Subnet Calculator
Network, broadcast, host range and mask for any IPv4 address and prefix.
Also accepts 192.168.1.130 255.255.255.192, or a bare address for a /32.
Network
192.168.1.128/26
62 usable addresses out of 64 in the block.
● Private — 192.168.0.0/16 (RFC 1918) — the home-router range.
Subnet mask
255.255.255.192
Wildcard mask
0.0.0.63
What Cisco ACLs and some firewalls want — the mask inverted.
Prefix
/26
Network address
192.168.1.128
Identifies the block. Not assignable to a host.
Broadcast address
192.168.1.191
Reaches every host on the segment. Not assignable.
Usable host range
192.168.1.129 – 192.168.1.190
Total addresses
64
Usable hosts
62
Legacy class
C
Classful addressing was replaced by CIDR in 1993. Shown because exam questions and old documentation still use it; it has no effect on how anything routes.
In binary
Cyan is the network portion fixed by the prefix; grey is the host portion you can vary. The prefix is literally how many bits are cyan.
- Address
11000000.10101000.00000001.10000010
- Network
11000000.10101000.00000001.10000000
- Mask
11111111.11111111.11111111.11000000
- Broadcast
11000000.10101000.00000001.10111111
Network in hex: 0xC0A80180 · as an integer: 3,232,235,904
Split this block
Divide /26 into equal subnets. Each step to a longer prefix halves the size and doubles the count.
Prefix, mask and host-count reference
| Prefix | Mask | Addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 512 | 510 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 |
| /32 | 255.255.255.255 | 1 | 1 |
What the prefix actually does
An IPv4 address is thirty-two bits. The prefix says how many of those bits, counting from the left, identify the network; everything after belongs to the host. That is the entire idea, and the binary view above is worth a look because it makes the arithmetic self-evident: the cyan digits cannot change within the block, the grey ones enumerate it.
So a /24 fixes twenty-four bits and leaves eight to vary, which is 28 = 256 addresses. A /26 fixes two more bits, leaving six: 64 addresses. Every bit you add to the prefix halves the block.
The network address is what you get with all host bits set to zero; the broadcast address is all host bits set to one. Neither is assignable, which is where the “minus two” comes from.
The boundary that catches people out
A block always begins at a multiple of its own size. 192.168.1.64/26 is valid; 192.168.1.100/26 is not a network address, because 100 is not a multiple of 64 — the calculator will show you it actually lives in the block starting at 64.
This is also why the third octet moves for anything shorter than /24. In a /22 the block is 1,024 addresses, so the boundaries fall at 10.0.0.0, 10.0.4.0, 10.0.8.0 and so on — every fourth /24. 10.0.6.0/22 is not a valid network address for the same reason.
Sizing a network
Count your hosts, add room to grow, round up to the next power of two, then subtract two.
| You need | Use | Gives you | Common for |
|---|---|---|---|
| 2 hosts | /31 | 2 usable | Router-to-router links |
| up to 6 | /29 | 6 usable | A small block of public addresses |
| up to 30 | /27 | 30 usable | A rack, or a small office VLAN |
| up to 62 | /26 | 62 usable | A department |
| up to 254 | /24 | 254 usable | The default almost everywhere |
| up to 1,022 | /22 | 1,022 usable | A floor or a campus segment |
The instinct to size exactly is worth resisting. Renumbering a live network because it filled up costs real downtime, and RFC 1918 space is free — there is no prize for using 10.0.0.0/8 efficiently. The opposite mistake is more common than it should be: putting an entire site in one flat /16 means broadcast traffic reaches thousands of hosts and anything that compromises one machine can reach all of them.
Private, public, and why your server is unreachable
The calculator flags which category your address falls into, because it answers a question people usually arrive with without realising. Three ranges are reserved by RFC 1918 for private use and are never routed on the internet:
10.0.0.0/8— 16.7 million addresses172.16.0.0/12— note the range is 172.16 through 172.31, not all of 172192.168.0.0/16— the home-router range
If a service on 10.0.0.5 cannot be reached from outside, that is not a firewall problem to debug. The address is not routable, and no configuration on your machine changes it.
Two more worth recognising. 169.254.0.0/16 is link-local — a machine assigns itself one of these when DHCP fails, so seeing it usually means “no DHCP server answered”. And 100.64.0.0/10 is carrier-grade NAT: if your router reports one of those as its WAN address, your ISP has put you behind their own NAT, which is why port forwarding does not work no matter how you configure it.
Related
To go the other way — a range of addresses into the blocks that cover it — the CIDR calculator does that exactly, without rounding up. For a straight prefix-to-mask lookup there is a narrower tool with the full table. And if you want to know who owns a public address rather than how it subdivides, the IP lookup covers that.
Subnetting questions
Why are there two fewer usable hosts than addresses?
The first address in a block identifies the network itself and the last is the broadcast address, which reaches every host on the segment. Neither can be assigned to a machine, so a /24 with 256 addresses gives you 254 usable ones. The exceptions are /31 and /32, which have no network or broadcast address at all.
Can I actually use a /31?
Yes, on point-to-point links, and it is standard practice there. RFC 3021 defined it in 2000 precisely because the old rule wasted half of every point-to-point allocation: a /30 gives four addresses of which two are usable, so linking two routers consumed four addresses to use two. A /31 has no network or broadcast address, both addresses are hosts, and every current router platform supports it. Calculators that report "0 usable hosts" for a /31 are describing a rule that was retired twenty-six years ago.
What is a wildcard mask and when do I need one?
It is the subnet mask with every bit inverted, so /24 becomes 0.0.0.255 rather than 255.255.255.0. Cisco access control lists and some routing protocol statements expect it in that form. The reason it exists is that a wildcard mask does not have to be contiguous — you can match "any address whose last octet is even" — although in practice almost every wildcard mask you will write is just an inverted subnet mask.
How do I pick a prefix length for a new network?
Work from the host count, then add headroom, then round to the next power of two. Forty devices needs 42 usable addresses after the network and broadcast, which means a /26 with 62. Do not size it exactly: renumbering a network because you ran out is far more painful than allocating a slightly larger block, and private address space is not scarce. The common mistake in the other direction is putting everything in a single /16, which makes broadcast traffic and lateral movement both worse than they need to be.
What happened to Class A, B and C?
CIDR replaced them in 1993. Under classful addressing the first few bits of an address determined the mask, which meant an organisation needing 500 addresses had to take a Class B with 65,534 of them and waste the rest. CIDR made the prefix explicit and independent, which is why every address is written with a slash today. The classes survive in exam questions and in the phrase "a class C network" meaning a /24 — the calculator shows the class for that reason, but it has no effect on how anything routes.
Does the calculator send my addresses anywhere?
No. All of it is integer arithmetic running in your browser — there is nothing to send, and the page works with no network connection at all. That matters more than it sounds for a tool like this, because the addresses people paste into subnet calculators are frequently their own internal network topology.
Last reviewed . Found something out of date? Tell us.