Skip to content

IPv4 Subnet Calculator

Turn any CIDR block into its netmask, wildcard, network and broadcast addresses, usable host range and binary breakdown.

Network address192.168.1.0
Netmask255.255.255.0
Wildcard mask0.0.0.255
Broadcast192.168.1.255
First host192.168.1.1
Last host192.168.1.254
Prefix/24
Addresses256
Usable hosts254
ClassC
Private network (RFC 1918) - not routable on the public internet; needs NAT to reach it.

Bit breakdown

Address11000000.10101000.00000001.00001010
Netmask11111111.11111111.11111111.00000000
Network11000000.10101000.00000001.00000000
Broadcast11000000.10101000.00000001.11111111

The first 24 bits are the network; the remaining 8 are the host. Network = address AND netmask. Broadcast = network OR wildcard. It is the same masking the bitmask generator does, with dotted-decimal formatting on top.

Address as integer3232235786
Address in hexC0.A8.01.0A
Netmask as integer4294967040

Split this block

Each extra prefix bit halves the block. Pick a target prefix to see the resulting subnets.

CIDR reference

PrefixNetmaskWildcardAddressesUsable hosts
/8255.0.0.00.255.255.25516,777,21616,777,214
/9255.128.0.00.127.255.2558,388,6088,388,606
/10255.192.0.00.63.255.2554,194,3044,194,302
/11255.224.0.00.31.255.2552,097,1522,097,150
/12255.240.0.00.15.255.2551,048,5761,048,574
/13255.248.0.00.7.255.255524,288524,286
/14255.252.0.00.3.255.255262,144262,142
/15255.254.0.00.1.255.255131,072131,070
/16255.255.0.00.0.255.25565,53665,534
/17255.255.128.00.0.127.25532,76832,766
/18255.255.192.00.0.63.25516,38416,382
/19255.255.224.00.0.31.2558,1928,190
/20255.255.240.00.0.15.2554,0964,094
/21255.255.248.00.0.7.2552,0482,046
/22255.255.252.00.0.3.2551,0241,022
/23255.255.254.00.0.1.255512510
/24255.255.255.00.0.0.255256254
/25255.255.255.1280.0.0.127128126
/26255.255.255.1920.0.0.636462
/27255.255.255.2240.0.0.313230
/28255.255.255.2400.0.0.151614
/29255.255.255.2480.0.0.786
/30255.255.255.2520.0.0.342
/31255.255.255.2540.0.0.122
/32255.255.255.2550.0.0.011

How subnetting works

An IPv4 address is a single 32-bit number; the dots are only formatting. A prefix length splits those 32 bits into a network part and a host part. Every host on a link shares the network part, which is what lets a router decide, from one AND operation, whether a packet is local or has to be forwarded.

The netmask is that split written as a bitmask: /24 is 24 ones followed by 8 zeros, printed 255.255.255.0. Because the ones have to be contiguous and left-aligned, a mask and a prefix length carry exactly the same information - which is why CIDR notation replaced dotted netmasks for most purposes in 1993.

Two addresses in every block are reserved. All-zeros in the host part names the network itself; all-ones is the directed broadcast. That is where “254 usable hosts in a /24” comes from, and it is why a /30 - four addresses - gives you only two usable ones. The exceptions are /31, where RFC 3021 dispenses with the broadcast for point-to-point links, and /32, a single host route.

Wildcard masks and ACLs

A wildcard mask is the bitwise NOT of the netmask, and Cisco ACLs and OSPF network statements want it rather than the netmask. A /24 becomes 0.0.0.255. The rule is the same one every bitmask follows: a 0 in the wildcard means “this bit must match”, a 1 means “don't care”. Writing the netmask where a wildcard is expected silently matches the wrong traffic, which is one of the more expensive typos in networking.

Private and reserved ranges

RangePurposeRFC
10.0.0.0/8Private networkRFC 1918
172.16.0.0/12Private network (172.16-172.31 only)RFC 1918
192.168.0.0/16Private networkRFC 1918
100.64.0.0/10Carrier-grade NATRFC 6598
127.0.0.0/8LoopbackRFC 1122
169.254.0.0/16Link-local (APIPA)RFC 3927
192.0.2.0/24Documentation (TEST-NET-1)RFC 5737
198.51.100.0/24Documentation (TEST-NET-2)RFC 5737
203.0.113.0/24Documentation (TEST-NET-3)RFC 5737
224.0.0.0/4MulticastRFC 5771
240.0.0.0/4ReservedRFC 1112

The 172.16.0.0/12 boundary catches people out: 172.16 through 172.31 are private, but 172.32.0.0 onwards is public address space belonging to somebody else.

Code Examples

import ipaddress

net = ipaddress.ip_network("192.168.1.0/24")

net.network_address   # 192.168.1.0
net.broadcast_address # 192.168.1.255
net.netmask           # 255.255.255.0
net.hostmask          # 0.0.0.255
net.num_addresses     # 256
list(net.hosts())[0]  # 192.168.1.1

# split into four /26s
[str(s) for s in net.subnets(prefixlen_diff=2)]

Frequently Asked Questions

What does the /24 in a CIDR block mean?

It is the prefix length: the number of leading bits that identify the network. A /24 fixes the first 24 bits and leaves 8 for hosts, which is 256 addresses, 254 of them usable. The netmask 255.255.255.0 is exactly those 24 bits set to 1.

Why are there two fewer usable hosts than addresses?

The all-zeros host address is the network identifier and the all-ones host address is the directed broadcast, so neither can be assigned to an interface. A /24 has 256 addresses and 254 usable hosts. The exceptions are /31 and /32.

What is a /31 used for?

RFC 3021 point-to-point links. A /31 has only two addresses and, because there is no room for one, no broadcast address - both addresses are usable. It halves the address waste on router-to-router links compared with the /30 that used to be standard.

What is a wildcard mask?

The bitwise inverse of the netmask. Cisco ACLs and OSPF network statements take wildcards rather than netmasks, so a /24 is written 0.0.0.255. It is the same mask with the roles of 1 and 0 swapped, which is exactly what a NOT does.

Which address ranges are private?

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use. Note the middle one: 172.16 through 172.31 are private, but 172.32 onwards is public. The calculator also flags loopback (127/8), link-local (169.254/16), carrier-grade NAT (100.64/10) and the documentation ranges.

How do I split a /24 into smaller subnets?

Borrow bits from the host portion. Each extra prefix bit halves the block, so a /24 becomes two /25s, four /26s, eight /27s and so on. The split table on this page lists the resulting networks, broadcasts and host ranges.

Are address classes still relevant?

Not for routing - classful addressing was replaced by CIDR in 1993. The class letter still gets asked for in exams and appears in old documentation, so it is shown here, but the prefix length is what actually determines the network boundary.

How does a netmask relate to a bitmask?

It is the same thing. A netmask is a 32-bit bitmask whose ones must be contiguous and left-aligned. Network address is address AND mask; broadcast is network OR wildcard. The bitmask generator on this site does the identical arithmetic without the dotted-decimal formatting.

Why is 255.255.0.255 not a valid netmask?

Because the ones are not contiguous. A netmask has to be a run of ones followed by a run of zeros so that a single prefix length describes it. Masks with holes are rejected here rather than silently accepted.

Related Tools

This tool runs entirely in your browser - nothing you enter is uploaded or stored.