How to read the result
- Network is the first address of the block with the prefix length: the name of the subnet, used in routing tables and firewall rules.
- Netmask is the prefix written as an address (/24 = 255.255.255.0). Wildcard mask is its inverse, used by Cisco ACLs and OSPF.
- Broadcast is the last address; packets sent there reach every host on the subnet. IPv6 has no broadcast.
- First and last usable host bound the addresses you can assign. Gateways usually take the first or last one by convention.
- Usable hosts is total addresses minus the network and broadcast addresses (232-prefix - 2 for IPv4).
- The type line says whether the address is public, private (RFC 1918), carrier-grade NAT, loopback, link-local, documentation or another special range.
IPv4 CIDR cheat sheet
| Prefix | Netmask | Addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /22 | 255.255.252.0 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 512 | 510 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 (point-to-point) |
| /32 | 255.255.255.255 | 1 | 1 (single host) |
Common mistakes
- Using a host address as the network. 192.168.1.77/24 is a host in 192.168.1.0/24. Route and firewall entries need the network address; the calculator shows it.
- Forgetting the two reserved addresses. A /29 gives 6 hosts, not 8. Size subnets for hosts plus gateway plus growth.
- Overlapping subnets. 10.0.0.0/16 already contains 10.0.5.0/24. Splitting a block with the split option gives non-overlapping pieces.
- Picking 192.168.0.0/24 or 192.168.1.0/24 for a VPN. Home routers use them, so remote users collide. Pick something less common in 10.0.0.0/8 or 172.16.0.0/12.
- Subnetting IPv6 smaller than /64 for a LAN. SLAAC needs a /64; use /127 only for point-to-point links.
FAQ
Why are there two fewer usable hosts than addresses?
In an IPv4 subnet the first address is the network address and the last is the broadcast address, so a /24 has 256 addresses but 254 usable hosts. /31 (point-to-point links, RFC 3021) and /32 (a single host) are the exceptions.
What is a wildcard mask?
The inverse of the netmask: 0 bits must match, 1 bits can be anything. 255.255.255.0 becomes 0.0.0.255. Cisco ACLs and OSPF network statements use wildcard masks.
Which IP ranges are private?
IPv4 private ranges (RFC 1918) are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 100.64.0.0/10 is carrier-grade NAT space, and 169.254.0.0/16 is link-local. In IPv6 the private equivalent is fc00::/7 (unique local addresses).
Can I enter a netmask instead of a prefix?
Yes: 192.168.1.10 255.255.255.0 and 192.168.1.10/255.255.255.0 both work and are converted to /24. A bare address is treated as a single host (/32 or /128).
Why is my IPv6 subnet a /64?
IPv6 LANs use /64 because SLAAC address autoconfiguration needs a 64-bit interface ID. Sites usually get a /48 or /56 and carve /64s out of it; use the split option to list them.