| # | Network | Host range | Broadcast | Hosts |
|---|
The split above cuts a block into equal pieces. Real networks are not equal: 40 desks, 12 phones, a pair of router interfaces. Type the host counts and this allocates largest first, on the boundary each subnet has to start on.
One prefix per line. This finds the smallest single prefix covering all of them — and, more importantly, tells you whether that prefix also covers addresses you did not list.
The dots are punctuation, not structure. An IPv4 address is a single 32-bit number; writing it as four decimals separated by dots was a convenience for humans in 1981 and it has been obscuring the only structure that matters ever since. The prefix length says how many of those 32 bits identify the network — they are the same for every machine on it — and the rest identify the host. That is the whole of subnetting. Everything else is consequence.
Which is why a subnet must start on a multiple of its own size. A network address is just
the address with every host bit set to zero, and the row above shows that happening. The numbers a
prefix is allowed to begin on are therefore not a convention anyone chose — they are the only
values the low bits can take when they are all zero. Type
192.168.1.100/26 into a router and you have not defined a network beginning at .100;
you have named a host inside 192.168.1.64/26, and the equipment will quietly agree
with the arithmetic rather than with you.
The block size is the number to carry in your head. Once the boundary falls inside an octet, that octet advances in steps of 256 divided by the number of subnets — 128, 64, 32, 16, 8, 4 — and every network, broadcast and usable range falls out of it without any binary at all. A /26 steps by 64, so the networks are .0, .64, .128 and .192; the broadcast of each is one below the next one's start. This is the "magic number" method, and it is how people who do this daily work out in their heads what a calculator is for.
And the mask has an evil twin. The subnet mask marks the network bits with ones; the
wildcard mask used in access lists and OSPF marks the host bits with ones instead
— it is the mask with every bit flipped, which is why /24 is
255.255.255.0 as a mask and 0.0.0.255 as a wildcard. They describe the
same boundary from opposite sides, and mixing them up is one of the great reliable ways to write a
firewall rule that matches everything you did not intend.
RFC 1918 set aside three blocks for private use — 10.0.0.0/8,
172.16.0.0/12 and 192.168.0.0/16 — and every network on earth draws
from the same three. They are not allocated to anyone, so nobody can tell you that yours clashes
until the day it matters. Then two organisations merge, or a home worker brings up a VPN, and both
ends are numbered 192.168.1.0/24 because that is what the router shipped with.
An address cannot mean two machines at once. When the ranges collide, a host looking for
192.168.1.50 finds the one on its own LAN — the more specific, directly connected
route always wins — and the tunnel carries nothing. Nothing is broken, no error is raised, and
the VPN reports itself up. It is the single most common reason a site-to-site link comes up and
passes no traffic.
There are only three ways out, and none of them is free. Renumber one side, which is correct
and expensive. NAT the overlap, presenting each site to the other on a range nobody is using,
which works and makes every future diagnosis harder because the address in the log is not the address
on the machine. Or plan ahead and pick from the parts of the private space nobody reaches for:
of the 65,536 possible 192.168.x.0/24 networks almost everyone uses .0 or .1, and
10.0.0.0/8 has sixteen million addresses that are mostly untouched.
One range that looks private and is not: 100.64.0.0/10, set aside by RFC 6598 for
carrier-grade NAT. Your internet provider may already be using it between their network and your
router, so borrowing it internally puts you in a collision with your own ISP — the one party
you cannot renumber.
One 192.168.1.0/24, and four things to put in it: about 50 staff devices, 20 phones, 12 cameras, and a point-to-point link to a remote site.
Largest first, or you will strand the space. Fifty hosts need /26 — 62 usable, since a /27's 30 will not do — taking .0 to .63. Twenty phones fit a /27 at .64, twelve cameras a /28 at .96, and the link a /30 at .112. Every one of those starts on a multiple of its own size, which is not a coincidence: it is the only way they can be laid end to end without a gap.
That uses 116 of 256 addresses and leaves .116 to .255 free in one unbroken run.
