CIDR / Subnet Calculator — IPv4 & IPv6
Turn a CIDR prefix into the numbers you need: network and broadcast address, usable host range, subnet mask and host count.
- Network
- 11000000.10101000.00000001.00000000
- Mask
- 11111111.11111111.11111111.00000000
What the slash actually means
CIDR notation writes an address followed by a slash and a number: 192.168.1.0/24. The number is simply how many leading bits are fixed — how many bits identify the network rather than the host.
An IPv4 address is 32 bits. A /24 fixes the first 24, leaving 8 bits free. Eight bits give 2⁸ = 256 addresses, of which 254 are assignable to hosts (the first identifies the network, the last is the broadcast address).
Two consequences follow, and both surprise people:
A smaller number means a bigger network. A /16 has 65,536 addresses; a /24 has 256. The number counts fixed bits, not available ones, so it runs backwards from size.
Each step down doubles the network. /25 → /24 → /23 → /22 doubles at every step. This is why subnet sizes are always powers of two and why you cannot have a subnet of exactly 100 addresses — you take a /25 (128) and waste 28.
CIDR replaced the old class A/B/C system in 1993 precisely because classes only allowed three sizes, and the middle one — 65,534 hosts — was absurdly wasteful for an organisation that needed 300.
IPv4 prefix reference
| CIDR | Mask | Addresses | Usable | Typical use |
|---|---|---|---|---|
| /32 | 255.255.255.255 | 1 | 1 | A single host — firewall rules, allow-lists |
| /31 | 255.255.255.254 | 2 | 2* | Point-to-point links (RFC 3021) |
| /30 | 255.255.255.252 | 4 | 2 | Router-to-router links, the classic choice |
| /29 | 255.255.255.248 | 8 | 6 | A small block of servers |
| /28 | 255.255.255.240 | 16 | 14 | A small device segment |
| /27 | 255.255.255.224 | 32 | 30 | A small office |
| /26 | 255.255.255.192 | 64 | 62 | A department |
| /25 | 255.255.255.128 | 128 | 126 | Half a classic subnet |
| /24 | 255.255.255.0 | 256 | 254 | The standard LAN or VLAN |
| /23 | 255.255.254.0 | 512 | 510 | A large flat LAN |
| /22 | 255.255.252.0 | 1,024 | 1,022 | A campus segment |
| /20 | 255.255.240.0 | 4,096 | 4,094 | A large subnet or VPC subnet |
| /16 | 255.255.0.0 | 65,536 | 65,534 | A whole VPC or site |
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | The full 10.0.0.0/8 private range |
* A /31 has no network or broadcast address by RFC 3021 — both addresses are usable, which is why it superseded /30 for point-to-point links and halves the waste.
Reserved ranges worth recognising
| Range | Purpose |
|---|---|
10.0.0.0/8 | Private (RFC 1918) — the largest private block |
172.16.0.0/12 | Private (RFC 1918) — note it is 172.16–172.31, not all of 172.x |
192.168.0.0/16 | Private (RFC 1918) — home and small office networks |
127.0.0.0/8 | Loopback — the whole /8, not just 127.0.0.1 |
169.254.0.0/16 | Link-local (APIPA) — what you get when DHCP fails |
169.254.169.254/32 | Cloud instance metadata endpoint. The target of most SSRF attacks |
100.64.0.0/10 | Carrier-grade NAT (RFC 6598) — used by ISPs and Tailscale |
224.0.0.0/4 | Multicast |
0.0.0.0/0 | The default route — "everything" |
Subnetting mistakes that cause outages
Overlapping subnets in a VPC or between sites
Cause:Two networks assigned ranges that intersect — commonly two offices both using 192.168.1.0/24, then connected by VPN.
Fix:Plan address space centrally before allocating. Pick an unusual private range (10.37.x.x rather than 192.168.0.x or 192.168.1.x) so future VPN peering does not collide.
A host cannot reach another host on what looks like the same subnet
Cause:Mismatched masks. One host configured /24 and another /25 disagree about whether an address is local, so one ARPs and the other routes.
Fix:Every host on a segment must share the same prefix length. Check the mask, not just the address.
