--- title: "IP Subnet Calculator" date: 2026-10-08 author: "Sofia Ramirez" featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/10/subnet-calculator.jpg" --- # IP Subnet Calculator The IP subnet calculator takes an IPv4 address and a prefix length and returns the network, broadcast address, usable host range, subnet mask, wildcard mask, class and type, plus the mask and address in binary. For 192.168.1.10/24 it reports **254** usable hosts from 192.168.1.1 to 192.168.1.254 and a broadcast address of 192.168.1.255. IP Subnet Calculator Examples Reset Home LAN /24 Office block /22 Split a /24 into /26 Point-to-point /31 CGNAT /10 IPv4 address Paste CIDR (192.168.10.0/22), or add a mask or wildcard after a space (192.168.10.0 255.255.252.0 or 192.168.10.0 0.0.3.255). Prefix length / The number after the slash, 0 to 32. A prefix or mask typed in the address field takes its place. Split into No split (show the CIDR cheat sheet) /1 /2 /3 /4 /5 /6 /7 /8 /9 /10 /11 /12 /13 /14 /15 /16 /17 /18 /19 /20 /21 /22 /23 /24 /25 /26 /27 /28 /29 /30 /31 /32 Lists every smaller block of the network at this prefix, with first and last host, broadcast and a CSV. Network 192.168.1.0/24 Copy 192.168.1.0/24 runs from 192.168.1.1 to 192.168.1.254, with 254 usable hosts and broadcast address 192.168.1.255. Network192.168.1.0/24 SubnetsNot split: pick a prefix under Split into Broadcast address192.168.1.255 Usable host range192.168.1.1 to 192.168.1.254 Usable hosts254 Total addresses256 Subnet mask255.255.255.0 Wildcard mask0.0.0.255 Address classC Address typePrivate (RFC 1918) Mask in binary11111111.11111111.11111111.00000000 Address in binary11000000.10101000.00000001.00001010 Copy all details Save scenario Share result Download CSV Saved scenarios Saved in this browser only. Each column is recalculated whenever the page loads. CIDR cheat sheet | Prefix | Subnet mask | Wildcard | Addresses | Usable hosts | |---|---|---|---|---| How this works How it worksUsable hosts = 2^(32 − prefix) − 2, except /31 (two hosts, RFC 3021) and /32 (one). The /prefix notation is CIDR, defined in [IETF RFC 4632 (opens in new window)](https://www.rfc-editor.org/rfc/rfc4632.html). A dotted mask or Cisco wildcard is read as the prefix it stands for; a mask that is not one run of 1 bits is rejected. A split lists up to 1,024 subnets. Not coveredIPv4 only; the class column is historical, and nothing is scanned or contacted. Privacy**What you enter never reaches our server.** It is processed on your device, inside this page. CorrectionsReport a wrong result to [media@sqmagazine.co.uk](mailto:media@sqmagazine.co.uk?subject=Correction%3A%20IP%20Subnet%20Calculator); every report is reviewed and confirmed errors are corrected. Include the inputs and the answer you expected. With your permission, we thank you by name on this page. FeedbackHow useful was this tool? The figures shown are the worked example. Enable JavaScript to calculate with your own numbers. ## How to Use the IP Subnet Calculator The calculator runs in your browser, and nothing you enter reaches our server. Give it an address and a prefix, and every field updates at once: 1. Type an address into “IPv4 address”, such as 192.168.1.10. An address with the prefix attached, such as 192.168.1.10/24, or an IPv6 address returns an error asking for a valid IPv4 address. 2. Set “Prefix length” to the number after the slash. According to the IETF’s [RFC 4632](https://www.rfc-editor.org/rfc/rfc4632), it is a decimal value between 0 and **32** that describes the number of significant bits. A mask written as 255.255.255.0 goes in as 24. 3. Or pick a preset from the “Examples” row: 192.168.1.10/24, 10.0.0.0/8, 172.16.5.9/12 or 203.0.113.45/28. 4. Read “Network”, then the rows from “Broadcast address” down to “Address in binary”. 