IPv4 Subnet Calculator.
Calculate network boundaries, broadcast addresses, usable host ranges, subnet masks, wildcard masks, address counts, binary values, and IPv4 classification from an IP address and CIDR prefix or subnet mask.
Quickly validate subnet configurations, confirm addressing boundaries, and support network planning before moving into detailed routing, segmentation, and architecture decisions.
Subnet Boundaries
Determine the actual network address, broadcast address, and usable host range for the entered IPv4 subnet.
CIDR & Subnet Masks
Validate CIDR prefixes, subnet masks, wildcard masks, address counts, and special /31 and /32 behavior.
IPv4 Address Allocation
Use subnet results as inputs for VLAN planning, routing, segmentation, and scalable address design.
IPv4 planning tool: This calculator analyzes one IPv4 subnet at a time. It supports /0 through /32, including /31 point-to-point networks and /32 host routes.
Subnet inputs
Enter any IPv4 address within the subnet. The calculator will determine the actual network boundary.
You may enter any address within the target subnet.
IPv4 CIDR and Subnet Mask Cheat Sheet
Common prefixes, subnet masks, address counts, and traditionally usable host counts.
| Prefix | Subnet Mask | Total Addresses | Traditional Usable Hosts | Common Use |
|---|---|---|---|---|
| /32 | 255.255.255.255 | 1 | 1 host route | Single host or loopback route |
| /31 | 255.255.255.254 | 2 | 2 endpoints | Point-to-point link |
| /30 | 255.255.255.252 | 4 | 2 | Traditional point-to-point subnet |
| /29 | 255.255.255.248 | 8 | 6 | Small infrastructure segment |
| /28 | 255.255.255.240 | 16 | 14 | Small device group |
| /27 | 255.255.255.224 | 32 | 30 | Small access subnet |
| /26 | 255.255.255.192 | 64 | 62 | Medium access subnet |
| /25 | 255.255.255.128 | 128 | 126 | Half of a /24 |
| /24 | 255.255.255.0 | 256 | 254 | Common LAN or VLAN |
| /23 | 255.255.254.0 | 512 | 510 | Two contiguous /24 networks |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Larger campus segment |
| /21 | 255.255.248.0 | 2,048 | 2,046 | Large address block |
| /20 | 255.255.240.0 | 4,096 | 4,094 | Large routed block |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Large private or enterprise block |
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Very large aggregate block |
Engineering reference: Use this guide to understand the calculations behind the tool, select practical subnet sizes, avoid address overlap, and build an IPv4 plan that supports routing, segmentation, and future growth.
Understanding IPv4 Subnetting
Subnetting is the practice of dividing a single IPv4 network into smaller, logically distinct segments. Each segment, or subnet, functions as its own broadcast domain while remaining part of the larger addressing hierarchy. Subnetting is one of the foundational skills in IP network design, and it remains directly relevant even as IPv6 adoption grows, because the vast majority of enterprise, federal, and DoD networks still run IPv4 at the access and distribution layers.
Subnetting exists for a small number of practical reasons. First, it allows a large address block to be allocated efficiently rather than wastefully. Second, it contains broadcast traffic to a manageable scope, preventing a single flat network from becoming a performance and stability liability. Third, it allows routing tables to scale, since routers can summarize many small subnets into a single advertised route. Fourth, it supports security segmentation, allowing administrators to isolate workloads, user groups, or security zones from one another using routing and access control rather than physical separation alone.
Before CIDR (Classless Inter-Domain Routing) was introduced in 1993, IPv4 networks were allocated using rigid address classes — Class A, B, and C — each with a fixed subnet mask. This classful model was simple but extremely wasteful. An organization that needed 2,000 addresses had no efficient option between a Class C (254 usable hosts) and a Class B (65,534 usable hosts), so many organizations were allocated far more address space than they needed.
CIDR eliminated the concept of fixed class boundaries and replaced it with variable-length subnet masking (VLSM). Under CIDR, any IPv4 network can be divided into subnets of virtually any size, expressed using a prefix length such as /24 or /27. This is the addressing model used across every modern network today, from small branch offices to hyperscale cloud environments, and it is the model this calculator is built around.
Why CIDR matters for scalable design
- Efficient address allocation — organizations receive and assign only the address space they actually need.
- Broadcast containment — smaller subnets limit the reach of ARP broadcasts, DHCP discovery traffic, and Layer 2 flooding.
