Toolyard

How to Calculate a Subnet

CIDR and masks

An IPv4 address is 32 bits. The prefix after the slash says how many of them identify the network; the rest identify hosts. /24 is the mask 255.255.255.0: 24 network bits and 8 host bits, 256 addresses.

/24255.255.255.0256 addresses, 254 hosts
/25255.255.255.128128 addresses, 126 hosts
/26255.255.255.19264 addresses, 62 hosts
/27255.255.255.22432 addresses, 30 hosts
/28255.255.255.24016 addresses, 14 hosts
/30255.255.255.2524 addresses, 2 hosts

Worked example: 192.168.1.130/26

  1. /26 leaves 6 host bits, so each subnet has 26 = 64 addresses.
  2. Subnets start at multiples of 64 in the last number: 0, 64, 128, 192. 130 falls in the one starting at 128.
  3. Network address: 192.168.1.128. Broadcast address, the last in the block: 192.168.1.191.
  4. Usable hosts: 192.168.1.129 to 192.168.1.190, 62 addresses.

The first and last addresses are reserved, so a subnet has 2host bits − 2 usable hosts. /31 links between two routers and single /32 addresses are special cases.

Calculator

The Subnet Calculator works this out for any address and prefix or mask, with the wildcard mask and binary form. To convert the numbers between decimal, binary and hex, use the Number Base Converter.

Splitting a /24 into four

Borrowing 2 host bits turns 192.168.1.0/24 into four /26 subnets of 64 addresses each:

SubnetUsable hostsBroadcast
192.168.1.0/26.1 to .62.63
192.168.1.64/26.65 to .126.127
192.168.1.128/26.129 to .190.191
192.168.1.192/26.193 to .254.255

To size a subnet for a number of hosts, take the smallest block where 2host bits − 2 is enough: 50 hosts need /26 (62), and 100 hosts need /25 (126).

When the prefix is not a multiple of 8

Take 10.1.37.5/20. A /20 mask is 255.255.240.0, so the boundary falls in the third number, in blocks of 256 − 240 = 16: 0, 16, 32, 48. 37 lies in the block starting at 32, so the network is 10.1.32.0 and the broadcast is 10.1.47.255, with 4,096 addresses.

Common mistakes

  • Overlapping subnets. 10.0.0.0/24 and 10.0.0.128/25 overlap, because the second sits inside the first. Each subnet must start on a multiple of its own size.
  • The wildcard mask. Router access lists often want the inverse of the mask: 255 minus each number, so /26 is 0.0.0.63.
  • Private ranges. Only 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are for private networks. 172.32.x.x is a public address.

Tools in this guide

More guides