Allocate smallest-first and every block still lands, but not as tightly: the /30 takes .0, the /28 cannot start until .16, the /27 until .32 and the /26 until .64 — so the job finishes at .127 and 12 addresses are stranded in the gap nothing fits. Twelve is survivable in a /24. The same mistake in a /16 being carved for a campus strands thousands, and the fix is always the same one word: largest first.
The number after the slash is how many bits are locked as the network. Bigger prefix, smaller network: /24 leaves 8 host bits (256 addresses); each step up halves the block, each step down doubles it.
The first address names the network; the last is the broadcast that reaches every host. Neither can go to a device, which is why usable = total − 2.
The subnet mask is the prefix written as an address: 1-bits for network, 0-bits for host. The wildcard is its mirror image, used by ACLs and some routing tools (notably Cisco).
Two special cases: /31 gives exactly two addresses for a point-to-point link with no waste, and /32 is a single host, a route to one exact address.
Every block reserves its first address as the network identifier and its last as the broadcast, so a /24’s 256 addresses give 254 usable hosts. The exceptions are /31 (a two-address point-to-point link) and /32 (a single host).
Three blocks are reserved for private use: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Addresses inside them are not routable on the public internet; they are for your own networks. When two of your networks use the same range, they collide the moment you join them.
1s where the subnet mask has 0s. Access-control lists and some routing tools use it to describe the same range. A /24 mask of 255.255.255.0 becomes a wildcard of 0.0.0.255.
Not yet: IPv4 only. IPv6 uses the same CIDR idea over 128-bit addresses, so host counts become astronomically large and the “usable = total − 2” rule no longer applies.
Every block reserves its first address as the network identifier and its last as the broadcast address, so a /24's 256 addresses give 254 usable hosts. The exceptions are /31 (a two-address point-to-point link) and /32 (a single host).
It's the inverse of the subnet mask — 1s where the mask has 0s. Access-control lists and some routing tools (notably Cisco) use it instead of the subnet mask to describe the same range.
Three blocks are reserved for private use: 10.0.0.0/8, 172.16.0.0/12, and
192.168.0.0/16. Addresses inside them aren't routable on the public internet — they're for
your own networks.
Not yet — this is IPv4 only. IPv6 uses the same CIDR idea but with 128-bit addresses, so host counts become astronomically large and the "usable = total − 2" rule no longer applies.
IPv4 only, and strictly classless — the historical class A/B/C rules are ignored, because CIDR replaced them. Usable hosts are total minus two for the network and broadcast addresses, except at /31 (a two-address point-to-point link) and /32 (a single host). The VLSM panel deliberately uses a different mask per subnet, and allocates largest first because each subnet must begin on a multiple of its own size. Two-host subnets get a /30, not a /31: a /31 is a point-to-point link with no broadcast address. Summarising reports whether the covering prefix takes in addresses you did not list. It has no knowledge of your actual network: which addresses are already assigned, reserved for DHCP, or taken by a gateway is something only your own records can tell you.
It is /20: the first 20 bits are the network, which leaves 12 host bits, so each subnet holds 4,096 addresses and 4,094 usable hosts. It steps in blocks of 16 in the third octet (256 − 240), so networks start at .0, .16, .32 and so on: 10.1.16.0/20 runs from 10.1.16.0 to 10.1.31.255. Enter 20 as the prefix length to see it.
Subnet bits are the bits borrowed from the host part: the new prefix minus the original one. Each borrowed bit doubles the number of subnets, so borrowing 3 bits from a /24 gives 8 subnets of /27, each with 30 usable hosts. Host bits are 32 minus the prefix, and usable hosts are 2host bits − 2, except at /31 and /32.
It is the inverse of the subnet mask 255.255.0.0, which is /16: the 0s in a wildcard mark the bits that must match and the 255s the bits that may vary, so 0.0.255.255 matches every address in a /16 such as 10.1.0.0. Access-control lists and some routing tools use wildcards in place of subnet masks.
Releases in which this page changed, newest last. Derived from the archived copy of every release, not from notes written afterwards — so it reflects what actually shipped. Site-wide passes are left out; they are in the full changelog.