IPv4 Subnet Calculator

An IPv4 address is 32 bits, and CIDR (Classless Inter-Domain Routing) notation splits those 32 bits into a network portion and a host portion. The number after the slash — the prefix length — is how many of the leading bits are fixed as the network; everything after that is available for host addresses. A /24 fixes the first 24 bits, leaving 8 bits for hosts, which gives 2^8 = 256 total addresses in that block. A /26 fixes 26 bits, leaving only 6 host bits, for 2^6 = 64 addresses — a smaller prefix number always means a larger block, and a larger prefix number always means a smaller one, which trips people up the first few times.

This replaced the older "classful" system (Class A, B, C networks with fixed sizes) precisely because fixed-size blocks wasted huge numbers of addresses for organizations that needed something in between — CIDR lets a network be exactly the size it needs to be, at the cost of the network boundary no longer being obvious just from looking at the first octet of an address.

Within any subnet, the address with every host bit set to zero is the network address — it identifies the subnet itself, not any individual device on it, and is used in routing tables to refer to the whole block. The address with every host bit set to one is the broadcast address — a packet sent there is (traditionally) delivered to every host on that subnet simultaneously. Neither is assignable to a single device on most networks, which is why a /24 has 256 total addresses but only 254 usable ones for hosts.

The one common exception worth knowing: a /31 (only one usable host bit) is defined by RFC 3021 specifically to skip this rule for point-to-point links, since a two-address link has no meaningful concept of a broadcast address — both addresses in a /31 are usable, which is why they show up frequently in router-to-router WAN links where every address matters.

A subnet mask is the same prefix-length information as CIDR notation, written out in dotted-decimal form: /24 is 255.255.255.0, /26 is 255.255.255.192. It's applied with a bitwise AND against an address to find that address's network. A wildcard mask is the bitwise complement (inverse) of the subnet mask — 0.0.0.255 for a /24 — and it flips the logic: instead of "these bits must match to be in this network," a wildcard mask says "these bits don't matter for the match."

Wildcard masks show up mainly in Cisco IOS access control lists and OSPF network statements, where the syntax historically expected the inverted form rather than a standard subnet mask. Getting the two confused is a classic networking mistake — writing a subnet mask where a device expects a wildcard mask silently matches the wrong set of addresses instead of throwing an error, which makes it a particularly annoying bug to track down in a firewall rule.

Variable Length Subnet Masking is the practice of subdividing one larger address block into subnets of different sizes based on how many hosts each actually needs, instead of carving a network into equal fixed-size pieces. A site with a 200-host office, a 20-device server room, and a 2-address router link doesn't need three identical /24s — VLSM lets you assign a /24 to the office, a /27 (30 usable hosts) to the server room, and a /30 (2 usable hosts) to the router link, all carved out of the same parent block without waste.

This is standard practice in any real network design because IPv4 address space is a genuinely scarce resource — assigning a /24 to a link that only ever needs 2 addresses wastes 252 of them. The tradeoff is that VLSM requires a routing protocol that can carry subnet mask information with each route (classless protocols like OSPF and BGP do this natively; the old classful protocols like the original RIP did not).

RFC 1918 reserves three blocks of IPv4 address space for private networks that will never be routed on the public internet: 10.0.0.0/8 (a full /8, over 16 million addresses, common in large corporate networks), 172.16.0.0/12 (about 1 million addresses, common in Docker and cloud VPC defaults), and 192.168.0.0/16 (65,536 addresses, the range almost every home router uses). Any device using one of these ranges needs NAT (Network Address Translation) at the network's edge to communicate with the public internet, since routers everywhere else are configured to simply drop traffic to and from these ranges.

Recognizing these three ranges on sight is genuinely useful troubleshooting knowledge: if you see 10.x.x.x, 172.16-31.x.x, or 192.168.x.x anywhere in a network diagram or a curl error message, you immediately know that's a private, locally-scoped address, not a real destination reachable from outside that network.

Online subnet calculators and command-line tools like ipcalc, sipcalc, or Python scripts all compute the same network parameters — network address, broadcast address, subnet mask, CIDR range, and usable host count — but they serve different workflows. A browser-based calculator is immediately accessible from any operating system with no installation, no dependencies, and no need to remember command syntax. You type an IP and prefix length, and every derived value appears instantly. For quick one-off calculations during a meeting, a network review, or a certification exam, that zero-friction availability is hard to beat.

Command-line tools excel at automation and scripting: you can loop through hundreds of subnets, integrate calculations into provisioning scripts, parse output with awk or jq, and version-control your network plans as code. ipcalc and sipcalc are preinstalled on many Linux distributions and are trivial to add to macOS via Homebrew, but they're absent from Windows by default and require either WSL or a standalone build. Python's ipaddr module offers the most flexibility but demands a runtime and some programming knowledge. Use the online calculator for ad-hoc queries and learning; use CLI tools when subnet calculation needs to be repeatable, automated, or embedded in infrastructure-as-code pipelines.