Cannot create the subnet — "range is not valid"
Cause:The network address is not aligned to the prefix boundary. 192.168.1.64/26 is valid; 192.168.1.50/26 is not, because /26 blocks start at .0, .64, .128 and .192.
Fix:The network address must be divisible by the block size. This calculator shows the correct network address for any address you enter.
A /24 in a cloud VPC gives fewer usable addresses than expected
Cause:Cloud providers reserve addresses in every subnet — AWS takes five (network, VPC router, DNS, future use, broadcast), so a /24 yields 251 rather than 254.
Fix:Budget for the reservation when sizing. It matters most on small subnets: an AWS /28 has 11 usable addresses, not 14.
IPv6 subnetting is a different exercise
The arithmetic is the same but the scale changes what is sensible.
An IPv6 address is 128 bits. The convention is that a single LAN gets a /64 — which is 18.4 quintillion addresses for one network segment. That looks absurd until you know that stateless address autoconfiguration (SLAAC) requires exactly 64 host bits to work, so you should not subnet below /64 on any segment where hosts self-configure.
Sites are typically allocated a /48, which gives 65,536 separate /64 subnets. An ISP might hand a residential customer a /56, still 256 subnets.
There is no broadcast address in IPv6 and no network address reservation, so every address in a subnet is usable — the "minus two" rule does not apply. Multicast replaces broadcast entirely.
The practical consequence: IPv6 planning is about hierarchy and readability, not conservation. Nobody runs out of addresses inside a /48, so allocate on boundaries that make routing and firewall rules legible.
About
The CIDR / Subnet Calculator takes any IPv4 address in CIDR notation (e.g. 192.168.1.0/24) and instantly calculates: network address, broadcast address, first and last usable host addresses, subnet mask, wildcard mask (used in Cisco ACLs and OSPF), total host count, usable host count, IP class (A/B/C/D/E), private/public range detection, and binary representations of both the network address and the subnet mask. The subnet split feature divides any parent network into smaller subnets by specifying a longer prefix length. Common subnet presets are provided for quick access. All calculations are pure JavaScript — no external library or server call is needed.
How to use
- 1 Type any IPv4 address in CIDR notation into the input box (e.g. 10.0.0.0/8 or 192.168.1.64/26).
- 2 Click any preset button to populate a commonly used network.
- 3 Network address, broadcast, host range, subnet mask, wildcard, and binary representations update instantly.
- 4 To split the subnet into smaller blocks, type a new (larger) prefix length and click Split.
- 5 The split results table shows each sub-network with its range, broadcast, and usable host count.
- 6 Click the copy icon next to any field to copy that value to your clipboard.
- What is CIDR notation?
- CIDR (Classless Inter-Domain Routing) notation represents an IP network as an address followed by a slash and a prefix length — for example, 192.168.1.0/24. The prefix length (0–32) specifies how many leading bits identify the network portion. /24 means 24 bits are the network and 8 bits are for hosts, giving 254 usable addresses.
- How many usable hosts does a subnet have?
- For prefix /n, total addresses = 2^(32-n). Two are reserved (network and broadcast), so usable hosts = 2^(32-n) − 2. Exception: /31 has 2 usable hosts (RFC 3021, used for point-to-point links); /32 is a single-host route.
- What is a wildcard mask and where is it used?
- A wildcard mask is the bitwise inverse of a subnet mask — 0-bits mean "match exactly" and 1-bits mean "any value." Used in Cisco ACLs and OSPF network statements. For example, the wildcard for /24 is 0.0.0.255.
- How do I find the network and broadcast address for a CIDR range?
- Network address = IP AND subnet mask. Broadcast = network OR wildcard mask. Example: 192.168.1.100 AND 255.255.255.0 = 192.168.1.0; then 192.168.1.0 OR 0.0.0.255 = 192.168.1.255. This tool performs both automatically.
- Is this tool 100% client-side?
- Yes. Pure JavaScript with no external API calls, no CDN library, and no server communication. All arithmetic runs locally in your browser — suitable for air-gapped networks or offline use.
The full guide
More in Network & Security
See all network & security.