CIDR / Subnet Calculator
CIDR notation writes a network as an address followed by a prefix length, and the prefix length is simply how many leading bits are fixed. Everything else about a subnet follows from that one number.
How to use it
- Enter an IPv4 address and a prefix length.
- Network address, broadcast address, mask, and usable host range are computed in the page.
- Nothing is transmitted, which matters because internal ranges describe your infrastructure.
What the prefix length means
An IPv4 address is 32 bits. The prefix length says how many of those are the network portion; the rest identify a host within it. A /24 fixes the first 24 bits, leaving 8 for hosts, which gives 256 addresses.
Each bit added to the prefix halves the network. A /25 is 128 addresses, a /26 is 64, a /27 is 32. Going the other way, a /23 is 512. The count is always 2 raised to the power of 32 minus the prefix.
The subnet mask is the same information written differently: a /24 is 255.255.255.0, because 24 one-bits followed by 8 zero-bits is 11111111.11111111.11111111.00000000. Mask notation predates CIDR and persists in interface configuration.
Why usable hosts is two fewer than the total
Two addresses in every subnet are reserved. The first, with all host bits zero, is the network address, which names the subnet itself and appears in routing tables. The last, with all host bits one, is the broadcast address, which reaches every host on the segment.
So a /24 holds 256 addresses and 254 usable ones. A /30, commonly used for point-to-point links, holds 4 addresses and exactly 2 usable, which is why it was the traditional choice for connecting two routers.
RFC 3021 removed that overhead for point-to-point links by defining /31, where both addresses are usable because a link with exactly two endpoints has no need for broadcast. Modern router platforms support it, and it halves address consumption on backbone links.
A /32 is a single address with no network or broadcast at all. It is used for host routes, loopback interfaces, and firewall rules naming one machine.
Private ranges and the CGNAT block
RFC 1918 reserves three ranges that are never routed on the public internet.
The three, and how they are typically used:
- 10.0.0.0/8, which is 16.7 million addresses. The usual choice for large corporate networks and cloud VPCs, because there is room to subnet it hierarchically by region and environment.
- 172.16.0.0/12, which spans 172.16 through 172.31 and gives about a million addresses. Frequently misread: 172.32.0.0 is public, and the range is not the whole of 172.
- 192.168.0.0/16, which is 65,536 addresses. Home routers and small offices, almost always carved into /24s.
Practical subnetting advice
Leave room. Networks are painful to renumber once they carry production traffic, and the usual failure is allocating exactly what is needed today. A /24 per subnet is generous for most purposes and costs nothing when drawn from a /8.
Align on natural boundaries where you can. Subnets at /24, /16, and /8 are readable at a glance because they fall on octet boundaries. A /27 requires arithmetic every time someone reads it, and arithmetic done under pressure at three in the morning is where firewall rules go wrong.
Avoid overlapping allocations across sites you might later connect. Two offices that both chose 192.168.1.0/24 cannot be joined by a VPN without renumbering one of them, and this is an extremely common and entirely avoidable problem.
At a glance
| Input | IPv4 address and prefix length |
|---|---|
| Outputs | Network, broadcast, mask, usable range |
| Total addresses | 2 to the power of 32 minus prefix |
| Transmitted | Nothing |
Frequently asked questions
Why are there two fewer usable hosts than addresses?
The first address names the network and the last is the broadcast address. Neither can be assigned to a host, so a /24 gives 254 usable addresses out of 256.
Can I use a /31?
On point-to-point links, yes. RFC 3021 makes both addresses usable because a two-endpoint link needs no broadcast. Modern routers support it; it is not appropriate for a broadcast segment.
Which private range should I choose?
10.0.0.0/8 for anything that might grow or need hierarchical subnetting. 192.168.0.0/16 for small networks. Whatever you pick, avoid ranges your future VPN peers are likely to have chosen.
Is 172.20.0.0 private?
Yes. The RFC 1918 block is 172.16.0.0/12, covering 172.16 through 172.31. 172.20 falls inside it, while 172.32 does not and is public.
Read more
Timestamps, permissions, subnets, and cron — Four operational primitives with unintuitive semantics, and the specific failures each one causes.