Internet Protocol version 4 (IPv4) Subnet Calculator

Subnet Brief

{{ analysis.network }}/{{ analysis.prefix }}

IPv4 seed:

Use CIDR or dotted mask, e.g. 10.0.12.8/21 or 10.0.12.8 255.255.248.0.

Prefix length: /{{ prefixControl }}

Tune /0-/32 for what-if sizing, or return to Auto to parse the seed notation.

bits

/0 all IPv4 {{ prefixOverrideStatus }} /32 host

Host target:

Optional positive whole number of usable hosts, e.g. 80.

Split demand list:

Enter up to 32 host counts separated by commas, spaces, or semicolons: 120, 60, 30.

Host probe index:

Use 0 for first usable host; /31 and /32 treat endpoint offsets as usable.

Host window focus:

Start shows low hosts, Around uses the probe, End jumps to the tail of the range.

Host window size:

Pick 16-256 rows; All usable hosts still stops at 4,096 rows.

Growth reserve: {{ reserve_percent }}%

Set 0-40%; applies only to Host target and Split demand list.

Split ordering:

Largest-first usually packs best; Keep entered order follows your demand list.

Metric	Value	Copy
{{ row.key }}	{{ row.value }}

Offset	Address	Role	Copy
{{ row.row }}	{{ row.address }}	{{ row.role }}

Prefix	Mask	Wildcard	Total	Usable	Relative size	Host target fit	Copy
{{ row.prefix }}	{{ row.mask }}	{{ row.wildcard }}	{{ row.totalAddresses }}	{{ row.usableHosts }}	{{ row.relativeSize }}	{{ row.fitLabel }}

#	Demand	Planned	Capacity	CIDR	First	Last	Broadcast	Waste	Status	Copy
{{ row.order }}	{{ row.requestedDisplay }}	{{ row.plannedDisplay }}	{{ row.capacityDisplay }}	{{ row.cidr }}	{{ row.firstHost }}	{{ row.lastHost }}	{{ row.broadcast }}	{{ row.wasteDisplay }}	{{ row.status }}
No split plan is active Add host counts in Split demand list to generate VLSM child subnet rows.

Topic	Value	Copy
{{ row.key }}	{{ row.value }}

Embed:

Customize

Include current inputs

Size

Advanced

Width

Height

Aspect ratio

Max height

Collapsible embed

Allow fullscreen

Referrer policy

Sandbox tokens

IPv4 subnetting is the arithmetic behind a large share of everyday network work. It decides where a routed block begins, where it ends, how many addresses can be assigned, and which values should be kept for the network and broadcast edges. The same calculation shows up when a router interface is configured, a DHCP scope is sized, a firewall rule uses a wildcard mask, or an address plan is split for several VLANs.

Common IPv4 subnet planning questions and the subnet facts they depend on
Network question	Subnet fact that answers it
Can this address live behind the same gateway?	The normalized CIDR block, first host, last host, and broadcast address.
Is there enough room for a new site, VLAN, or pool?	Usable-host capacity after the prefix length and edge-address rules are applied.
Will an access-list or route summary match the intended addresses?	The subnet mask, wildcard mask, and binary boundary between network and host bits.
Can one parent range be split without overlap?	Aligned child CIDR blocks sized from each requested host count.

A subnet is written as a 32-bit IPv4 address plus a prefix length. In 192.168.14.99/26, the /26 says that the first 26 bits are the network portion and the remaining 6 bits are host space. A dotted subnet mask such as 255.255.255.192 describes the same boundary when its one bits are contiguous. Once that boundary is known, the network address is the first value in the block and the broadcast address is the last value in ordinary IPv4 subnets.

IPv4 CIDR diagram showing a 32-bit address split into network bits and host bits, with network, first host, last host, and broadcast markers.

Subnet planning is easy to misread because the address typed into a form is often only a seed. The host address 10.0.12.8/21 may sit inside a block that begins at 10.0.8.0/21. The typed address, the normalized network, and the assignable host range are related, but they are not interchangeable. That distinction matters before copying a gateway address, summarizing a route, or deciding whether a firewall object covers the right devices.