5. Open the collapsed “CIDR cheat sheet” for every prefix from /32 to /8. It stops at /8 because, per RFC 4632, prefixes of length shorter than 8 have not been allocated or assigned to date. 6. Use “Share result” to send a URL that reopens the same calculation, or “Download CSV” to keep the table. The “How this is calculated” note restates the host formula. ## How the Subnet Calculator Works The calculator treats the address and the mask as 32-bit values. [RFC 791](https://www.rfc-editor.org/rfc/rfc791) fixes the size: “Addresses are fixed length of four octets (32 bits).” The prefix builds the mask. Per RFC 950, the mask is a bit-mask with bits set in the fields corresponding to the IP network number, and additional bits set corresponding to the subnet number field. Three bit operations and one power of two then give the network, the broadcast, the wildcard and the address counts: - The network is the address AND the mask. [RFC 950](https://www.rfc-editor.org/rfc/rfc950) has a host decide whether a destination is local by testing bitwise\_and(dg.ip\_dest, my\_ip\_mask) = bitwise\_and(my\_ip\_addr, my\_ip\_mask), the same comparison the tool runs. - The broadcast address is the network with every host bit set to one. According to RFC 1122, that form is the Directed broadcast to the specified network and MUST NOT be used as a source address. - The wildcard mask is the mask with every bit inverted, the form access lists read. - Total addresses equal **2** raised to the number of host bits, because RFC 4632 lets a prefix describe any power of two-sized block of between one and 2^32 end system addresses. Usable hosts take 2 off that total, except at /31 and /32. Class and type are labels, read from the first octet and a block lookup. | Output | What the tool computes | Rule and source | |---|---|---| | Subnet mask, Mask in binary | The first N bits set to one and the rest zero, where N is the prefix | [RFC 4632](https://www.rfc-editor.org/rfc/rfc4632), section 3.1 | | Network | Address AND mask, shown with the prefix | [RFC 950](https://www.rfc-editor.org/rfc/rfc950) bitwise\_and | | Broadcast address | Network OR inverted mask (every host bit one) | [RFC 1122](https://www.rfc-editor.org/rfc/rfc1122), section 3.2.1.3 | | Usable host range | Network plus one, to broadcast minus one; the whole block at /31 and /32 | [RFC 3021](https://www.rfc-editor.org/rfc/rfc3021); RFC 4632 host route | | Total addresses | Two to the power of the host bits (32 minus the prefix) | RFC 4632, section 3.1 | | Usable hosts | Total minus two; /31 keeps both and /32 keeps its one | RFC 1122; RFC 3021 | | Wildcard mask | Mask with every bit inverted | Cisco access-list documentation | | Address class | High-order bits of the first octet: zero, one-zero, one-one-zero, 1110, 1111 | [RFC 791](https://www.rfc-editor.org/rfc/rfc791); [RFC 1112](https://www.rfc-editor.org/rfc/rfc1112) | | Address type | Lookup against 13 fixed blocks under nine labels, else Public | [IANA registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml) of special-purpose blocks | *Sources: RFC 4632, RFC 950, RFC 1122, RFC 3021, RFC 791, RFC 1112, IANA, Cisco* ### How Do You Calculate a Subnet by Hand? Write the address and the mask in binary. AND them for the network, set every host bit to one for the broadcast, and count 2 to the power of the host bits: a /24 has **256** addresses and 254 usable hosts. The example below runs each step. ## Subnet Calculator Example: 192.168.1.10/24 The opening preset gives these figures: 1. The address in binary is 11000000.10101000.00000001.00001010. Its high-order bits are one-one-zero, so “Address class” reads C, the pattern [RFC 791](https://www.rfc-editor.org/rfc/rfc791) gives when in class c, the high order three bits are one-one-zero. 2. The mask in binary for /24 is **24 ones** and **8 zeros**, 11111111.11111111.11111111.00000000, or 255.255.255.0 in decimal. 3. AND the two values and all **8 host bits** drop to zero, which gives the network 192.168.1.0/24. Set the host octet to all ones for the broadcast address, 192.168.1.255. Invert the mask for the wildcard, 0.0.0.255. 4. The usable host range runs from 192.168.1.1 to 192.168.1.254, which is **254** usable hosts out of 256 total. 