- Routing scalability — contiguous CIDR blocks can be summarized into fewer routing table entries, reducing convergence time and memory overhead on routers.
- Security segmentation — subnet boundaries provide a natural enforcement point for firewall rules, access control lists, and VLAN-to-subnet mapping.
How an IPv4 Subnet Calculator Works
An IPv4 subnet calculator takes an IP address and a subnet mask or CIDR prefix and derives a consistent set of values that describe the resulting network. Understanding each of these values individually makes the calculator's output meaningful rather than just a string of numbers.
| Term | Definition |
|---|---|
| IP Address | A 32-bit address, typically written in dotted-decimal notation, identifying a specific host or interface. |
| Subnet Mask | A 32-bit value that identifies which bits of the IP address represent the network portion and which represent the host portion. |
| CIDR Prefix | A shorthand notation (for example, /24) indicating how many leading bits of the address are the network portion. |
| Network Portion | The bits of the address that identify the subnet itself, shared by every host on that subnet. |
| Host Portion | The remaining bits available to uniquely identify individual hosts within the subnet. |
| Network Address | The address with all host bits set to zero — it identifies the subnet itself and cannot be assigned to a host. |
| Broadcast Address | The address with all host bits set to one — it is used to reach every host on the subnet simultaneously. |
| Wildcard Mask | The inverse of the subnet mask, used primarily in Cisco access control lists and OSPF configuration. |
Step-by-step calculation process
- Convert the IP address and subnet mask into binary.
- Perform a bitwise AND between the address and the mask to determine the network address.
- Set all host bits to 1 to determine the broadcast address.
- Subtract the network and broadcast addresses from the total address count to determine usable host addresses.
- Identify the first usable host (network address + 1) and last usable host (broadcast address − 1).
- Invert the subnet mask bit-by-bit to produce the wildcard mask.
This process is identical regardless of subnet size — the only variable is where the boundary falls between the network portion and the host portion of the 32-bit address.
CIDR Notation Explained
CIDR notation expresses the number of network bits directly after the IP address. The table below summarizes the most commonly used prefixes, their total address count, usable host count, and typical use cases.
| CIDR | Subnet Mask | Total Addresses | Usable Hosts | Common Use Case |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Large private allocations (e.g., 10.0.0.0/8) |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Regional or campus-wide address blocks |
| /24 | 255.255.255.0 | 256 | 254 | Standard LAN or VLAN segment |
| /25 | 255.255.255.128 | 128 | 126 | Split LAN, half of a /24 |
| /26 | 255.255.255.192 | 64 | 62 | Small department or floor segment |
| /27 | 255.255.255.224 | 32 | 30 | Small office or server cluster |
| /28 | 255.255.255.240 | 16 | 14 | Small equipment segment, management network |
| /29 | 255.255.255.248 | 8 | 6 | Small ISP handoff, firewall segment |
| /30 | 255.255.255.252 | 4 | 2 | Traditional point-to-point WAN link |
| /31 | 255.255.255.254 | 2 | 2 (special case) | Modern point-to-point links per RFC 3021 |
| /32 | 255.255.255.255 | 1 | 1 (host route) | Loopback interfaces, host routes |
Subnet Masks and Wildcard Masks
A subnet mask is a 32-bit value where each bit set to 1 represents part of the network portion of the address, and each bit set to 0 represents the host portion. Expressed in binary, common masks look like this:
- 255.255.255.0 — 11111111.11111111.11111111.00000000 (/24)
- 255.255.254.0 — 11111111.11111111.11111110.00000000 (/23)
- 255.255.252.0 — 11111111.11111111.11111100.00000000 (/22)
- 255.255.255.192 — 11111111.11111111.11111111.11000000 (/26)
A wildcard mask is the bitwise inverse of the subnet mask. Where the subnet mask has a 1, the wildcard mask has a 0, and vice versa. Wildcard masks are used extensively in Cisco access control lists, where they define which bits of an address must match exactly and which bits are permitted to vary. For example, a subnet mask of 255.255.255.0 corresponds to a wildcard mask of 0.0.0.255.
Wildcard masks also appear in OSPF network statements, where they select interfaces whose addresses match a configured range. Route summarization itself is expressed with a network prefix and mask or prefix length rather than an ACL-style wildcard. Understanding the inverse relationship between a subnet mask and its wildcard equivalent is essential when configuring ACLs and OSPF interface selection.
