Subnet calculator

From a prefix length to a block of addresses

In CIDR notation the number after the slash says how many leading bits identify the network; the rest number the hosts. A /24 leaves 8 host bits, so the block holds 2^8 = 256 addresses. Every bit you take for the network halves the block, and every bit you give back doubles it. That gives you the sizes to memorise: /30 is 4 addresses, /29 is 8, /28 is 16, /27 is 32, /26 is 64, /25 is 128, /24 is 256, /23 is 512, /22 is 1,024 and /20 is 4,096.

Two addresses in a normal subnet are not for hosts: the first is the network address and the last is the broadcast address. A /26 therefore has 64 addresses and 62 usable ones, with the mask 255.255.255.192 and the wildcard mask 0.0.0.63. The two exceptions are /31, which is two usable addresses on a point-to-point link under RFC 3021, and /32, which names one host.

A worked example with a host address

Type 10.20.30.77/26. The block size is 64, so the blocks in the last octet start at 0, 64, 128 and 192. The address 77 sits in the block starting at 64. The calculator reports the network 10.20.30.64, the broadcast 10.20.30.127 and the usable range 10.20.30.65 to 10.20.30.126. You can paste any host address, not just the network address, and the tool masks it down to the right block. That is the quickest way to answer whether two machines share a subnet: compare their network addresses, not their last octets.

Splitting a network the sensible way

To divide 192.168.10.0/24 into four equal segments, move to /26 and step by 64: 192.168.10.0, .64, .128 and .192. For unequal needs, allocate the biggest block first and align each block to its own size, because a /26 may only start at a multiple of 64. A /27 for 20 hosts (30 usable) and two /28s for servers and management (14 usable each) fit with room to spare:

• 192.168.10.0/27 for users, 30 usable
• 192.168.10.32/28 for servers, 14 usable
• 192.168.10.48/28 for management, 14 usable
• 192.168.10.64 and above remain free for growth

Ranges you meet constantly

The private blocks are 10.0.0.0/8, 172.16.0.0/12 (that is 172.16.0.0 to 172.31.255.255, a frequent source of mistakes because people read it as 172.0.0.0/8) and 192.168.0.0/16. Carrier-grade NAT uses 100.64.0.0/10, and 169.254.0.0/16 is link-local, the range a machine invents for itself when DHCP fails. Cloud networks subtract more from the top and bottom of each subnet: AWS and Azure reserve five addresses per subnet, so a /28 with 16 addresses gives you 11 in practice.

A wildcard mask is the mask turned inside out, and it appears in router access lists and OSPF network statements. A rule written as 10.20.30.0 0.0.0.63 matches the same block as 10.20.30.0/26.

Firewall rules and monitoring

A subnet calculator becomes practical when you write an allow-list. Tenium's checkers connect from a small set of fixed addresses, listed on the checker IP page and as JSON; adding each as a /32 is clearer than guessing at wider blocks, and a wide block opens the rule to neighbours you never intended. If a rule that looks correct does not work, calculate the block it actually covers. A monitor that suddenly times out after a security group change is the standard symptom, and port monitoring separates a blocked connection ("timeout") from a closed port ("refused").

The tool handles IPv4 only. The "IP class" row is a historical label; CIDR replaced classful addressing in the 1990s and class tells you nothing about the real prefix. IPv6 uses the same prefix idea with 128 bits, and a /64 is the standard size of a single LAN.