5. The type reads Private (RFC 1918) because [RFC 1918](https://www.rfc-editor.org/rfc/rfc1918) names 192.168.0.0 – 192.168.255.255 (192.168/16 prefix) as private, and 192.168.1.0/24 sits inside it. ### What Does a Subnet Mask of 255.255.255.0 Mean? A mask of 255.255.255.0 means the three left-hand octets name the network and the last octet numbers the hosts. In RFC 4632’s words, for a block written as /24, the most significant 24 bits are ones and the least significant 8 bits are zeros. Eight host bits give 256 values. Two are reserved. So a device with that mask can share its network with up to **253** other hosts. ## What Your Subnet Calculator Result Means The result is arithmetic on an address and a prefix. It tells you where a block starts and ends and how many devices fit inside it; it says nothing about whether those devices are in use or secure. The two addresses left out of the usable range are the block’s network and broadcast addresses. [RFC 3021](https://www.rfc-editor.org/rfc/rfc3021) counts the four addresses of a 30-bit subnet as two host addresses, one all-zeros network and one all-ones broadcast. The /31 and /32 rows break that pattern. The same RFC notes that numbered subnets used a 30-bit subnet mask (in most cases), which requires four addresses per link, even though point-to-point links can only possibly have two identifying endpoints. On a point-to-point link with a 31-bit mask, the two remaining addresses MUST be interpreted as host addresses. So a /31 keeps both of its **2** addresses for hosts, a /30 spends 4 addresses on the same two hosts, and a /32 is a single address, the row RFC 4632’s table marks as a host route. The all-ones address has its own rule. [RFC 919](https://www.rfc-editor.org/rfc/rfc919) says: “The address 255.255.255.255 denotes a broadcast on a local hardware network, which must not be forwarded.” The tool labels that address “Multicast or reserved”, the label it gives every address whose first octet is 224 or above. The explainer on [how VPNs work](https://sqmagazine.co.uk/how-vpns-work/) covers the tunnel that joins two private networks. ### Common Mistakes When Reading a Subnet Result - Counting cloud hosts from the usable column. Amazon’s [VPC user guide](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-sizing.html) says The first four IP addresses and the last IP address in each subnet CIDR block are not available for your use, and it keeps a subnet between a /28 netmask and /16 netmask. A /28 that shows 14 usable hosts here leaves **11** in a VPC. - Reading the class column as routing. Classful assignment is deprecated, as the classes section explains. - Reading a Public label as proof an address is routed on the internet. The type column checks **13 fixed blocks** under nine labels, so a special-purpose block outside them still reads Public, as the next section shows. - Typing a dotted mask into “Prefix length”. The field takes **0 to 32 mask bits**; above 32 it shows an error, and a decimal is rounded. Segmenting an office network is one of the controls in the [small-business cybersecurity plan](https://sqmagazine.co.uk/how-to-secure-your-business-from-cyber-attacks/), and sizing those segments starts with the split below. ## How Many Subnets Are in a /24? Every bit borrowed from the host part doubles the subnet count and halves the addresses in each. A /24 split to /26 gives **4** subnets of 64 addresses with 62 usable hosts each. | New prefix | Subnets in a /24 | Addresses each | Usable hosts each | |---|---|---|---| | /25 | 2 | 128 | 126 | | /26 | 4 | 64 | 62 | | /27 | 8 | 32 | 30 | | /28 | 16 | 16 | 14 | | /29 | 32 | 8 | 6 | | /30 | 64 | 4 | 2 | | /31 | 128 | 2 | 2 (RFC 3021) | *Sources: RFC 4632 section 3.1 table, RFC 3021; usable hosts derived as addresses minus two, except /31 (RFC 3021)* A home /24 leaves room for 254 devices, and the [smart home statistics](https://sqmagazine.co.uk/smart-home-statistics/) show how many connected devices a household now runs. ## Private, Public and Special-Purpose