Understanding Network and Broadcast Addresses
Every subnet reserves two addresses that cannot be assigned to a host under traditional IPv4 addressing rules: the network address and the broadcast address.
The network address, with all host bits set to zero, identifies the subnet itself. It is used internally by routers and in routing tables to reference the subnet as a whole, rather than any individual device on it.
The broadcast address, with all host bits set to one, allows an IPv4 packet to be delivered to every host on the subnet simultaneously. Directed broadcasts are commonly filtered at routed boundaries, while services such as DHCP initially rely on local broadcast behavior before a client has an address. ARP is also broadcast locally at Layer 2, but it does not use the subnet's directed broadcast address. Because the IPv4 broadcast address identifies the entire subnet, it cannot be assigned to an individual host under traditional subnetting rules.
These two reserved addresses are why a /24 subnet, which contains 256 total addresses, provides only 254 usable host addresses — the first and last addresses in the range are consumed by the network and broadcast functions.
Special handling for /31 and /32
Two prefix lengths break the traditional network/broadcast reservation model. A /31 subnet, defined in RFC 3021, contains only two addresses and treats both as usable host addresses on point-to-point links, since there is no meaningful broadcast domain to reserve an address for. This is widely used on modern router-to-router WAN links to conserve address space compared to the traditional /30.
A /32 represents a single address and is used for host routes and loopback interfaces. Because a /32 describes exactly one address with no room for a separate network or broadcast address, it is treated as a direct host identifier rather than a subnet in the traditional sense.
IPv4 Address Classes vs CIDR
Before CIDR, IPv4 address space was divided into fixed classes based on the leading bits of the address:
| Class | First Octet Range | Default Mask | Typical Allocation Size |
|---|---|---|---|
| Class A | 1–126 | 255.0.0.0 (/8) | 16.7 million addresses |
| Class B | 128–191 | 255.255.0.0 (/16) | 65,536 addresses |
| Class C | 192–223 | 255.255.255.0 (/24) | 256 addresses |
This model was simple to implement but poorly matched to real-world requirements. Many organizations were allocated far more address space than they needed, and there was no efficient way to request an intermediate size such as 1,000 or 4,000 addresses. Classful routing protocols also carried no subnet mask information in their updates, which meant an entire network had to use a single consistent mask throughout.
CIDR removed the concept of fixed class boundaries entirely. Under CIDR, address classes are no longer functionally relevant — a /24 can appear anywhere in the IPv4 address space, regardless of what class its first octet would have historically implied. Modern routing protocols such as OSPF, EIGRP, and BGP all carry prefix length information directly, allowing variable-length subnetting throughout a network. The terms Class A, B, and C persist in common usage mainly as informal shorthand for address range and default mask, not as an active constraint on network design.
Private vs Public IPv4 Address Space
RFC 1918 reserves three blocks of IPv4 address space for private use within organizations, meaning these addresses are not routed on the public internet:
| RFC 1918 Range | CIDR Block | Total Addresses |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16,777,216 |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1,048,576 |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 |
Private address space allows organizations to build large internal networks without consuming scarce public IPv4 addresses. Public IP addresses, by contrast, are globally unique and routable across the internet, and are typically allocated by regional internet registries to ISPs and then to end organizations.
Network Address Translation (NAT) allows devices using private addressing to communicate with public internet resources by translating private source addresses to a public address at the network edge. Port Address Translation (PAT), a specific form of NAT, allows many internal hosts to share a single public IP address by distinguishing sessions using unique source port numbers. This combination is what allows most enterprise and residential networks to operate with a small number of public addresses despite having many more internal devices.
Planning an enterprise network refresh?
Subnetting decisions affect VLAN design, routing, segmentation, growth, and long-term supportability. If you need help validating an addressing plan or designing a scalable network architecture, Anchor Defense can provide an experienced second set of eyes.
