Subnet Calculator: How to Work Out Addresses, Masks and Ranges

In a router settings screen or on a server, the address 192.168.1.10 is always accompanied by one more number: 255.255.255.0, or in CIDR notation, /24. It explains where your local network ends and the neighbouring one begins. On its own the value looks like a random collection of digits, which is exactly why people copy it from an example without understanding the meaning. Here is how to take an address apart bit by bit, count how many devices fit in a network, find the first and the last usable address, and work out the mask of your own machine.

What an IP address and a subnet mask are

An address in version 4 of the protocol is a 32-bit number, normally written as four parts separated by dots, each running from 0 to 255. Such an address is not handed out at random: it splits into two halves. The first, the network part, is identical for every device in the same network and points at the network itself. The second, the host part, is different for each device and identifies that specific device inside it. The subnet mask says where the boundary between those two halves runs.

How an address is built: four octets

Each part of an address is called an octet and holds exactly 8 bits. That is why 255 is eight ones in binary, and zero is eight zeros. Converting an address to binary is worth doing once, because everything after that becomes a simple bitwise operation rather than an exercise in counting addresses one by one: the mask, the network address and the broadcast address are all computed directly.

• an address consists of four octets of 8 bits, 32 bits in total;
• the number of possible addresses is 2 to the power of 32, that is 4 294 967 296;
• an octet is written in decimal, yet internally it is always eight bits;
• leading zeros are left out, so 010 is written 10, while 000 is written 0;
• the binary form of an address always contains exactly 32 zeros and ones, grouped in eights.

192.168.1.10

192 = 11000000     168 = 10101000
  1 = 00000001      10 = 00001010

altogether: 11000000.10101000.00000001.00001010

The mask: which bits belong to the network

A mask is written as a binary number of the same 32 bits, and it always begins with ones and ends with zeros. The ones mark the bits that belong to the network, the zeros mark the host bits. In dotted form the mask looks much like an address: 255.255.255.0 in binary is 24 ones followed by 8 zeros. Matching the first 24 bits of an address against the mask is what produces the network part.

• 255.255.255.0 corresponds to /24: 24 network bits and 8 host bits;
• 255.255.0.0 corresponds to /16, and 255.0.0.0 to /8;
• 255.255.255.252 corresponds to /30, leaving only two host bits;
• the more ones the mask holds, the smaller the network and the larger the subnets inside it;
• the wildcard mask, which turns up in filtering rules, is computed the other way round: ones and zeros swap, so /24 becomes 0.0.0.255.

CIDR and how many addresses a network holds

The /24 form is called a prefix in CIDR notation, and it is simply a short way of saying "24 ones in the mask". The number of addresses follows from one step: take two to the power of the number of zeros in the mask. With /24 there are eight zeros, so the network holds 2 to the power of 8, that is 256 addresses. Two of them never go to a device. The network address marks the network itself, and the broadcast address sends a packet to everyone inside it. That leaves 254 addresses for actual hosts.

Address: 11000000.10101000.00000001.00001010
Mask:    11111111.11111111.11111111.00000000   (/24)
              AND
Network: 11000000.10101000.00000001.00000000   = 192.168.1.0

At /24 the host part occupies 8 bits:
   2^8 = 256 addresses in total
   256 − 2 = 254 available to devices

The same calculation for /26: 6 zero bits, so
   2^6 = 64 addresses, 62 available to devices

• /8 — 2 to the power of 24, which is 16 777 216 addresses;
• /16 — 2 to the power of 16, 65 536 addresses;
• /24 — 2 to the power of 8, 256 addresses, 254 for devices;
• /26 — 2 to the power of 6, 64 addresses, 62 for devices;
• /30 — 2 to the power of 2, 4 addresses, of which only two can be assigned;
• /31 and /32 are counted separately, since nothing is subtracted there: they cover link-to-point links and a single address on an interface.

Network address, broadcast, first and last host

Two addresses in every network are spoken for. The first, the network address, comes from clearing every host bit, and it points at the network rather than at a device. The second, the broadcast address, comes from setting every host bit, and a packet sent to it reaches everyone in the network. The addresses in between belong to devices, and the outermost of those are the first and the last usable host.

