# IP Subnet Calculator

How subnetting works

Every IPv4 address is 32 bits, usually written as four decimal octets such as 192.168.10.37. A subnet splits those 32 bits into two parts: the network bits on the left, which are the same for every device in the subnet, and the host bits on the right, which identify one device inside it.

The prefix length says where the split is. In 192.168.10.37/26 the first 26 bits are the network part and the remaining 6 bits are the host part. That /26 notation is called CIDR (Classless Inter-Domain Routing, RFC 4632). Before CIDR, the split was fixed by the address class, which is why you still see “Class A/B/C” in older material and in the calculator above. Today the prefix length is explicit and classes only matter for history.

The same information can be written as a subnet mask: 26 ones followed by 6 zeros is 11111111.11111111.11111111.11000000, or 255.255.255.192. The wildcard mask is the inverse, 0.0.0.63, which is what Cisco-style access lists and OSPF network statements use. The calculator shows all three forms and lets you copy each.

Two addresses in every ordinary subnet are special:

• Network address: all host bits 0. It names the subnet itself (192.168.10.0).
• Broadcast address: all host bits 1. Packets sent to it reach every host in the subnet (192.168.10.63).

Everything in between is available for hosts. That is why the host count is the block size minus two, with exceptions for /31 and /32 covered below.

Worked example: 192.168.10.37/26

Take the default example in the calculator. You are given the host address 192.168.10.37 and the prefix /26.

Step 1: write the mask. 26 ones and 6 zeros. The first three octets are all ones (255), and the last octet is 11000000, which is 128 + 64 = 192. Mask: 255.255.255.192.

Step 2: write the address in binary. Only the last octet changes the result here, but it is worth seeing all four:

Step 3: AND the two. A bit of the result is 1 only if both inputs are 1. In the last octet, 00100101 AND 11000000 is 00000000. The network address is 192.168.10.0.

Step 4: set all host bits to 1 for the broadcast address. The six host bits become 111111, so the last octet is 00111111 = 63. Broadcast: 192.168.10.63.

Step 5: the usable range is everything between them. First host 192.168.10.1, last host 192.168.10.62. The block has 2^6 = 64 addresses, so 62 usable hosts.

Notice that 192.168.10.37 is not the network address. You can type any address inside a subnet and the calculator reports the block it belongs to; it also tells you when the address you entered has host bits set. The binary view in the tool shows the network bits highlighted and the host bits dimmed, so you can see exactly where the boundary falls.

Counting hosts: 2^(32 − n) − 2

For a prefix length n, the number of addresses is 2^(32 − n). Subtract two for the network and broadcast addresses and you get the usable hosts:

• /24: 2^8 = 256 addresses, 254 usable.
• /26: 2^6 = 64 addresses, 62 usable.
• /30: 2^2 = 4 addresses, 2 usable.

Two prefixes break the formula, and a good calculator handles both:

/31 has 2 usable addresses, not 0. Applying the formula literally gives 2 − 2 = 0, which would make /31 useless. RFC 3021 defines /31 for point-to-point links: with only two devices on the link there is nobody to broadcast to, so both addresses are assigned to the two ends. In a /31 the calculator therefore shows the first and last address as the two usable hosts and notes that there is no broadcast address in the classic sense. Some older devices do not support it, in which case use a /30.

/32 is a single host. One address, no network or broadcast concept. It shows up as a loopback address, a host route, or a firewall rule that matches exactly one machine. The calculator reports 1 total and 1 usable.

At the other end, 0.0.0.0/0 is all 4,294,967,296 IPv4 addresses and is how a default route is written.

Common prefixes

Here is a short reference. Every value comes from the same calculation the tool uses; for the full /0 to /32 chart see the subnet cheat sheet.

A quick way to remember it: each extra prefix bit halves the block. Going from /24 to /26 splits one block of 256 into four blocks of 64, at 192.168.10.0, .64, .128 and .192. The Split into smaller subnets control in the calculator does exactly that and lists each subnet with its host range.

Converting an IP range to CIDR blocks

Sometimes you have a start and an end address rather than a prefix, for example from a firewall export, a cloud provider’s IP list, or a block list. A CIDR block is only a power-of-two sized, aligned range, so an arbitrary range usually needs several blocks.

The algorithm is greedy. At the current address, take the biggest block that (a) starts exactly there, meaning the address is a multiple of the block size, and (b) does not extend past the end of the range. Then continue from the first address after that block.

Take 10.0.0.5 to 10.0.0.20, which is 16 addresses but not a single aligned block:

1. 10.0.0.5 is odd, so only a /32 fits at this address. Block: 10.0.0.5/32. Next: .6.
2. .6 is a multiple of 2 but not of 4, so a /31 fits (.6, .7). Block: 10.0.0.6/31. Next: .8.
3. .8 is a multiple of 8 and .8–.15 ends before .20, so a /29 fits. Block: 10.0.0.8/29. Next: .16.
4. .16 is a multiple of 16, but a /28 would run to .31, past the end. A /30 (.16–.19) fits. Block: 10.0.0.16/30. Next: .20.
5. .20 is the last address. Block: 10.0.0.20/32.