Common Enterprise Subnet Sizes
| CIDR | Typical Deployment | Guidance |
|---|---|---|
| /24 | Standard office LAN or VLAN | Provides 254 usable hosts, a common default for a single VLAN or floor. Leaves reasonable room for growth without being excessive. |
| /23 | Large office or dense floor | Combines two /24 blocks into 510 usable hosts. Useful where a single /24 is already near capacity and re-addressing is undesirable. |
| /30 | Traditional WAN link | Provides exactly two usable addresses for a point-to-point circuit. Still common on legacy links and some vendor equipment. |
| /31 | Modern point-to-point link | Conserves address space on router-to-router links by using both addresses in the block as host addresses, per RFC 3021. |
| /32 | Loopback interface | Used for router loopbacks, host routes, and anycast addressing where only a single address needs to be represented. |
The right subnet size for a given segment depends on projected device count, growth expectations, and the broadcast domain characteristics of the traffic running on it. Oversized subnets increase the blast radius of broadcast traffic and Layer 2 issues; undersized subnets force premature re-addressing as an environment grows.
Variable-Length Subnet Masking (VLSM)
Variable-length subnet masking allows multiple subnet sizes to be created from the same parent address block. Instead of assigning every VLAN or routed segment an identical prefix, an engineer can match each subnet to its actual capacity requirement while preserving contiguous space for growth and route summarization.
For example, a parent block such as 10.10.0.0/22 could be divided into a /23 for users, a /25 for servers, a /26 for voice, a /27 for printers, and a /28 for infrastructure management. The largest requirement should normally be allocated first, followed by progressively smaller subnets, with every boundary aligned to the selected prefix length.
| Function | Example Prefix | Usable Addresses | Planning Consideration |
|---|---|---|---|
| User access | /23 | 510 | Supports a dense user VLAN with growth capacity. |
| Server segment | /25 | 126 | Leaves room for server, appliance, and service expansion. |
| Voice | /26 | 62 | Suitable for a smaller phone or voice-services segment. |
| Printers and shared devices | /27 | 30 | Limits the broadcast domain for a small endpoint group. |
| Infrastructure management | /28 | 14 | Useful for switches, controllers, firewalls, and management interfaces. |
VLSM improves address efficiency, but it also increases the importance of documentation. Every allocated block should be recorded in an IP address management system, checked for overlap, and evaluated as part of the organization's larger summarization strategy.
Worked Subnetting Example
Consider the address 192.168.50.27/24. Walking through this calculation demonstrates the process described earlier in concrete terms.
- Subnet mask: A /24 prefix corresponds to 255.255.255.0, or 11111111.11111111.11111111.00000000 in binary.
- Network address: Applying a bitwise AND between 192.168.50.27 and 255.255.255.0 zeroes out the last octet, producing 192.168.50.0.
- Broadcast address: Setting all host bits (the last octet) to 1 produces 192.168.50.255.
- Usable host range: The first usable host is the network address plus one, 192.168.50.1, and the last usable host is the broadcast address minus one, 192.168.50.254.
- Usable hosts: A /24 provides 256 total addresses, minus the network and broadcast addresses, for 254 usable hosts.
- Wildcard mask: Inverting 255.255.255.0 bit-by-bit produces 0.0.0.255.
The original host address, 192.168.50.27, falls within this usable range and is a valid host address on the 192.168.50.0/24 subnet.
Common IPv4 Subnetting Mistakes
- Using the wrong subnet mask — applying a mask that does not match the intended subnet size, leading to overlapping or fragmented address space.
- Miscounting usable hosts — forgetting to subtract the network and broadcast addresses, or misapplying the /31 exception.
- Ignoring growth — sizing a subnet exactly to current device count with no room for expansion, forcing a disruptive re-addressing project later.
- Broadcast domain too large — deploying an oversized subnet (a /16 for a single VLAN, for example) that increases broadcast traffic and Layer 2 instability risk.
- Incorrect summarization — advertising a summary route that does not align to a valid CIDR boundary, causing routing black holes or unintended overlap.
- Using overlapping subnets — assigning address ranges that intersect with existing subnets, common in mergers, acquisitions, or VPN interconnects.
- Misunderstanding /31 — assuming a /31 requires a network and broadcast address like other prefixes, when RFC 3021 treats both addresses as usable.
- Confusing address classes with CIDR — assuming a "Class C" address must use a /24 mask, when CIDR allows any prefix length regardless of the address's historical class.
Subnet Planning Best Practices
- Plan for growth — size subnets with reasonable headroom above current device counts, particularly for VLANs supporting end-user devices or IoT endpoints.
- Reserve address space — set aside contiguous blocks for future sites, VLANs, or services rather than allocating sequentially with no gaps.
- Align subnets to VLANs — maintain a clean one-to-one relationship between VLAN IDs and subnets where possible to simplify troubleshooting and access control.