Network address:      192.168.1.0
First usable host:    192.168.1.1
Last usable host:     192.168.1.254
Broadcast address:    192.168.1.255
Total addresses:      256
Available to hosts:   254

Another example, 10.0.0.0/8:
   16 777 216 addresses in total, 16 777 214 available
   host range: 10.0.0.1 — 10.255.255.254
   broadcast: 10.255.255.255

And 192.168.1.130/26:
   mask 255.255.255.192
   network 192.168.1.128, broadcast 192.168.1.191
   hosts 192.168.1.129 — 192.168.1.190, 62 in total

Of those four numbers, two are familiar to anyone who has set up a home network: 192.168.1.1 is almost always the router, and 192.168.1.255 is almost always the broadcast address. Everything in the range 192.168.1.1 — 192.168.1.254 belongs to devices: computers, phones, televisions, printers, and anything else able to join a network.

Classful networks and why they were dropped

Before 1993, addresses were divided into classes, and the leading octet alone decided where the network ended. Class A covered 1 to 126 with a mask of 255.0.0.0, class B covered 128 to 191 with 255.255.0.0, and class C covered 192 to 223 with 255.255.255.0. The remaining ranges had special roles: 224 to 239 went to multicast, and 240 to 255 was reserved. The scheme was simple, but every new provider added more networks to the routing tables, and by the early nineties those tables had become unmanageable. In 1993 the IETF published RFC 1518 and RFC 1519, introducing CIDR notation with a prefix of any length, and in 2006 RFC 4632 revised it. Classful networks survived afterwards only as historical background, and every modern network is described by a prefix.

• class A: leading octet 1 to 126, mask 255.0.0.0, up to 16 million addresses;
• class B: 128 to 191, mask 255.255.0.0, up to 65 thousand addresses;
• class C: 192 to 223, mask 255.255.255.0, 254 addresses;
• 127.0.0.0/8 is the loopback, the address of the machine itself, which never leaves the host;
• 0.0.0.0 means "any address" and in a router it marks the default gateway.

Private addresses and why they must not reach the internet

Private addresses look entirely ordinary but were set aside specifically for internal networks. RFC 1918, published in February 1996, defines three ranges for this purpose. The point of them is that they are not unique across the internet: every office and every home runs its own 192.168.1.0/24, and that causes no conflict precisely because such addresses are not routed in the public internet. A packet carrying a private address that turns up on the global network is normally dropped at the closest router. This is why a home router takes a private address for itself while presenting an address issued by the provider to the outside, swapping one for the other on the fly.

• 10.0.0.0/8 is the largest private block, 10.0.0.0 to 10.255.255.255, used in large organisational networks;
• 172.16.0.0/12 covers 172.16.0.0 to 172.31.255.255, a range noticeably smaller than the 172 suggests;
• 192.168.0.0/16 covers 192.168.0.0 to 192.168.255.255, the familiar home and office block;
• 169.254.0.0/16 is link-local, the address a device assigns to itself when it finds no network;
• 100.64.0.0/10 is reserved for operators handing out addresses to hundreds of subscribers behind one public address.

Finding your own address and mask

Your own address can be checked from the operating system without opening a browser. On Windows that is the ipconfig command, on Linux and macOS it is ip addr or ifconfig, and on a phone it sits in the network section of the settings. The mask appears next to the address as 255.255.255.0, and modern systems also show it in readable form, written as /24.

1. open a terminal or a command prompt;
2. on Windows run ipconfig, on Linux and macOS run ip addr or ifconfig;
3. find the line whose address starts with 192.168, 10 or 172.16;
4. look beside it for the subnet mask field, or for a prefix in brackets on systems that show one;
5. enter the address and prefix into the subnet calculator, which immediately reports the network, the broadcast address and the host range.

The public address you are seen under on the internet is found differently: any IP lookup service will show it, and the IP information tool prints the address itself, the class of the network, whether it is private or public, and immediately calculates the CIDR details for whatever value you type in. The difference between the two addresses is informative in itself: if the external address begins with 192.168, there is a router with a private address in front of you, and quite possibly no port forwarding configured.

