the rest set to 0, then group into four octets and convert each to decimal. Example: /22 → 11111111.11111111.11111100.00000000 → 255.255.252.0. To find the network address from a host IP, perform a bitwise AND of the IP with the subnet mask. For 192.168.5.130/22: 192.168.5.130 AND 255.255.252.0 = 192.168.4.0. Total addresses are 2^(32 − prefix); usable hosts are 2^(32 − prefix) − 2 except for /31 (2 usable per RFC 3021) and /32 (host route, 1 address).

A wildcard mask is the bitwise inverse of a subnet mask: 1 bits in the wildcard mark 'don't care' positions. For mask 255.255.255.0 the wildcard is 0.0.0.255. Cisco IOS uses wildcard masks in standard and extended ACLs, OSPF network statements, and route-map conditions. For example, `network 10.1.1.0 0.0.0.255 area 0` places the entire 10.1.1.0/24 subnet into OSPF area 0. Wildcard masks need not be contiguous (unlike subnet masks), enabling pattern matches like 10.0.0.0 0.255.0.255 to match all addresses where the first and third octets are fixed but the second and fourth are unconstrained.

VLSM (RFC 1812) lets you carve a single allocated block into subnets of different sizes — essential when you have point-to-point links, server VLANs, and user LANs all sharing one /22 or /20. Plan from largest to smallest: assign the biggest required subnet first, then the next, aligning each on its natural prefix boundary. From 192.168.16.0/22 (1,022 hosts), you might carve 192.168.16.0/24 (254 hosts), 192.168.17.0/25 (126 hosts), 192.168.17.128/26 (62 hosts), and 192.168.17.192/30 for a WAN link (2 hosts). VLSM is core to CCNA, CompTIA Network+, and any production IP plan — get it wrong and you waste address space or create overlapping subnets.

Before CIDR, IPv4 used classful addressing: Class A (0.0.0.0–127.255.255.255, /8 default), Class B (128.0.0.0–191.255.255.255, /16 default), and Class C (192.0.0.0–223.255.255.255, /24 default). Class D (224.0.0.0–239.255.255.255) is reserved for multicast and Class E (240.0.0.0 onward) for experimental use. Classful addressing wasted addresses (a Class B with 65,534 hosts was overkill for most networks) and contributed to IPv4 exhaustion. CIDR (1993) decoupled prefix length from class, but you'll still see 'Class C' used loosely to mean '/24 home network', and many certification questions still reference classes.

RFC 1918 reserves three ranges for private use, not routable on the public Internet: 10.0.0.0/8 (16 million addresses, common in enterprise), 172.16.0.0/12 (1 million, used by Docker default bridge and some lab networks), and 192.168.0.0/16 (65,000, the default for most home routers). Network Address Translation (NAT) maps these private addresses to a public IP for Internet egress. Other reserved ranges include 169.254.0.0/16 (link-local, RFC 3927), 127.0.0.0/8 (loopback), and 100.64.0.0/10 (carrier-grade NAT, RFC 6598). Choose 10.x for sites with many subnets, 192.168.x for small offices, and 172.16.x where 10.x is already used elsewhere.

IPv6 (RFC 4291) uses 128-bit addresses written in eight groups of four hex digits (e.g., 2001:db8::/32). The standard host subnet size is /64 — half of the address — leaving 64 bits for the interface identifier (often derived from the MAC via SLAAC, RFC 4862). ISPs typically assign customers a /48 or /56, allowing thousands of /64 subnets per site. Notation rules: leading zeros in each group can be omitted, and one run of all-zero groups can be compressed to '::'. The IPv4 concepts of network/broadcast don't translate cleanly: IPv6 has no broadcast (replaced by multicast and anycast). Use this calculator's binary view as a reference for prefix arithmetic.

Quick reference for usable hosts by prefix: /30 = 2 hosts (point-to-point), /29 = 6, /28 = 14, /27 = 30, /26 = 62, /25 = 126, /24 = 254, /23 = 510, /22 = 1,022, /21 = 2,046, /20 = 4,094, /19 = 8,190, /18 = 16,382, /17 = 32,766, /16 = 65,534, /12 = 1,048,574, /8 = 16,777,214. The formula is 2^(32 − prefix) − 2 for prefixes /1–/30. RFC 3021 allows /31 (2 addresses, both usable) for point-to-point WAN links to save address space. /32 represents a single host, used for loopbacks and host routes in OSPF/BGP.

Public cloud VPCs follow CIDR rules with provider-specific reservations. AWS reserves the first four addresses (network, VPC router, DNS, future use) and the broadcast of every subnet — a /28 has 11 usable hosts on AWS, not 14. Azure VNets reserve the first three addresses plus the broadcast (also 11 usable for /28). GCP reserves the first two addresses plus the second-to-last and the broadcast in every subnet (12 usable for /28). For new VPCs, plan a /16 (65,536 addresses) primary CIDR and carve out /24 subnets per Availability Zone — public, private, and database tiers per AZ. Avoid 100.64.0.0/10 in cloud (carrier-grade NAT collisions) and check for overlap with on-prem ranges before provisioning Direct Connect, ExpressRoute, or Cloud Interconnect.

Frequent subnetting mistakes: (1) Forgetting to subtract 2 for network and broadcast — a /28 has 14 usable hosts, not 16. (2) Misaligning a subnet on a non-boundary address — 10.0.0.5/29 starts at 10.0.0.0, not 10.0.0.5. (3) Confusing wildcard mask with subnet mask in Cisco ACL syntax (the ACL takes wildcard, not mask). (4) Overlapping subnets in VLSM plans — always verify each new subnet's range doesn't intersect an existing one. (5) Using cloud-reserved addresses for hosts (see Section 10). (6) Forgetting RFC 6890 special-purpose addresses (169.254.x.x link-local, 224.x.x.x multicast). Verify each subnet with this calculator before committing to your IPAM, Terraform, or router config.

A complete /1–/32 reference is built into this calculator. Highlights: /30 = 255.255.255.252 mask, 0.0.0.3 wildcard, 2 hosts; /29 = 255.255.255.248, 0.0.0.7, 6 hosts; /28 = 255.255.255.240, 0.0.0.15, 14 hosts; /27 = 255.255.255.224, 0.0.0.31, 30 hosts; /26 = 255.255.255.192, 0.0.0.63, 62 hosts; /25 = 255.255.255.128, 0.0.0.127, 126 hosts; /24 = 255.255.255.0, 0.0.0.255, 254 hosts; /23 = 255.255.254.0, 0.0.1.255, 510 hosts; /22 = 255.255.252.0, 0.0.3.255, 1,022 hosts; /20 = 255.255.240.0, 0.0.15.255, 4,094 hosts; /16 = 255.255.0.0, 0.0.255.255, 65,534 hosts; /8 = 255.0.0.0, 0.255.255.255, 16,777,214 hosts. Bookmark or print this page for offline reference.