Subnet Calculator

Understanding CIDR Notation

CIDR — Classless Inter-Domain Routing — is the universal language of IP networking. Before CIDR, IP addresses were split into rigid classes: Class A networks used the first 8 bits for the network portion and gave each organization up to 16.7 million addresses, Class B used 16 bits (65,536 addresses), and Class C used 24 bits (256 addresses). The class system wasted enormous chunks of address space and made routing tables bloated.

CIDR, introduced by RFC 1519 in 1993, allows any prefix length from /0 (the entire internet) to /32 (a single host). The notation 192.168.1.0/24 tells you two things: the IP address is 192.168.1.0, and the first 24 bits are the network identifier. The remaining 8 bits (32 − 24 = 8) are free for host addresses — 2⁸ = 256 total addresses, 254 usable after reserving the network and broadcast addresses.

You will encounter CIDR notation in nearly every networking context: configuring a router or switch interface, writing security group or firewall rules in AWS, Azure, or GCP, defining VPN split-tunneling policies, setting up Docker or Kubernetes pod networking, or assigning IP ranges in a DHCP server. Fluency with CIDR is one of the most practical skills a developer or systems administrator can have.

How to Read the Results

The calculator returns eleven fields for any CIDR input. Here is what each one means and when you need it:

• Network Address — The first address in the subnet, used to identify the network itself. This address is never assigned to a device. When you type a route into a router (e.g., ip route 10.1.0.0/16 ...), you use the network address.
• Broadcast Address — The last address in the subnet. A packet sent to this address is delivered to every host on the subnet. Like the network address, it cannot be assigned to a device (except in /31 subnets per RFC 3021).
• Subnet Mask — The dotted-decimal representation of the prefix. Use this in legacy systems that do not accept CIDR notation: older operating systems, some printers, and DHCP server configuration files.
• Wildcard Mask — The bitwise NOT of the subnet mask. Used in Cisco ACLs and OSPF area declarations. A 0 bit means "must match exactly"; a 1 bit means "can be anything."
• First / Last Usable Host — The range of addresses you can assign to devices. For a /24, that is x.x.x.1 through x.x.x.254.
• Total Addresses / Usable Hosts — Total includes the network and broadcast address; usable is what is assignable to devices. For /30 and shorter (larger networks), these differ by 2. For /31, they are equal (both 2). For /32, both are 1.

Common Subnet Sizes at a Glance

These are the prefix lengths you will encounter most often in cloud infrastructure, home networks, and enterprise environments:

Real Use Case: Designing AWS VPC Subnets

Cloud networking is where subnet math matters most day-to-day. AWS, GCP, and Azure all require you to define CIDR blocks when creating Virtual Private Clouds (VPCs) and subnets. Here is a worked example of planning a production VPC:

Suppose you create a VPC with CIDR 10.0.0.0/16. That gives you 65,536 addresses (65,534 usable). You want to carve it into subnets across three Availability Zones (AZs), with public subnets for load balancers and private subnets for application servers. A common layout:

• 10.0.1.0/24 — Public subnet AZ-1 (254 hosts, for NAT gateways and ALBs)
• 10.0.2.0/24 — Public subnet AZ-2
• 10.0.3.0/24 — Public subnet AZ-3
• 10.0.10.0/22 — Private subnet AZ-1 (1,022 hosts, for EC2/ECS tasks)
• 10.0.14.0/22 — Private subnet AZ-2
• 10.0.18.0/22 — Private subnet AZ-3
• 10.0.100.0/24 — Database subnet AZ-1 (RDS, ElastiCache)

Notice that the /22 private subnets are aligned on /22 boundaries: 10.0.10.0/22 ends at 10.0.13.255, and 10.0.14.0/22 starts immediately after. Misaligning subnets — for example, trying to use 10.0.11.0/22 — wastes addresses and confuses routing. AWS actually reserves five addresses per subnet (network, broadcast, plus three for its own use), so a /28 gives you only 11 usable addresses instead of the expected 14.

Security groups in AWS use CIDR notation to define allowed source or destination ranges. A common mistake is putting 0.0.0.0/0 (all traffic) in an inbound rule during development and forgetting to tighten it. The Subnet Calculator helps you construct precise CIDR ranges — for example, to allow only your office IP range.

Real Use Case: Home and Office Networks

On a home or small office network, subnet math shows up when configuring routers, setting static IPs, or troubleshooting connectivity. Most home routers default to 192.168.1.0/24 or 192.168.0.0/24, giving 254 usable addresses — more than enough for any household.