- Document thoroughly — maintain an accurate IP address management (IPAM) record of every subnet, its purpose, owner, and utilization.
- Design for summarization — allocate subnets in contiguous blocks aligned to natural CIDR boundaries so they can be summarized cleanly at distribution and core routing layers.
- Use hierarchical addressing — structure address space by region, site, and function so that summarization and troubleshooting scale predictably as the network grows.
- Design for future scalability — anticipate mergers, cloud migrations, and new sites when selecting an initial addressing scheme, since re-addressing a live network is disruptive and costly.
- Leverage automation — use IPAM tooling and automated provisioning where possible to reduce manual errors in subnet assignment and tracking.
Frequently Asked Questions
What is a subnet mask used for?
A subnet mask defines which bits of an IP address represent the network portion and which represent the host portion, allowing devices to determine whether another address is on the same local subnet or must be reached through a router.
What does CIDR notation mean?
CIDR notation, such as /24, indicates the number of leading bits in an address that make up the network portion, replacing the need to express a full subnet mask separately.
Why can't the network and broadcast addresses be assigned to hosts?
The network address identifies the subnet as a whole, and the broadcast address is reserved to deliver traffic to every host on the subnet simultaneously. Assigning either to an individual host would create ambiguity in how the address is interpreted.
What is a wildcard mask?
A wildcard mask is the inverse of a subnet mask, commonly used in Cisco access control lists and OSPF network statements to define which address bits must match and which are allowed to vary.
Why is a /31 subnet different from other prefixes?
RFC 3021 permits /31 subnets on point-to-point links to use both addresses in the block as host addresses, since a two-address link has no practical need for a separate broadcast address.
What is a /32 used for?
A /32 represents a single address and is typically used for router loopback interfaces, host routes, and anycast addressing, rather than a traditional multi-host subnet.
What are the RFC 1918 private address ranges?
The three private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not routed on the public internet and are intended for internal use.
How is a public IP address different from a private one?
A public IP address is globally unique and routable across the internet, while a private address is only valid within an internal network and requires NAT or PAT to communicate externally.
How many usable hosts are in a /27 subnet?
A /27 subnet contains 32 total addresses, with 30 usable host addresses after the network and broadcast addresses are reserved.
Do address classes still matter in modern networking?
Not for routing or subnet design. CIDR allows any prefix length regardless of an address's historical class, and modern routing protocols carry prefix length information directly rather than relying on classful assumptions.
How should I size a VLAN's subnet?
Base VLAN subnet size on realistic current device count plus a reasonable growth margin, while avoiding an oversized broadcast domain that unnecessarily increases Layer 2 traffic and failure scope.
What is the difference between a network address and a subnet ID?
These terms are generally used interchangeably — both refer to the address with all host bits set to zero, identifying the subnet as a whole rather than any individual host.
Why do WAN links sometimes use /30 and sometimes /31?
A /30 follows traditional subnetting rules with a reserved network and broadcast address, providing two usable hosts. A /31, permitted under RFC 3021, eliminates that reservation on point-to-point links, providing the same two usable addresses while consuming half the address space.
What happens if two subnets overlap?
Overlapping subnets create routing ambiguity and can cause unpredictable traffic forwarding, particularly during VPN interconnects, mergers, or cloud peering where two previously separate networks must integrate.
How does subnetting relate to route summarization?
Subnets allocated in contiguous, CIDR-aligned blocks can be represented by a single summary route at a distribution or core router, reducing the size of routing tables and improving convergence time.
Conclusion
Subnet planning is not a one-time exercise — it is a discipline that underpins every network design decision that follows it, from VLAN assignment to routing architecture to firewall segmentation. A well-structured addressing plan scales cleanly as an organization grows; a poorly structured one creates recurring friction that eventually forces a disruptive re-addressing effort.
An IPv4 subnet calculator is most valuable when it is used deliberately during network design, IP address planning, infrastructure upgrades, campus deployments, cloud migrations, routing redesigns, and data center buildouts — any point where address allocation decisions will have long-term consequences. Understanding the mechanics behind the calculator's output, rather than treating it as a black box, is what allows an engineer to catch design issues before they are built into production infrastructure.
Turn Addressing Decisions Into a Scalable Network Architecture.
Anchor Defense helps federal and defense organizations validate addressing plans, design scalable network architectures, improve segmentation, and align routing, switching, wireless, and security requirements with long-term operational needs.