IPv4 Subnet Calculator
Turn any CIDR block into its netmask, wildcard, network and broadcast addresses, usable host range and binary breakdown.
192.168.1.0255.255.255.00.0.0.255192.168.1.255192.168.1.1192.168.1.254Bit breakdown
| Address | 11000000.10101000.00000001.00001010 |
| Netmask | 11111111.11111111.11111111.00000000 |
| Network | 11000000.10101000.00000001.00000000 |
| Broadcast | 11000000.10101000.00000001.11111111 |
The first 24 bits are the network; the remaining 8 are the host. Network = address AND netmask. Broadcast = network OR wildcard. It is the same masking the bitmask generator does, with dotted-decimal formatting on top.
3232235786C0.A8.01.0A4294967040Split this block
Each extra prefix bit halves the block. Pick a target prefix to see the resulting subnets.
CIDR reference
| Prefix | Netmask | Wildcard | Addresses | Usable hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 |
How subnetting works
An IPv4 address is a single 32-bit number; the dots are only formatting. A prefix length splits those 32 bits into a network part and a host part. Every host on a link shares the network part, which is what lets a router decide, from one AND operation, whether a packet is local or has to be forwarded.
The netmask is that split written as a bitmask: /24 is 24 ones followed by 8 zeros, printed 255.255.255.0. Because the ones have to be contiguous and left-aligned, a mask and a prefix length carry exactly the same information - which is why CIDR notation replaced dotted netmasks for most purposes in 1993.
Two addresses in every block are reserved. All-zeros in the host part names the network itself; all-ones is the directed broadcast. That is where “254 usable hosts in a /24” comes from, and it is why a /30 - four addresses - gives you only two usable ones. The exceptions are /31, where RFC 3021 dispenses with the broadcast for point-to-point links, and /32, a single host route.
Wildcard masks and ACLs
A wildcard mask is the bitwise NOT of the netmask, and Cisco ACLs and OSPF network statements want it rather than the netmask. A /24 becomes 0.0.0.255. The rule is the same one every bitmask follows: a 0 in the wildcard means “this bit must match”, a 1 means “don't care”. Writing the netmask where a wildcard is expected silently matches the wrong traffic, which is one of the more expensive typos in networking.
Private and reserved ranges
| Range | Purpose | RFC |
|---|---|---|
| 10.0.0.0/8 | Private network | RFC 1918 |
| 172.16.0.0/12 | Private network (172.16-172.31 only) | RFC 1918 |
| 192.168.0.0/16 | Private network | RFC 1918 |
| 100.64.0.0/10 | Carrier-grade NAT | RFC 6598 |
| 127.0.0.0/8 | Loopback | RFC 1122 |
| 169.254.0.0/16 | Link-local (APIPA) | RFC 3927 |
| 192.0.2.0/24 | Documentation (TEST-NET-1) | RFC 5737 |
| 198.51.100.0/24 | Documentation (TEST-NET-2) | RFC 5737 |
| 203.0.113.0/24 | Documentation (TEST-NET-3) | RFC 5737 |
| 224.0.0.0/4 | Multicast | RFC 5771 |
| 240.0.0.0/4 | Reserved | RFC 1112 |
The 172.16.0.0/12 boundary catches people out: 172.16 through 172.31 are private, but 172.32.0.0 onwards is public address space belonging to somebody else.
Code Examples
import ipaddress
net = ipaddress.ip_network("192.168.1.0/24")
net.network_address # 192.168.1.0
net.broadcast_address # 192.168.1.255
net.netmask # 255.255.255.0
net.hostmask # 0.0.0.255
net.num_addresses # 256
list(net.hosts())[0] # 192.168.1.1
# split into four /26s
[str(s) for s in net.subnets(prefixlen_diff=2)]Frequently Asked Questions
What does the /24 in a CIDR block mean?
It is the prefix length: the number of leading bits that identify the network. A /24 fixes the first 24 bits and leaves 8 for hosts, which is 256 addresses, 254 of them usable. The netmask 255.255.255.0 is exactly those 24 bits set to 1.
Why are there two fewer usable hosts than addresses?
The all-zeros host address is the network identifier and the all-ones host address is the directed broadcast, so neither can be assigned to an interface. A /24 has 256 addresses and 254 usable hosts. The exceptions are /31 and /32.
What is a /31 used for?
RFC 3021 point-to-point links. A /31 has only two addresses and, because there is no room for one, no broadcast address - both addresses are usable. It halves the address waste on router-to-router links compared with the /30 that used to be standard.
What is a wildcard mask?
The bitwise inverse of the netmask. Cisco ACLs and OSPF network statements take wildcards rather than netmasks, so a /24 is written 0.0.0.255. It is the same mask with the roles of 1 and 0 swapped, which is exactly what a NOT does.
Which address ranges are private?
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use. Note the middle one: 172.16 through 172.31 are private, but 172.32 onwards is public. The calculator also flags loopback (127/8), link-local (169.254/16), carrier-grade NAT (100.64/10) and the documentation ranges.
How do I split a /24 into smaller subnets?
Borrow bits from the host portion. Each extra prefix bit halves the block, so a /24 becomes two /25s, four /26s, eight /27s and so on. The split table on this page lists the resulting networks, broadcasts and host ranges.
Are address classes still relevant?
Not for routing - classful addressing was replaced by CIDR in 1993. The class letter still gets asked for in exams and appears in old documentation, so it is shown here, but the prefix length is what actually determines the network boundary.
How does a netmask relate to a bitmask?
It is the same thing. A netmask is a 32-bit bitmask whose ones must be contiguous and left-aligned. Network address is address AND mask; broadcast is network OR wildcard. The bitmask generator on this site does the identical arithmetic without the dotted-decimal formatting.
Why is 255.255.0.255 not a valid netmask?
Because the ones are not contiguous. A netmask has to be a run of ones followed by a run of zeros so that a single prefix length describes it. Masks with holes are rejected here rather than silently accepted.
Related Tools
This tool runs entirely in your browser - nothing you enter is uploaded or stored.