IPv4 Subnet Calculator

How to use this subnet calculator

Enter any IPv4 address with a CIDR prefix (e.g., 192.168.1.0/24) or with a dotted-decimal subnet mask (e.g., 10.0.0.0 255.0.0.0). You can also enter a host address like 10.1.4.17/22 — the calculator derives the correct network address automatically by zeroing out the host bits.

What subnetting actually does

An IPv4 address is a 32-bit number split into two parts: the network portion and the host portion. The subnet mask is a second 32-bit number whose job is to draw the boundary between those two parts — all the 1-bits in the mask cover the network portion, and all the 0-bits cover the host portion. Subnetting is the act of lengthening the network portion (adding more 1-bits to the mask) to divide a larger address block into smaller, isolated segments.

Why does isolation matter? Every device on a subnet shares a broadcast domain. When one host sends an ARP request or a broadcast frame, every other device on the same subnet receives and processes it. A flat /16 with 65,000 hosts generates a constant flood of broadcast traffic that degrades performance and makes troubleshooting nearly impossible. Splitting it into /24s limits broadcast traffic to 254-host segments, makes routing policies granular, and lets you apply firewall rules between departments or server tiers.

How the arithmetic works

Every output this calculator produces comes from three bitwise operations on a 32-bit integer:

• Network address — IP AND mask. Every bit where the mask is 1 is kept; every bit where the mask is 0 is zeroed. The result is the first address in the subnet and is not assignable to a host.
• Broadcast address — IP OR NOT(mask). All the host bits are set to 1. The result is the last address in the subnet, reserved for subnet-wide broadcasts, and also not assignable.
• Usable host range — network address + 1 through broadcast address − 1. The count is 2^(32 − prefix) − 2.
• Wildcard mask — NOT(mask), the bitwise inverse. Used in Cisco ACLs and OSPF network statements. Where the subnet mask has a 0-bit (host bits), the wildcard has a 1-bit (don't care).

Worked example: 172.16.0.0/20

Take the block 172.16.0.0/20. A /20 prefix means 20 network bits and 12 host bits. The mask in binary is 20 ones followed by 12 zeros: 11111111.11111111.11110000.00000000, which is 255.255.240.0 in dotted decimal.

This is a typical medium-sized subnet for a campus building or a server VLAN — large enough to not run out of addresses, small enough to keep broadcast traffic manageable. In a real addressing plan you would document each subnet by its network address and prefix, not by its broadcast or host range.

Common subnet masks reference

What is subnetting and why it matters

Subnetting is the process of dividing a single IP network into smaller, logically isolated segments called subnets. The fundamental motivation is efficiency: the original IPv4 address space was designed for a much simpler internet, and without subnetting every organisation would waste enormous blocks of addresses that go unused. A Class B allocation, for example, hands you 65,534 host addresses. If you only need 300 hosts, the remaining 65,234 addresses sit idle — an unacceptable waste when public IPv4 space is exhausted.

Beyond address conservation, subnetting enforces security boundaries. Devices on different subnets cannot communicate directly — they must pass through a router or Layer 3 switch, where access control lists and firewall rules can inspect and filter traffic. This containment limits the blast radius of a compromised host: malware that spreads via broadcast (ARP, NetBIOS, multicast) stays within the subnet boundary. Subnetting also reduces broadcast domain size, which directly lowers the CPU load on every host in the segment — fewer broadcast frames to process means better performance for everyone. For network engineers, mastering subnetting is not optional; it is the bedrock skill that every other networking concept builds upon.

How to read CIDR notation

CIDR (Classless Inter-Domain Routing) notation expresses an IP address and its subnet mask together using a slash suffix. The number after the slash is the prefix length — the count of consecutive 1-bits in the subnet mask, reading from the most significant bit. For example, 192.168.10.0/24 means the first 24 bits are the network portion and the remaining 8 bits identify individual hosts. This maps to the dotted-decimal mask 255.255.255.0 (24 ones followed by 8 zeros). CIDR replaced the old classful A/B/C system, which forced you to use fixed masks regardless of actual need. With CIDR, a /27 gives you 30 usable hosts and a /16 gives you over 65,000 — you choose the size that fits. When reading a CIDR block, calculate usable hosts as 2^(32−prefix) − 2 (subtract network address and broadcast address).

Subnetting in enterprise networks

Enterprise network design typically allocates subnets by function and security zone rather than by physical location alone. A common pattern: a /8 or /16 private block is divided into regional supernets (/16 or /20), each region is further divided into site blocks (/22 or /23), and each site block is subdivided into function-specific subnets — users on /24, servers on /26, management on /28, and point-to-point WAN links on /30. This hierarchical approach keeps the routing table small through summarization: edge routers advertise only the site /22, not every individual /24 and /26 within it. When you need to grow the address space, you can simply extend the hierarchy by carving a new site block from the regional supernet, without redesigning the entire scheme.

Production subnet reference — most-used sizes

Common subnetting mistakes

Assigning the network or broadcast address to a host. The network address (all host bits zero) and the broadcast address (all host bits one) are reserved and cannot be configured on a router interface or end device. Cisco IOS will reject them outright; other platforms may accept the configuration but produce unexpected behavior.

Expecting four usable hosts from a /30. A /30 has 4 total addresses (2² = 4), but two are reserved — network and broadcast — leaving exactly 2 usable hosts. That is intentional: /30 subnets exist precisely for point-to-point WAN links where you need one address per router interface and nothing else. If you need more than 2 hosts, use a /29 (6 usable).

Confusing the subnet mask with the wildcard mask. The mask 255.255.255.0 as a Cisco ACL wildcard argument means "ignore the first three octets, match only addresses where the fourth octet is zero" — the opposite of what you usually want. Wildcard masks should be the inverse: 0.0.0.255 for a /24.

Overlapping subnets in an addressing plan. If you allocate 10.0.0.0/22 to one site and 10.0.2.0/23 to another, the second is entirely contained inside the first (10.0.2.0–10.0.3.255 falls within 10.0.0.0–10.0.3.255). Routing will work unpredictably depending on which entry is more specific. Always verify that each subnet's range — network address through broadcast — does not overlap with any other allocation.

Non-contiguous subnet masks. A valid subnet mask is always a run of consecutive 1-bits followed by consecutive 0-bits — for example 255.255.255.0. A mask that does not align to a power-of-two boundary (1-bits interleaved with 0-bits) confuses routers and is rejected outright by modern IOS. If your calculated mask is not one of the standard contiguous values, the prefix length is wrong.

The /31 special case. RFC 3021 allows /31 subnets on point-to-point links. A /31 has only 2 addresses and no broadcast — both addresses are usable as host addresses. Modern IOS versions support this with the ip address x.x.x.x 255.255.255.254 command. It saves one address per link compared to /30, which matters at scale.