IP Subnet Calculator

What a prefix actually does

An IPv4 address is 32 bits, usually written as four decimal numbers. The prefix length — the number after the slash — says how many of those leading bits identify the network. Everything after that identifies the host within it.

A /24 sets the first 24 bits as network, leaving 8 bits for hosts. Eight bits give 256 combinations, but two are reserved: the all-zeros host is the network address itself, and the all-ones host is the broadcast. That leaves 254 usable addresses, which is where the familiar number comes from.

The pattern generalises. Usable hosts equal 2^{(32−prefix)} − 2. A /25 gives 126, a /26 gives 62, a /27 gives 30, a /28 gives 14, a /30 gives 2. Every step up in prefix halves the block.

Reading the mask

Because the boundaries are powers of two, subnets always start at multiples of their own size. A /26 block is 64 addresses wide, so the four /26s inside a /24 start at .0, .64, .128 and .192 — never at .50. Getting that wrong is the most common subnetting error, and it is why 192.168.1.100/26 has a network address of 192.168.1.64 rather than 192.168.1.100.

A worked example

Take 192.168.1.10/26. The mask is 255.255.255.192, so the last octet’s top two bits are network and the bottom six are host. Ten in binary is 00001010, whose top two bits are 00, placing it in the first block. The network is 192.168.1.0, the broadcast is 192.168.1.63, and usable hosts run from .1 to .62 — 62 of them.

Move the same address to /24 and the answers change completely: network 192.168.1.0, broadcast 192.168.1.255, hosts .1 to .254. The address is identical; only the mask decided what network it belongs to. That is the whole point of a mask, and why two devices with the same address but different masks fail to talk to each other in ways that look inexplicable until you check.

Private ranges

RFC 1918 sets aside three blocks that are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 (that is 172.16 through 172.31, not all of 172), and 192.168.0.0/16. Home routers almost always use 192.168.0.0/24 or 192.168.1.0/24. Corporate networks tend toward 10.x because it is enormous. The calculator flags which category the address you entered falls into.

There is also 169.254.0.0/16, link-local, which a machine assigns itself when DHCP fails — seeing one of those is usually a diagnosis rather than a configuration.

Wildcard masks

A wildcard mask is the bitwise inverse of the subnet mask, and it is what Cisco access control lists and OSPF network statements expect. A /24 mask of 255.255.255.0 has a wildcard of 0.0.0.255. The convention is inverted: in a wildcard, a zero bit means "must match" and a one bit means "don’t care". It trips people up constantly, so the calculator shows both.

The /31 and /32 special cases

On a point-to-point link there is no need for a broadcast address, so RFC 3021 permits a /31 where both addresses are usable host addresses. It saves two addresses per link, which adds up across a large routed network. A /32 identifies exactly one address and shows up in host routes, loopback interfaces and firewall rules.

Why does a /24 give 254 hosts rather than 256?

Two addresses in every subnet are reserved. The lowest — all host bits zero — is the network address that identifies the subnet itself in routing tables. The highest — all host bits one — is the broadcast address that reaches every device on the segment. Neither can be assigned to a device, so a 256-address block yields 254 usable ones. The exception is a /31, where RFC 3021 allows both addresses on a point-to-point link.

What is the difference between a subnet mask and a wildcard mask?

They are bitwise inverses of each other and they mean opposite things. In a subnet mask a one bit marks the network portion, so /24 is 255.255.255.0. In a wildcard mask a zero bit means the corresponding bit must match and a one means ignore it, so the same /24 is 0.0.0.255. Subnet masks configure interfaces; wildcard masks appear in Cisco ACLs and OSPF network statements.

Which address ranges are private?

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Note that the 172 block covers 172.16 through 172.31 only — 172.32.x is public, which surprises people. These ranges are never routed on the public internet, so they can be reused inside any organisation, which is what makes NAT necessary at the boundary.

How do I split a /24 into smaller subnets?

Decide how many hosts each segment needs, round up to the next power of two, then add two for the network and broadcast addresses. Fourteen hosts needs a /28 (16 addresses). Then allocate blocks on their natural boundaries — /28s inside a /24 start at .0, .16, .32 and so on. Allocate the largest subnets first to avoid fragmenting the space, which is the essence of variable-length subnet masking.

Does any of this apply to IPv6?

The prefix concept carries over directly and IPv6 uses the same slash notation, but the details differ. There is no broadcast address in IPv6, so nothing is subtracted for it, and the standard subnet size for a LAN is /64 regardless of how few devices are on it — which is a vastly larger block than anything in IPv4. This calculator handles IPv4 only.