IPv4 Subnet Calculator
Calculate network address, broadcast, and host range from an IP and CIDR prefix or subnet mask.
| Item | Value | Binary |
|---|
If you choose a prefix larger than the current range, it shows how many subnets it will split into.
| # | Network | First Host | Last Host | Broadcast | Host Count |
|---|
CIDR Prefix Reference Table (VLSM)
Click a row to calculate with that prefix.
| CIDR | Subnet Mask | Wildcard | Total Addresses | Available Hosts |
|---|
What is the IPv4 Subnet Calculator?
When designing or managing a network, you often encounter CIDR notation like `192.168.1.0/24`. This IPv4 Subnet Calculator instantly computes the network address, broadcast address, and the exact range and number of usable IPs. It's smart enough to parse a full `IP/CIDR` string if you paste one, and it automatically syncs the `CIDR Prefix` and `Subnet Mask` fields. The tool also includes a subnetting simulator for planning network divisions and a handy VLSM reference table. All calculations run in your browser, so internal network information is never sent to a server.
How to use
- Enter an IP in the "IP Address" field, or paste a full string like `192.168.1.10/24` to have it recognized automatically.
- Adjust the "CIDR Prefix" (e.g., 24) or the "Subnet Mask" (e.g., 255.255.255.0). Editing one instantly updates the other.
- Results appear below, showing details like network address, usable host range, wildcard mask, and total addresses in both decimal and binary.
- To divide the calculated range, use the "Split Prefix" dropdown in the "Subnetting" section to see a list of the resulting smaller subnets.
- You can download the list of subnets by clicking the "Save CSV" button.
- Quickly apply a common prefix by clicking a row in the "CIDR Prefix Reference Table (VLSM)" at the bottom of the page.
IPv4 Subnet Calculator guide
How this tool is used in real work, and what to watch out for.
How to Read CIDR — Why a /24 has 254 Hosts
A /24 means the first 24 bits identify the network, and the remaining 8 bits identify hosts within it. While 8 bits can represent 256 values, you only get 254 usable hosts. That's because two addresses are reserved: the first address (where the host bits are all zeros) is the network address, which acts as a label for the network itself, and the last address (where the host bits are all ones) is the broadcast address. Neither can be assigned to a device.
The larger the prefix number, the smaller the network. A /25 has 128 addresses, and a /26 has 64. A good rule of thumb is that for every 1 you add to the prefix, the network size is halved. You can click any row in the reference table below to calculate with that prefix.
| Prefix | Total Addresses | Hosts | Notes |
|---|---|---|---|
| /24 | 256 | 254 | The most common size |
| /26 | 64 | 62 | For small subnets |
| /30 | 4 | 2 | Legacy size for router-to-router links |
| /31 | 2 | 2 | RFC 3021 — Point-to-point links don't need a broadcast, so both are usable |
| /32 | 1 | 1 | A single host. Used in firewalls to specify one IP. |
Cloud Providers Reserve More Than Two Addresses
This calculator shows the 254 usable hosts based on the IPv4 standard. However, if you create a /24 subnet in an AWS VPC, you'll only get 251 usable IP addresses. This is because AWS reserves five addresses in every subnet: the network address, the VPC router (.1), DNS (.2), one reserved for future use (.3), and the broadcast address. Azure also reserves five addresses in a similar fashion.
Losing three extra addresses might not seem like a big deal, but it's critical in smaller subnets. A standard /29 subnet gives you 6 usable hosts, but on AWS, you're left with only 3. In environments like Kubernetes where every pod consumes an IP, designing subnets too tightly will prevent you from adding nodes later. And once a subnet is created, you can't change its size.
Overlapping Subnets Will Come Back to Haunt You
The costliest mistake in subnet design isn't a calculation error; it's picking the wrong IP range. Since anyone can use private IP ranges, the moment you need to connect two networks, any overlapping ranges will conflict. And the only solution to this conflict is to completely re-architect one of the networks.
- Work-from-home VPNs: If your company network is `192.168.0.0/24` and an employee's home router also uses `192.168.0.0/24`, they won't be able to reach company servers even when connected to the VPN. The destination overlaps with their own local LAN, making routing impossible. This is highly probable, as it's a very common default for home routers.
- VPC Peering & On-Premises Connections: If two VPCs have overlapping CIDR blocks, peering will be rejected outright. If you manage multiple cloud accounts, assign non-overlapping ranges to each account from the very beginning.
- Docker: The default bridge network is `172.17.0.0/16`. If your corporate network uses the `172.17.x.x` range, containers won't be able to reach internal company servers.
- Establish a company-wide standard. For example, assign `10.10.x.x` for offices, `10.20.x.x` for dev VPCs, and `10.30.x.x` for production VPCs. A clear division prevents overlap no matter what you connect later.
Using Subnets in Firewalls and Security Groups
When adding an IP to a security group or firewall rule, you almost always use CIDR notation. To allow a single IP address, you append a `/32`, like `203.0.113.9/32`. Conversely, `0.0.0.0/0` means 'anywhere in the world'.
The most common and dangerous mistake is opening port 22 (SSH) or 3389 (RDP) to `0.0.0.0/0`. Within minutes of a server going live, it will be targeted by automated brute-force attacks. Always restrict administrative ports to trusted sources, like your office IP or a bastion host.
- The `Wildcard Mask` field is used in syntaxes like Cisco ACLs. It's the inverse of a subnet mask, so a /24 corresponds to `0.0.0.255`. It's easy to get this wrong, so copy the value from this tool to avoid mistakes.
- Many business internet connections have dynamic IPs, meaning your office IP can change. Don't rely solely on an IP allowlist; use a VPN or bastion host as a more stable access method.
- The plan to 'open it wide now and lock it down later' rarely happens. Start with the principle of least privilege and keep your rules tight from the beginning.
Planning Layouts with the Subnetting Tool
In the `Subnetting` section below, you can choose a larger `Split Prefix` to see how the current range can be divided. The table shows the network, host range, and broadcast address for each resulting subnet. This is useful for planning, such as dividing a `10.0.0.0/16` into 256 `/24` subnets for different availability zones or purposes.
The table displays the first 256 subnets, but you can download up to the first 5,000 as a CSV file by clicking `Save CSV`. The file is saved as UTF-8 with a BOM, so it opens correctly in Excel without character encoding issues. This makes it easy to create tables for your design documents.
Frequently asked questions
How many hosts are in a /24 network?
A /24 network has 8 host bits (32 - 24), which means 2⁸ or 256 total addresses. Since the first (network) and last (broadcast) addresses are reserved, you have 254 usable hosts for devices.
What's the difference between CIDR and a subnet mask?
They are two notations for the same thing: network size. A subnet mask uses a four-part decimal format like `255.255.255.0`, while CIDR uses a simple slash format like `/24`. This tool converts between them automatically.
What is a wildcard mask used for?
A wildcard mask is a subnet mask with the bits inverted (e.g., `0.0.0.255` is the wildcard for `255.255.255.0`). It's used in router Access Control Lists (ACLs) to define an IP range to match.
Is it safe to enter my company's IP address here?
Yes, absolutely. This calculator runs entirely inside your web browser. No data you enter—including internal IP addresses—is ever sent to a server, ensuring your information remains private. No sign-up or installation is needed.