IP Subnet Calculator

IP Subnetting Explained: Networks, Masks, CIDR and How to Split Address Blocks

Every device on an IP network needs an address, and every network needs a plan for how those addresses are divided. Subnetting is that plan. It takes one large block of IPv4 addresses and carves it into smaller, manageable networks — subnets — each with its own network address, broadcast address and range of assignable host addresses. Subnetly exists to make that carving instant: you supply an IP address and either a CIDR prefix or a dotted subnet mask, and the calculator resolves every boundary of the block for you, with no binary arithmetic and no spreadsheet formulas.

The anatomy of an IPv4 address

An IPv4 address is a 32-bit number, conventionally written as four decimal octets separated by dots, such as 192.168.1.10. Each octet holds eight bits, so each ranges from 0 to 255. Conceptually the address has two parts: a network portion that identifies which network the device belongs to, and a host portion that identifies the individual device inside that network. The dividing line between the two portions is not fixed — it is defined by the subnet mask or, equivalently, by the CIDR prefix length. Moving that dividing line is the entire mechanics of subnetting: shift it right and you get more, smaller networks; shift it left and you get fewer, larger ones.

Historically, addresses were grouped into classes. Class A networks start with a first octet from 0 to 127 and were designed for a handful of enormous organisations. Class B covers 128 to 191, and Class C covers 192 to 223, with a default mask of 255.255.255.0 that yields 254 usable hosts. Class D is reserved for multicast and Class E for experimental use. Classful networking has long since been replaced by classless routing, but the classes still appear in exams and in the way people casually describe address ranges, which is why Subnetly reports the class of the address you enter alongside its modern CIDR interpretation.

Subnet masks and CIDR notation

A subnet mask is a 32-bit value whose binary form is a run of 1s followed by a run of 0s. The 1s cover the network portion; the 0s cover the host portion. The mask 255.255.255.0, for example, is twenty-four 1s followed by eight 0s. CIDR notation simply counts the 1s: that mask is written as /24. The two forms are fully interchangeable, and Subnetly converts between them in both directions — type a dotted mask and it shows you the prefix, drag the prefix slider and it shows you the mask. Not every dotted quad is a valid mask, however. Because the 1s must be contiguous, a value like 255.255.0.255 is invalid, and Subnetly will tell you so instead of silently producing nonsense.

From the mask, every other boundary of the subnet follows mechanically. The network address is the result of AND-ing the IP address with the mask: host bits are cleared to zero, giving the lowest address in the block. The broadcast address is the exact opposite: keep the network bits, set every host bit to 1, giving the highest address in the block. The usable host range sits between them — normally from network-plus-one to broadcast-minus-one — because the two extreme addresses are reserved for identifying the network itself and for broadcasting to every host on it. The total number of addresses in a block is two raised to the power of the number of host bits, so a /24 has 256 addresses, a /16 has 65,536, and a tiny /30 has just four.

The wildcard mask and where it appears

The wildcard mask is the bitwise inverse of the subnet mask: where the subnet mask has 1s, the wildcard has 0s, and vice versa. A /24 therefore has a wildcard mask of 0.0.0.255, and a /26 has 0.0.0.63. Wildcard masks feel backwards the first time you meet them, but they answer a natural question in access control lists and routing protocols: which bits of an address must match exactly, and which bits are allowed to vary? In Cisco IOS access lists and in OSPF network statements, a wildcard bit of 0 means "this bit must match" and a wildcard bit of 1 means "do not care". Subnetly displays the wildcard mask next to every calculation so you can paste it straight into a router configuration without inverting the mask by hand.

Special cases: /31 and /32

The familiar rule "subtract two for the network and broadcast addresses" breaks down at the very small end of the scale. A /32 has a single address: it is a host route, identifying exactly one device, and it appears in routing tables, loopback addressing and firewall rules. A /31 has two addresses and, under the original rules, zero usable hosts once network and broadcast are reserved — a wasteful outcome for a point-to-point link that needs exactly two addresses, one for each end. RFC 3021 therefore permits /31 blocks on point-to-point links where both addresses are usable, and modern equipment supports this widely. Subnetly handles both cases explicitly: for a /31 it reports two usable addresses, and for a /32 it reports one, rather than showing a confusing negative or zero host count.

Private and public address space

Not every address can appear on the public internet. RFC 1918 reserves three ranges for private use inside homes, offices and cloud virtual networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Devices on private addresses reach the internet through network address translation at a router or gateway, which rewrites their private source address to a public one. Other ranges are special too: 127.0.0.0/8 is loopback, 169.254.0.0/16 is link-local addressing assigned when DHCP fails, and 100.64.0.0/10 is shared address space used by carriers for carrier-grade NAT. Subnetly flags whether the address you enter is private, because the answer changes how you should plan: private blocks can be subnetted however you like without asking anyone, while public blocks are allocated by registries and are precious.

Splitting a network into N subnets

The most common subnetting task is division: you hold one block and need several equal networks — one per office floor, per department, per VLAN or per customer. The method is called borrowing bits. To create N subnets you borrow enough host bits so that two raised to the borrowed count is at least N; the borrowed bits join the network portion, so the prefix length grows. Splitting a /24 into four subnets borrows two bits, produces four /26 blocks of 64 addresses each, and Subnetly lists all of them with their network addresses, host ranges and broadcast addresses. If you ask for five subnets, the maths rounds up to eight — subnets always come in powers of two when they are equal-sized — and the calculator makes that rounding visible rather than hiding it.

Equal splits are simple, but real networks are rarely equal. A head office might need 500 addresses while a branch needs 20. The technique for that is variable length subnet masking, or VLSM: allocate the largest block first, then carve the next block from the remaining space, always keeping new blocks aligned on their natural boundaries. Alignment is the subtle part — a /26 must start at an address whose last octet is a multiple of 64 — and it is exactly the kind of detail a calculator is good at enforcing. Even if you plan with VLSM on paper, running each resulting block through a calculator like Subnetly is a cheap sanity check before you commit the plan to routers and DHCP servers.

Why subnet at all?

Subnetting is not just an addressing ritual; it buys real operational benefits. Smaller broadcast domains mean less chatter: broadcast and multicast traffic stays inside one subnet instead of washing over every device in a building. Subnets create natural security boundaries — you can place firewall rules between the guest Wi-Fi subnet and the servers subnet, and a compromised device can only wander within its own segment. They make routing tables smaller through aggregation, they let DHCP scopes map cleanly onto physical locations, and they make troubleshooting easier because an IP address itself tells you where a device is supposed to be. Good subnet planning, verified with a calculator, prevents the two classic failures: running out of addresses in a growing department, and wasting a huge block on a link that needed four addresses.

Reading binary without fear

Subnetly also shows the binary form of your address and mask, because binary is where subnetting stops being memorised rules and starts being obvious. When you see the mask as twenty-four 1s and eight 0s lined up under the address, the network address is just "copy the bits where the mask has 1s, zero the rest". Borrowing bits for a split is literally watching the boundary move one column to the right. You do not need to work in binary daily — the calculator does that — but glancing at it when a result surprises you is the fastest way to understand why the result is what it is. Most subnetting mistakes, from misaligned blocks to masks that are not contiguous, become visible at a glance in binary.

Whether you are studying for a networking exam, designing a cloud VPC, segmenting a home lab or double-checking a change window at 2 a.m., the workflow is the same: enter the address, choose the prefix or mask, read the boundaries, split if you need to, and copy the summary into your documentation. Subnetly does all of it locally in your browser, instantly, for free.

Frequently asked questions