IPv4 Addresses The “Address type” column matches the address against **13** fixed blocks under nine labels and calls everything else Public. Every block it names except multicast, 224.0.0.0 to 239.255.255.255, has a row in the [IPv4 Special-Purpose Address Space registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml), and the rows for Private-Use, Shared Address Space, Loopback, Link Local, Documentation (TEST-NET-1) and Benchmarking all carry a Globally Reachable value of False. So those six labels mark blocks the public internet is not expected to route, while a Public label proves nothing about routing either way. The standards behind each label: [RFC 1918](https://www.rfc-editor.org/rfc/rfc1918) reserves 10.0.0.0 – 10.255.255.255 (10/8 prefix), 172.16.0.0 – 172.31.255.255 (172.16/12 prefix) and the 192.168/16 block for private internets. [RFC 6598](https://www.rfc-editor.org/rfc/rfc6598) sets aside the Shared Address Space for Carrier-Grade NAT and says it is distinct from RFC 1918 private address space because it is intended for use on Service Provider networks. Loopback addresses MUST NOT appear outside a host, per RFC 1122. Link-local addresses in [RFC 3927](https://www.rfc-editor.org/rfc/rfc3927)‘s 169.254/16 prefix are not suitable for communication with devices not directly connected to the same physical (or logical) link. The fourth preset reads Documentation because [RFC 5737](https://www.rfc-editor.org/rfc/rfc5737) provides 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) for that purpose. | Tool label | Blocks the tool checks | Registry entry | Globally Reachable | |---|---|---|---| | Private (RFC 1918) | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | Private-Use, RFC 1918 | False | | Shared address space (CGNAT) | 100.64.0.0/10 | Shared Address Space, RFC 6598 | False | | Loopback | 127.0.0.0/8 | Loopback, RFC 1122 | False | | Link-local | 169.254.0.0/16 | Link Local, RFC 3927 | False | | Documentation (RFC 5737) | 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Documentation (TEST-NET-1, 2, 3), RFC 5737 | False | | Benchmarking (RFC 2544) | 198.18.0.0/15 | Benchmarking, [RFC 2544](https://www.rfc-editor.org/rfc/rfc2544) test ports 198.18.1.0 to 198.18.64.0 and 198.19.1.0 to 198.19.64.0 | False | | IETF protocol assignments | 192.0.0.0/24 | IETF Protocol Assignments, RFC 6890 | False for the /24 row; 192.0.0.9/32 and 192.0.0.10/32 inside it read True | | This network (reserved) | 0.0.0.0/8 | “This network”, RFC 791 | False | | Multicast or reserved | first octet 224 or above | Reserved 240.0.0.0/4 (RFC 1112) and Limited Broadcast 255.255.255.255/32 (RFC 919); multicast itself is defined by RFC 1112 | False for 240.0.0.0/4 and 255.255.255.255/32; multicast, 224.0.0.0/4, has no row in this registry | *Sources: IANA IPv4 Special-Purpose Address Space registry, RFC 1918, RFC 6598, RFC 1122, RFC 3927, RFC 5737, RFC 2544, RFC 1112, RFC 919* The lookup is shorter than the registry. 192.88.99.0/24 Deprecated (6to4 Relay Anycast), 192.31.196.0/24 AS112-v4 and 192.52.193.0/24 AMT are registry rows the tool does not label, so an address inside them reads Public. The [remote work cybersecurity statistics](https://sqmagazine.co.uk/remote-work-cybersecurity-statistics/) cover VPN use on hotspot and home links. ## IP Address Classes vs CIDR [RFC 791](https://www.rfc-editor.org/rfc/rfc791) defined the classes by the high-order bits of an address, saying that in class a, the high order bit is zero, the next 7 bits are the network, and the last 24 bits are the local address, while in class b, the high order two bits are one-zero, the next 14 bits are the network and the last 16 bits are the local address. Class c starts one-one-zero, and the next **21** bits are the network and the last 8 bits are the local address. [RFC 1112](https://www.rfc-editor.org/rfc/rfc1112) added class D IP addresses, i.e., those with “1110” as their high-order four bits for multicast groups, which run from 224.0.0.0 to 239.255.255.255, and class E, reserved