A practical scenario: you have two floors in an office, and you want to segment IoT devices (smart lights, cameras) away from employee laptops. You could split a /23 (510 hosts) into two /24s: 10.1.0.0/24 for staff and 10.1.1.0/24 for IoT. Traffic between the two VLANs can then be filtered by a managed switch or firewall, improving both security and network performance.

When assigning static IPs to servers, printers, or other fixed devices, you need to know the subnet boundaries. If your network is 10.1.0.0/24, valid static IPs run from 10.1.0.1 to 10.1.0.254 — a mistake like assigning 10.1.1.5 would put the device on a different subnet, and it would be unreachable from the rest of the 10.1.0.0/24 network.

RFC 1918 Private IP Address Ranges

RFC 1918 defines three blocks of IPv4 addresses reserved for private use that are never routed on the public internet:

• 10.0.0.0/8 — 16,777,216 addresses (10.0.0.0 to 10.255.255.255). Used by large enterprises and cloud VPCs. AWS, GCP, and Azure all default to ranges from this block.
• 172.16.0.0/12 — 1,048,576 addresses (172.16.0.0 to 172.31.255.255). Docker uses 172.17.0.0/16 by default for its bridge network. Less commonly used than the other two ranges.
• 192.168.0.0/16 — 65,536 addresses (192.168.0.0 to 192.168.255.255). The default for home routers worldwide. Most home networks use 192.168.0.0/24 or 192.168.1.0/24.

In addition to RFC 1918, there are two other special ranges to know: 127.0.0.0/8 is the loopback range (127.0.0.1 is "localhost"), and 169.254.0.0/16 is the link-local range (assigned automatically when DHCP fails — you will see these on Windows as the dreaded "169.254.x.x" address that indicates the device could not reach a DHCP server).

Special Subnets: /31, /32, and /0

Three subnet sizes have special meanings that differ from the standard formula:

/31 — Point-to-Point Links. RFC 3021 (2000) allows /31 subnets for point-to-point links between two routers. A /31 has exactly 2 addresses and no broadcast address — both addresses are usable. This saves address space on the countless router-to-router links in carrier networks. On a /31, one IP goes to each router interface; the concept of "network address" and "broadcast" does not apply in the traditional sense. Modern router operating systems (IOS, JunOS, EOS) all support /31 interfaces.

/32 — Host Routes. A /32 identifies exactly one IP address — the mask is 255.255.255.255. You will see /32 used for loopback interfaces on routers (every router runs a loopback address for management and OSPF router-ID purposes), for advertising a single IP in BGP, and in firewall rules that apply to one specific host. In AWS, an Elastic IP attached to an ENI appears as a /32 route.

/0 — Default Route. The /0 prefix covers the entire IPv4 address space. In routing, 0.0.0.0/0 is the default route — "send traffic anywhere not matched by a more specific route here." It is the catch-all used in internet gateway routing tables and VPN split-tunneling rules. In firewall rules, 0.0.0.0/0 in an inbound rule means "allow from all IPs" — a configuration that should never appear in production security groups without additional controls.

Common Mistakes and Edge Cases

Host bits set in the network address. A common mistake is writing 192.168.1.5/24 when you mean the network 192.168.1.0/24. The calculator accepts either form — it masks off the host bits to derive the network address — but routers and cloud consoles often reject addresses where the host portion is non-zero. Always use the network address (all host bits zero) when defining routes or subnets.

Forgetting reserved addresses in cloud subnets. AWS reserves 5 IP addresses per subnet (not the usual 2). For example, in a /28 (16 total addresses), AWS keeps addresses 0, 1, 2, 3 and 15, leaving only 11 usable. For Lambda functions in a VPC, large /24 subnets are recommended since Lambda pre-warms many ENIs. If you size a subnet too small, ECS tasks or Lambda invocations will fail with network interface allocation errors.

Overlapping subnets. Two subnets overlap if one contains addresses from the other. For example, 10.0.0.0/16 and 10.0.1.0/24 overlap (the /24 is entirely inside the /16). Overlapping subnets cause routing ambiguity and are usually rejected by cloud consoles. When designing a VPC, plan your address space on paper (or in a spreadsheet) before creating subnets, ensuring each CIDR block uses a distinct, non-overlapping range within the parent VPC CIDR.

Confusing subnet mask and wildcard mask. Entering a wildcard mask where a subnet mask is expected (or vice versa) produces incorrect results. If you enter 0.0.0.255 expecting the calculator to treat it as a mask, it will be interpreted as an IP address, not a mask. The calculator works only with CIDR prefix notation (e.g., /24) — if you have a dotted-decimal mask like 255.255.255.0, convert it by counting the 1 bits: 255 = 8 bits, so 255.255.255.0 = /24.

Frequently Asked Questions