IP Subnet Calculator

An IP address is a number. A prefix says how many of its bits name the network, and everything left over names a host on it.

192.168.1.100/24

11000000.10101000.00000001.01100100
+-------- network, 24 bits -------++ host +

Change any bit on the right and you are still on the same
network. Change any bit on the left and you are not.

That is the whole idea, and every other quantity falls out of it. The netmask is the same split written as an address, with ones over the network part. The wildcard mask is that inverted. The number of addresses is two to the power of the host bits. The broadcast address is the network address with every host bit set.

Where the missing two hosts went

A /24 holds 256 addresses and 254 hosts.

  192.168.1.0     the network itself, naming the network and not a host
  192.168.1.1     first usable
  ...
  192.168.1.254   last usable
  192.168.1.255   broadcast, meaning everybody on the link

The all-zeros host part names the network itself and the all-ones host part is the broadcast, so a /24 has 256 addresses and 254 usable ones. That subtraction gets smaller and more painful as the subnet does: a /29 has eight addresses and six hosts, a quarter of it gone to bookkeeping.

Two exceptions are worth knowing. A /31 has no network or broadcast address at all: RFC 3021 gives both of its addresses to the two ends of a point-to-point link. That is the whole reason it exists, and it replaced the /30 that used to waste half of itself on the same job. And a/32 is one address. It is how a single host gets written in a routing table or a firewall rule.

The private ranges, and the one everybody gets wrong

10.0.0.0/8         10.0.0.0     to 10.255.255.255      16,777,216 addresses
172.16.0.0/12      172.16.0.0   to 172.31.255.255      1,048,576
192.168.0.0/16     192.168.0.0  to 192.168.255.255     65,536

The middle one ends at 172.31, not 172.16. It is a /12,
which is sixteen /16s, and reading it as "172.16.x.x"
is the single most common mistake in this space.

Those three are RFC 1918 and they are not routed on the public internet. Three more are worth recognising on sight:

For examples and documentation there are three ranges set aside precisely so that nobody's real network gets used by accident: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24. Use them instead of 1.2.3.4, which belongs to somebody.

Prefix to size, from memory

/32   1 address        a single host
/31   2                 a point-to-point link, RFC 3021
/30   4, 2 usable       the old way to do a point-to-point link
/29   8, 6
/28   16, 14
/24   256, 254          the default that everybody means by "a subnet"
/16   65,536
/8    16,777,216

Every step down doubles it. The rule that saves the arithmetic: a /24 is 256, and each bit you take back multiplies by two. Going the other way, each bit you give away halves it.

The other direction is the one worth practising: to fit 500 hosts you need 512 addresses, which is nine host bits, which is a /23.

Classes have not existed since 1993

"That is a class C address" usually means "that is a /24", and the two have not been the same thing for thirty years. The old scheme fixed the split at 8, 16 or 24 bits according to the leading bits of the address, which meant the only sizes on offer were 16 million, 65 thousand and 256. An organisation needing 300 addresses got handed 65,536.

CIDR replaced it in 1993 and made the prefix an explicit part of the address. The class is shown above because the vocabulary survives in conversation and in a certain amount of old documentation, not because anything acts on it.

Wildcard masks read backwards

A netmask has ones over the bits that matter. A wildcard mask, the thing Cisco access lists and OSPF take, has ones over the bits that donot. So a /24 is 255.255.255.0 as a netmask and0.0.0.255 as a wildcard.

They are exact inverses, so one is always the other subtracted from 255.255.255.255. The reason wildcards can do things netmasks cannot is that nothing requires them to be contiguous: 0.0.0.255 with a step of 0.0.1.0 can match every odd subnet, which a netmask has no way to express.

IPv6 is the same arithmetic and different habits

• No broadcast. It does not exist. Multicast does the same jobs, and the all-zeros host address is the subnet-router anycast address that every router on the link answers to.
• /64 is the subnet. Not because of address scarcity but because stateless autoconfiguration builds the bottom 64 bits from the interface, so a subnet longer than /64 breaks it. A single /64 holds 18,446,744,073,709,551,616 addresses, which is more than four billion times the whole IPv4 space.
• Every interface has a link-local address in fe80::/10 whether you configured one or not, and a great deal of IPv6 works over that instead of over the address you assigned.
• fc00::/7 is the private range, and in practice fd00::/8, where you are supposed to generate a random 40-bit global ID instead of using fd00::/8 directly. Almost nobody does, so a great many home networks have colliding unique local prefixes.

Writing IPv6 down the way everything else does

RFC 5952 says exactly one spelling is canonical: lowercase, no leading zeros in a group, and :: replacing the longest run of zero groups, leftmost when two runs tie, and never for a single group. That is the form produced above.

It matters because addresses get compared as strings far more often than anybody would like: in logs, in allowlists, in database columns. Two spellings of the same address are the same address and are not the same string.