for future addressing modes. The tool prints those two as “D (multicast)” and “E (reserved)”. Classes no longer decide routing. [RFC 4632](https://www.rfc-editor.org/rfc/rfc4632) records that the community chose to deprecate the Class A/B/C network address assignment system in favor of using “classless”, hierarchical blocks of IP addresses (referred to as prefixes). The legacy Class B network 172.16.0.0 became the prefix 172.16.0.0/16, and the legacy Class C network 192.168.99.0 became 192.168.99.0/24. The class column is a label from that history; the prefix is what routers use. ## Wildcard Mask vs Subnet Mask A wildcard mask is the subnet mask with all **32** bits flipped, so 255.255.255.0 becomes 0.0.0.255. Cisco’s access-list documentation explains the two readings: interfaces use a subnet mask that starts with larger values (255s) on the left, while ACLs use a wildcard mask (also called an inverse mask), which works in the opposite way. In that reading, each 0 in the wildcard mask means, this bit must match exactly, and each 1 means, this bit can be ignored. So the 0.0.0.255 in the result says: match the three left-hand octets of the network exactly, and accept any value in the last one. ## Why Use an IP Subnet Calculator? A subnet calculator removes the binary arithmetic and the two exceptions people forget, /31 and /32, and it shows every boundary of a block at once. Amazon’s VPC guide points its own readers to one: “There are tools available on the internet to help you calculate and create IPv4 and IPv6 subnet CIDR blocks.” It suggests searching for terms such as ‘subnet calculator’ or ‘CIDR calculator’. ## Is there anything else my agent or I should know about this page? Yes. The calculator handles IPv4 only, does arithmetic on the address and prefix you enter, and reaches no network: it does not ping, scan or look anything up, and nothing you enter reaches our server. The “Address class” column is historical. The CIDR specification chose to deprecate the Class A/B/C network address assignment system, so the letter describes the high-order bits of the address, not how it is routed. The “Address type” column is a lookup against 13 fixed blocks under nine labels, so a registry block outside them displays as Public. A /31 shows two usable hosts because, on a point-to-point link, both addresses MUST be interpreted as host addresses, and a /32 is a single address. The tool does not plan variable-length subnets, split a block or handle IPv6. SQ Magazine publishes the page for information. An address plan is arithmetic; it helps you lay out a network and promises no security outcome. ## Conclusion For 192.168.1.10/24, the IP subnet calculator returns a network of 192.168.1.0/24, a broadcast address of 192.168.1.255 and **254** usable hosts from 192.168.1.1 to 192.168.1.254. Enter your own block next. A Private, Shared, Loopback, Link-local, Documentation or Benchmarking type marks a block the registry flags as not globally reachable; a Public type proves nothing about routing. If the block you planned sits behind a tunnel, the [VPN statistics](https://sqmagazine.co.uk/vpn-statistics/) cover how common that setup has become. ## More Network Tools [All network tools (3) →](https://sqmagazine.co.uk/network-tools/) - [ Your IP Edge lookup Live Detected the moment you open it Network At the network edge What Is My IP Address Your public IP, provider and location, read at the edge. IPv4 and IPv6Provider, ASN and time zone → ](https://sqmagazine.co.uk/what-is-my-ip/) - [ Download time 50 GB at 300 Mbps 24m 41s DSL 10 Mbps 12h 20m 44sFiber 1 Gbps 7m 24s Security In your browser Download Time Calculator How long a file takes at your connection speed. 270 MbpsEffective speed → ](https://sqmagazine.co.uk/download-time-calculator/) - [ SPF record Example: example.com v=spf1 -all DMARC: p=reject Network Public DNS lookup TXT Record Lookup TXT, SPF and DMARC records for any domain. SPF and DMARC read outAny public domain → ](https://sqmagazine.co.uk/txt-record-lookup/)