Subnet Calculator

Paste an IPv4 or IPv6 address with a CIDR prefix (e.g. 192.168.1.10/24 or 2001:db8::1/64) and get back the network address, broadcast, first and last usable host, netmask and total address count. IPv6 skips broadcast — the protocol simply doesn’t have one — and shows the size of the range instead.

The arithmetic behind every answer is the same. The prefix length says how many leading bits are fixed by the network; whatever is left belongs to hosts. A /24 fixes 24 bits and leaves 8, so the block holds 2^(32−24) = 256 addresses, of which 254 are usable: the first address identifies the network and the last is the broadcast. From there the table is easy to memorise — /25 is 128 addresses and 126 hosts, /26 is 64/62, /27 is 32/30, /28 is 16/14, /29 is 8/6, /30 is 4/2. The part people forget is that splitting costs you addresses. Carve a /24 into four /26s and you drop from 254 usable hosts to 248, because each new subnet reserves its own network and broadcast pair.

/31 is the documented exception to the minus-two rule. RFC 3021 allows both addresses of a /31 to be used as hosts on a point-to-point link, since there is nobody else on the wire that a broadcast could reach. Every mainstream router vendor has supported it for years, and on a network with a few hundred WAN links it halves the address waste compared with the traditional /30. /32 isn’t really a subnet at all — it’s a single host route, the form you see on loopback interfaces, in BGP advertisements for anycast VIPs, and in firewall rules that name exactly one machine.

The practical cases where you actually reach for this: sizing a VPC or VLAN before clicking create in a cloud console; expanding a vendor-supplied CIDR allowlist into a readable range so you can confirm it covers the IPs you expect; sanity-checking a firewall rule where someone wrote /26 and you need to know whether that is 32, 64 or 128 addresses; splitting a /24 for a branch-office plan.

Variable Length Subnet Masking is why the calculator gets opened more than once per project. Instead of chopping a /16 into equal pieces, you size each subnet to what it actually needs — a /22 for a user VLAN with 900 devices, a /26 for servers, a /29 for the DMZ, /31s for the transit links. The constraint is alignment: a subnet has to start on its own natural boundary, so a /26 begins at .0, .64, .128 or .192 and nowhere else. Type an address that isn’t the network address and the calculator shows you which network it actually falls into, which is the fastest way to catch a misaligned plan before it reaches a router.

A few reserved blocks are worth recognising on sight. RFC 1918 gives you 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use — and the 172.16 one is regularly misread, because /12 covers 172.16.0.0 through 172.31.255.255, not just the 172.16 range. Beyond that: 100.64.0.0/10 is CGNAT space handed out by ISPs that have run out of public IPv4; 169.254.0.0/16 is link-local, and seeing it on a host almost always means DHCP failed; 127.0.0.0/8 is loopback; 224.0.0.0/4 is multicast.

IPv6 changes the habits more than the maths. There is no broadcast, its role having been taken over by multicast groups, and subnets are effectively always /64 because stateless autoconfiguration (SLAAC) expects 64 bits of interface identifier. A site typically receives a /48, which contains 65,536 /64s, so you plan by allocating subnet IDs in the 16 bits between /48 and /64 rather than by counting hosts — a single /64 already holds about 18 quintillion addresses and will never fill. Prefixes longer than /64 are legal and sometimes used on point-to-point links and loopbacks, but they break SLAAC, so use them deliberately or not at all.

What this calculator will not do is check whether a range is already in use, talk to your router, or tell you that a plan is routable. It is arithmetic on the numbers you type — no packets, no scanning, no external lookup — which is exactly why you can paste a production range or an internal RFC 1918 block without worrying about it being logged or probed. If the question is who owns a public range rather than how it divides, that’s an ASN or WHOIS lookup instead.