Result: 10.0.0.5/32, 10.0.0.6/31, 10.0.0.8/29, 10.0.0.16/30, 10.0.0.20/32. The sizes are 1 + 2 + 8 + 4 + 1 = 16 addresses, which matches. Use the IP range to CIDR tab to do this for any range and copy the list; a range that happens to be aligned, such as 192.168.0.0 to 192.168.255.255, collapses to a single 192.168.0.0/16.

Going the other way, CIDR to IP range, is simpler: the first address is the network address and the last is the broadcast address, shown in the main result.

IPv6 subnetting basics

IPv6 uses 128-bit addresses written as eight groups of four hex digits. Two shortening rules apply: leading zeros in a group can be dropped, and one run of two or more all-zero groups can be replaced with ::. So 2001:0db8:abcd:0012:0000:0000:0000:0001 becomes 2001:db8:abcd:12::1. Type either form into the calculator and it shows both, along with the network prefix, the first and last address of the block, and the size of the block as 2^n and as an exact number.

The prefix length works as in IPv4, but there is no broadcast address, and nobody counts “usable hosts” because the numbers are enormous. What matters is how you carve up the space:

• /64 per LAN. A single subnet is a /64: 64 bits of network prefix and 64 bits of interface identifier. SLAAC (stateless autoconfiguration) assumes this, so do not use a longer prefix on a normal LAN. A /64 holds 2^64 = 18,446,744,073,709,551,616 addresses.
• /48 per site. A /48 contains 2^16 = 65,536 /64 subnets.
• /56 per home or small site. A /56 contains 2^8 = 256 /64 subnets, which is a common allocation from an ISP to a household.
• /127 or /128 for links and loopbacks. RFC 6164 recommends /127 on router-to-router links, which is the IPv6 equivalent of the IPv4 /31. A /128 is a single address.

Try 2001:db8:abcd:12::1/64 in the IP / CIDR tab: the block runs from 2001:db8:abcd:12:: to 2001:db8:abcd:12:ffff:ffff:ffff:ffff. The 2001:db8::/32 range is reserved for documentation (RFC 3849), so it is safe for examples.

Private and public addresses

The calculator labels an address as private or public with a simple check against the ranges reserved by RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. It also flags loopback (127.0.0.0/8), link-local (169.254.0.0/16), carrier-grade NAT (100.64.0.0/10) and multicast. For the full list and a checker for any address, see private IP address ranges.

Subnetting math is identical for private and public space. What differs is who is allowed to route it: private ranges are reused inside every organization and are not routed on the public internet.

Common mistakes

• Treating the host address as the network address. 192.168.10.37/26 is a host inside 192.168.10.0/26. Routers and firewalls that expect a network address will reject or silently normalize the first form.
• Forgetting the two reserved addresses. A /28 has 16 addresses, not 16 hosts. Size subnets for hosts plus growth, then pick the prefix.
• Assuming /31 and /32 follow the “minus two” rule. They do not. /31 gives two usable addresses on a point-to-point link, /32 gives one.
• Using a non-contiguous mask. 255.0.255.0 is not a valid subnet mask. The 1 bits must be contiguous from the left. The calculator rejects such masks and says why.
• Mixing up the mask and the wildcard. 0.0.0.63 is a wildcard (host bits), 255.255.255.192 is a mask (network bits). They are bitwise inverses.
• Leading zeros in octets. Some tools read 010.0.0.1 as octal. The calculator rejects leading zeros rather than guessing.
• Overlapping subnets. Two blocks like 10.0.0.0/24 and 10.0.0.128/25 overlap. Splitting a block cleanly into aligned halves avoids this.
• A longer prefix than /64 on an IPv6 LAN. It breaks SLAAC. Keep /64 for hosts.

Verify on the command line

It is worth checking any calculator, this one included, against an independent tool. On macOS, ipcalc is available from Homebrew; Python’s standard library has an ipaddress module on every platform.

The ipcalc command prints everything in one go, including the binary view with the network/host boundary:

ipcalc 192.168.10.37/26

The values match the calculator: network 192.168.10.0/26, first host .1, last host .62, broadcast .63, 62 usable hosts, and the same Class C private classification.

With Python you do not need to install anything. strict=False allows an address with host bits set, as in our example:

python3 -c "import ipaddress; n=ipaddress.ip_network('192.168.10.37/26', strict=False); print(n, n.netmask, n.broadcast_address, n.num_addresses)"

That prints the network, mask, broadcast and total address count (64, not 62, because Python’s num_addresses counts every address in the block).

For the range conversion, ipcalc has a deaggregate mode that takes a start and an end:

ipcalc 10.0.0.5 - 10.0.0.20

It returns the same five blocks as the walkthrough above and as the IP range tab. In Python, ipaddress.summarize_address_range does the same job.

Related reading and tools

If you are planning address space for a lab, Ultimate Kubernetes Tutorial Part 2 shows a VM network configured with a /24 subnet, and NodePort vs ClusterIP shows Flannel handing each node its own /24 slice of the pod network. For a printable list of masks and sizes, use the subnet cheat sheet.