Subnet Calculator

What a subnet actually is

Every IP address is really two numbers stuck together: the part that identifies a network, and the part that identifies a host inside it. Subnetting is the act of deciding where the boundary falls. Move it left and you get fewer, larger networks; move it right and you get more, smaller ones. Everything a subnet calculator prints follows from that one choice.

The boundary matters because routers only look at the network part. Two addresses on the same side of the line can talk directly over the local link; anything else has to go via a gateway. Get the boundary wrong on one machine and it will insist a neighbour is on the far side of the internet.

Reading CIDR notation

192.168.1.0/24 means "the first 24 bits are the network". An IPv4 address is 32 bits, so 8 bits are left for hosts — 2⁸ = 256 addresses. The prefix length is the whole story: network bits + host bits always equals 32 for IPv4 and 128 for IPv6, so every other figure can be derived from it.

Classless Inter-Domain Routing replaced the old class A/B/C scheme in 1993, precisely because fixed 8, 16 and 24-bit boundaries wasted enormous amounts of address space. A network needing 300 addresses had to be given a class B holding 65,536 of them. CIDR lets the boundary sit anywhere.

The mask says the same thing in dotted decimal

A subnet mask is the prefix written out as an address: ones for the network bits, zeros for the host bits. /24 is twenty-four ones then eight zeros, which grouped into bytes reads 255.255.255.0. Because the ones must be contiguous, only 33 masks exist at all, one per prefix length — the reference table further down lists the ones you will actually meet. Anything else, such as 255.255.0.255, is not a mask.

The wildcard mask is its exact complement

Cisco access lists and OSPF network statements take a wildcard mask, where the bits are inverted: 0.0.0.255 rather than 255.255.255.0. A zero means "this bit must match" and a one means "ignore this bit". Adding a mask octet to its wildcard octet always gives 255, which is a quick way to check you have converted it correctly.

Why two addresses are usually unusable

In an ordinary IPv4 subnet, two of the addresses are spoken for:

• The network address — all host bits zero. It names the subnet itself and appears in routing tables. It is not an interface.
• The broadcast address — all host bits one. Traffic sent here reaches every host on the link, so it cannot belong to one of them.

That is where the familiar 254 comes from: 256 addresses in a /24, minus those two. The subtraction is so routine that people apply it everywhere — and in two cases it is wrong.

/31 — the point-to-point exception (RFC 3021)

A link between two routers needs exactly two addresses. Under the old rules the smallest usable subnet was a /30: four addresses, two of them burnt on network and broadcast. RFC 3021 defines a /31 for this case, where the reservation simply does not apply and both addresses are assignable. There is nothing to broadcast to on a point-to-point link, because a packet sent to one end can only arrive at the other.

This calculator reports a /31 as two total, two usable. A calculator that says zero is subtracting a reservation that RFC 3021 removed.

/32 — a single host

A /32 has no host bits at all: it is one address. You see it as a host route in a routing table, on loopback interfaces, and in firewall rules that mean "exactly this machine". Its one address is usable, and it is simultaneously the first and the last address in the block.

Splitting a network: a worked example

Suppose you have 203.0.113.0/24 and need four equal subnets. Four is 2², so borrow two bits from the host part: /24 becomes /26. Each /26 has 6 host bits, giving 64 addresses and 62 usable hosts.

The same arithmetic runs in reverse. Merging those four /26s back into a /24 is supernetting, and it is what lets a provider advertise one route instead of four.

IPv4 prefix reference

Every IPv4 prefix from /8 down to /32 — the range used for subnetting rather than provider allocations — with the mask it corresponds to and the number of hosts it holds. Note the last two rows: /31 and /32 keep every address, for the reasons above.

IPv6 subnetting is a different game

The arithmetic is identical — mask, network, range — but three of the habits IPv4 teaches are wrong in IPv6.

• There is no broadcast address. IPv6 removed broadcast entirely and replaced it with multicast groups such as ff02::1, "all nodes on this link". So there is no last address to reserve, and this tool reports the broadcast field as absent rather than printing an address that does not exist.
• Nothing is subtracted from the range. The all-zeros host part is the Subnet-Router anycast address (RFC 4291), which belongs to the routers on the link rather than being unusable. Every other address in the prefix can be assigned.
• The subnet size is fixed by convention at /64. Stateless address autoconfiguration builds a 64-bit interface identifier, so a longer prefix breaks it. You do not subnet a /64 to save addresses — there is no shortage to save from.

The one place a longer prefix is normal is a router-to-router link, where RFC 6164 recommends a /127 for the same reason RFC 3021 recommends a /31 in IPv4. Check what your own connection supports with the IPv6 checker.

Mistakes worth knowing about

1. Treating a host address as a network. 192.168.1.55/24 is a perfectly valid thing to type — it is what an interface reports — but the network is 192.168.1.0/24. This calculator masks the host bits off and tells you it has done so, rather than pretending the network starts at .55.
2. Assuming a /31 is unusable. It has been valid since 2000 and is standard on provider backbones.
3. Subtracting two from an IPv6 prefix. There is no broadcast address to reserve.
4. Non-contiguous masks. A subnet mask must be a solid run of ones, and every modern operating system rejects anything else. An ACL wildcard mask is the one place scattered bits are legal, which is part of why the two are so easily confused.
5. Forgetting that the gateway lives inside the subnet. The router's address is one of the usable hosts, so a /29 with six usable addresses gives you five machines, not six.

Once the plan is settled, check what the outside world can actually reach with the port checker, or look up who owns a range with IP lookup.