IPv4 CIDR Calculator

How to read the results

Every IPv4 address is 32 bits long, written as four 8-bit octets in decimal. The number after the slash is the prefix length. It says how many of those bits, counting from the left, identify the network. Whatever is left over identifies a host inside it. In 192.168.1.10/24 the first 24 bits (192.168.1) are the network and the final 8 bits (.10) are the host.

The subnet mask is that same split written as an address: 24 ones followed by 8 zeros is 255.255.255.0. The boundary does not have to land between octets, which is where masks stop being memorable. A /20 is 255.255.240.0, because the third octet is cut four bits in. That is why this calculator shows the mask in binary as well as dotted decimal. The binary view makes the boundary obvious, and the dotted form is what you type into a router.

Enter any address inside a block and you get the block back, not the address you typed. 192.168.1.10/24 and 192.168.1.200/24 both resolve to 192.168.1.0/24, because masking the host bits off is exactly what a router does when it matches a route. It is also a quick way to check whether an address you have been given actually sits in the subnet you think it does.

How many IP addresses are in a /24?

256 in total, of which 254 are usable. A block holds 2^{(32 − prefix)} addresses, and in a conventional subnet two of them are already spoken for: the first, with all host bits zero, is the network address that names the subnet itself, and the last, with all host bits one, is the directed broadcast. Neither can be assigned to an interface, so usable is the total minus two.

That subtraction bites hardest on small blocks. A /30 holds four addresses and offers two, which is why it was the standard allocation for a link between two routers: half of every such block was overhead.

Worked example: splitting a /24 into four /26s

Borrow two bits from the host portion of 192.168.10.0/24 and you get four equal subnets of 64 addresses each, all with the mask 255.255.255.192:

Two things are worth noticing. Each subnet starts at a multiple of its own size, 0, 64, 128 and 192, and that alignment rule is not a convention you can bend: 192.168.10.32/26 is not a network, and this calculator will show it to you as 192.168.10.0/26. And the number of subnets you get is two raised to the number of bits you borrowed, so one /24 yields four /26s, eight /27s, or sixteen /28s.

What does a /31 or /32 mean?

A /32 is a single address and a /31 is a pair, both fully usable. They are the two prefixes where the minus-two rule above does not apply.

A /32 has no host bits at all: one address, reported here as one usable. You meet it wherever a single address is the whole point: router loopback interfaces, host routes in a routing table, a firewall rule or route target that has to match exactly one machine.

A /31 is the more interesting case. Under the rule above it would hold two addresses and offer zero, making it useless. RFC 3021 changed that for point-to-point links: a link with exactly two endpoints has no need of a broadcast address, because anything one end sends can only be heard by the other. Both addresses become assignable and a transit link costs two addresses instead of four. That is why this calculator reports a /31 as two usable addresses rather than none. Support is broad on current router platforms, but confirm the far end before you renumber, because some host stacks and older equipment still refuse a /31 on an interface.

Netmask and wildcard mask

The wildcard mask is the bitwise inverse of the subnet mask: /24 is 255.255.255.0 as a netmask and 0.0.0.255 as a wildcard. A one bit in a netmask means "this bit belongs to the network"; a one bit in a wildcard means "ignore this bit when matching". Cisco access lists and OSPF network statements take the wildcard form, so having both in front of you saves a mental inversion at the moment you can least afford one.

Common questions

Why does my cloud provider reserve five addresses per subnet?

AWS reserves five addresses in every VPC subnet: the network address, the VPC router, a DNS address, one held for future use, and the broadcast address. A /24 there gives 251 usable addresses rather than 254. Azure reserves five on the same principle and Google Cloud four. The counts here are the standard IPv4 ones, so subtract your provider's reservations on top, and check the smallest prefix they will accept: AWS, for example, will not create a subnet smaller than a /28.

How big a block should I allocate?

Size it for the growth you expect and then round up a prefix, because widening a subnet later means renumbering everything in it. The cost of a spare bit is a block twice the size; the cost of being one address short is an outage window. On a flat office VLAN a /24 is the usual default. For a handful of servers, a /28 or /27 keeps the address plan tidy without stranding 200 addresses.

Can I use the network or broadcast address on a host?

Not on a shared segment. Most stacks will refuse to accept the assignment, and the ones that let you try produce failures that are hard to attribute later, such as a host that is reachable from some places and not others. The two exceptions are the /31 and /32 cases above, where there is no broadcast address to collide with in the first place.

Need the prefix-to-mask relationship for every prefix at once? The CIDR ranges table lists /0 to /32 with masks and address counts.