Splitting a network into subnets

When a network ends up holding more devices than one block allows, it gets divided. The straightforward route runs from small subnets to large ones: take the original block and carve subnets with a longer prefix out of it. Each subnet gets its own range, and devices in different subnets no longer see each other directly but talk through a router. The same split keeps a guest network apart from a working one and stops guests from reaching the corporate segment.

Before: 192.168.1.0/24, 254 addresses
After: four subnets of /26, 62 addresses each

1. 192.168.1.0/26    mask 255.255.255.192
   hosts .1 — .62,  broadcast .63
2. 192.168.1.64/26   mask 255.255.255.192
   hosts .65 — .126, broadcast .127
3. 192.168.1.128/26  mask 255.255.255.192
   hosts .129 — .190, broadcast .191
4. 192.168.1.192/26  mask 255.255.255.192
   hosts .193 — .254, broadcast .255

Check: 64 × 4 = 256 addresses, eight of them
reserved (two per subnet), 248 go to devices.

The number of subnets is always a power of two, because "three and a half" subnets make no sense: addresses cannot be halved. If exactly four parts are needed, the prefix grows by two bits and 24 becomes 26. For eight, three bits are added and the result is /27. The reverse question is answered the same way: knowing how many addresses a subnet needs, pick the nearest power of two and subtract two.

Typical mistakes

• mixing up /24 and 255.255.255.0: these are the same thing written two ways, not different values, and a /24 prefix means 24 network bits, not 24 addresses;
• forgetting the broadcast address and handing a device 192.168.1.255, after which connectivity to it behaves in unpredictable ways;
• assuming 256 devices fit in a /24: only 254 are actually available, and on a densely filled network two addresses can turn out to be missing;
• picking a mask by the size of the network rather than by the number of devices, then wondering why some computers cannot see the rest;
• assigning a device an address from another range while forgetting the mask: with /24 an address such as 192.168.2.15 simply falls outside your network;
• treating classful networks as current: a class C network from a book published in 1998 may really be a /22 or a /28;
• taking /30 for an ordinary workstation: two addresses per device do not work that way, and /24 or /26 exist for that.

Common questions

Why does a /24 hold 256 addresses when only 254 are usable?

Because two addresses are reserved for the network itself. The network address 192.168.1.0 denotes the block 192.168.1.0/24 and cannot be assigned to a device, since otherwise the device could not tell itself apart from the network. The broadcast address 192.168.1.255 exists to send a packet to every participant at once. Everything between them, that is 192.168.1.1 through 192.168.1.254, is handed out to devices.

How do I find out my computer subnet?

On Windows, run ipconfig in the command prompt and look at the subnet mask line for the connection in question; on Linux or macOS use ip addr or ifconfig. Next to an address of 192.168.1.10 there will be 255.255.255.0, that is /24. On systems that show a prefix in brackets it is written as /24 straight away, and then there is nothing to recalculate.

How is a subnet mask different from a wildcard mask?

They are one and the same mask with the opposite meaning. An ordinary mask answers the question "which bits define the network", with ones first and zeros after: 255.255.255.0 for /24. A wildcard mask answers "which bits should be ignored", so the ones and zeros swap and the same /24 becomes 0.0.0.255. Wildcards turn up in routing and filtering rules where the intent is "any address in this subnet".

Can a network be split into unequal parts?

Yes, and the technique is called VLSM and is used everywhere. The largest subnet is carved out first for the largest requirement, then the next one, and so on, with the remaining space cut into the smaller subnets. Inside one address space the total number of addresses does not change, they are simply distributed unevenly: one part gets a thousand addresses, another gets twenty-eight.

Why does a private address not work on the internet?

Because routers in the public network have no idea where to send a packet addressed to 192.168.1.10. Such an address repeats in thousands of home and office networks around the world, so a router cannot decide which of them to deliver to. Those addresses are dropped at the edge of the network, and what goes out instead is the address the provider issued. Swapping one for the other at that boundary is called network address translation.

What is an address in 127.0.0.0/8?

That is the loopback: the address 127.0.0.1 always points at the machine that sent the request, whatever the network settings say. This is how a local web server is reached through localhost. Such packets never travel on the global internet, and the whole block 127.0.0.0/8 is reserved for that purpose.