Subnet Calculator

Where subnet maths shows up in real work

The first place subnet maths becomes part of daily work is the home network. A router hands out addresses from 192.168.1.0/24, and once a dozen devices are online the question becomes how to split that block: move cameras and guest phones into their own subnets so they do not swamp the main traffic. The second place is cloud infrastructure, where ordering a virtual machine shows a ready-made CIDR and asks you to pick a mask for extra network interfaces.

Engineering work brings the calculation back during incident review. A router log showing a packet addressed to the broadcast address 192.168.1.255 makes the first check simple: confirm that 192.168.1.0/24 is configured as intended and that the address really belongs to that subnet rather than to a neighbouring one that leaked into the routing table. The same habit catches planning errors: if a design document says 10.10.10.0/24 next to 10.10.0.0/16, one of the two was written on the wrong boundary. Pulling a host out of a log or a link is easier with a URL broken into parts, and the HTTP status code reference explains what the response line is telling you.

• Splitting a home router across subnets for different device types
• Ordering a cloud server with additional network interfaces
• Checking the address plan and router configuration
• Sizing an address pool for an office network
• Choosing a mask that fits the number of devices in a VLAN
• Reading addresses out of network equipment logs

Where subnet calculations go wrong

The first mistake is assuming a /24 holds some other number of addresses because the prefix looks like a class. Twenty-four network bits and eight host bits give exactly 256 addresses — there is no extra pair of addresses hiding behind the arithmetic of two to a power. The second mistake is swapping the network address for the broadcast address: in a /24 those are 192.168.1.0 and 192.168.1.255, with the host range sitting between them. The third, and most expensive one, is using a mask that does not exist inside the block.

Mask mistakes deserve their own paragraph, because the address looks right while the network misbehaves. In 192.168.1.0/24 and 192.168.1.128/25 the first 128 addresses coincide, so a router may happily accept traffic that was meant for a different subnet. Another subtlety: addresses from 127.0.0.0/8 only work on the device itself, and 169.254.0.0/16 appears on its own when an interface fails to get a DHCP lease, so neither should be counted as a working address.

• Confusing the number of network bits with the number of addresses
• Assigning the network or broadcast address to a device
• Using a mask that does not exist in the block, such as 255.255.255.192 in a /24
• Treating 127.0.0.0/8 as a working network when it only works locally
• Mistaking a 169.254.0.0/16 address for a normal DHCP lease
• Applying the minus-two rule to /31 and /32

A worked example: 192.168.1.0/24 step by step

Take the network 192.168.1.0/24 apart. The prefix 24 means the first 24 bits of the address describe the network and the remaining 8 bits describe the host. Eight free bits give 2 to the 8th power, that is 256 addresses in the block. Two of them are reserved, so 254 hosts remain and their working range is 192.168.1.1 to 192.168.1.254.

The same address is easier to verify in binary: 192 is 11000000 and 168 is 10101000, while the third and fourth octets carry the prefix and the host part. The mask 255.255.255.0 reads as 24 ones and eight zeros. ANDing the address with the mask drops the host part and leaves 192.168.1.0; inverting the mask gives 0.0.0.255, and adding it to the network address produces the broadcast 192.168.1.255. The binary view is what helps when a calculation has to be done by hand or a config needs checking, and a binary converter takes care of the octet-to-bits part.

Every step is a bitwise operation on a 32-bit number, so a /8 is calculated just as fast as a /32.

Subnets, masks and neighbouring tools

Subnet work rarely stands alone: you usually need to read the address itself or check a binary form alongside it. For a quick orientation there is an IP address checker that takes an address and immediately says whether it is private or public. When the idea of numbers in different bases feels shaky, the number base converter and the plain-language piece on binary code cover the two ideas the whole calculation rests on.

A frequent companion to subnets is an access rule, where networks are listed one after another. The .htaccess generator builds such lists, including blocks by address and by range, and shows what the finished Apache configuration looks like. Since those rules are written as regular expressions, they can be tested in advance with the regular expression tester.

• Checking an IP address and its class
• Converting numbers between binary, hexadecimal and other bases
• Understanding binary without a technical background
• Building address lists for access rules
• Testing the regular expressions used in access lists
• Sizing masks for routers and firewalls