Prefix length changes the block size. Moving from /24 to /25 halves the address block; moving from /24 to /23 doubles it.
Usable-host counts are not always total minus two. Ordinary subnets through /30 reserve network and broadcast values, while /31 and /32 have endpoint-specific meanings.
Special-use ranges still follow the same math. Private, loopback, link-local, documentation, multicast, and reserved address blocks can be calculated, but their routing purpose is different.
Variable-length subnet masking needs alignment. Child ranges must begin on binary boundaries, so the order of requested sizes can affect whether all child blocks fit.

The calculation can prove a CIDR boundary, capacity, wildcard mask, and split layout. It cannot prove that a live network is unused, delegated, routed, or safe to announce. Before deployment, compare the result with IPAM records, DHCP exclusions, router summaries, firewall objects, and change history.

How to Use This Tool:

Start with the address notation from the ticket, router config, or design note. The calculator accepts CIDR, an IPv4 address followed by a dotted subnet mask, or a bare IPv4 address that you can test with the prefix control.

Enter the starting value in IPv4 seed. Use 10.0.12.8/21 for slash notation or 10.0.12.8 255.255.248.0 for dotted-mask notation.
Check Prefix length. Auto follows the prefix or contiguous dotted mask in the seed. Move the number field or slider for a what-if prefix, and press Auto to return to the parsed seed.
If an error appears, fix the exact input rule first. CIDR prefixes must be from /0 to /32, IPv4 octets must be 0-255, and dotted masks must have contiguous network bits.
Use Deploy Brief for the main handoff values: CIDR, Subnet mask, Wildcard mask, First host, Last host, Broadcast, Total addresses, Usable hosts, Address type, and nearby subnet values.
Set Host target and Growth reserve when capacity is the question. Fit verdict, Smallest fitting prefix, and Prefix Ladder show whether the current block covers the reserve-adjusted load.
Use Host probe index, Host window focus, and Host window size to inspect a small slice of a large subnet. Probe index 0 means the first usable host in ordinary subnets; /31 and /32 use endpoint offsets instead.
Add positive host counts in Split demand list to build a VLSM child plan. Choose Split ordering for largest-first packing, smallest-first review, or entered-order rollout, then check Split Plan and Split Utilization Stack for allocated or blocked rows.

Interpreting Results:

Trust the normalized CIDR before reading any capacity or split decision. If the First host, Last host, or Broadcast value does not match the network you intended, the later rows are describing a different block.

IPv4 subnet result interpretation guide
Result area	What to trust	What to double-check
Deploy Brief	The normalized block, masks, host range, and address category.	Compare gateway, DHCP pool, and ACL values against the first and last usable hosts.
Prefix Ladder	Nearby prefix sizes, wildcard masks, total addresses, and usable-host counts.	Use Host target fit, not raw address count alone, when a reserve was entered.
Host Window	A sampled view of usable addresses near the start, end, or probe offset.	Large subnets are intentionally sampled; do not mistake hidden rows for unavailable addresses.
Split Plan	Whether reserve-adjusted child demands fit inside the current parent block.	Allocated means mathematically placed, not confirmed unused in production.
Address Math	Binary, hexadecimal, integer span, and ACL wildcard representations.	Confirm your firewall or router syntax before pasting a wildcard line.

Address type is a warning label, not a reachability test. Private, CGNAT, Loopback, Link-local, Test net, Multicast, and Reserved labels describe special-purpose meaning. Public / unclassified address space only means the seed did not match the built-in special-use list; it does not prove ownership, routing, or permission to use the range.

Technical Details:

IPv4 subnet math treats an address as a 32-bit unsigned integer. The prefix length p determines how many leading bits must stay fixed for the network. The remaining 32 - p bits form the host portion, which is why every one-bit prefix change doubles or halves the address block.

The subnet mask has ones in the network portion and zeros in the host portion. The wildcard mask is the bitwise inverse of the subnet mask, so it marks which bits can vary inside the block. Network and broadcast boundaries come from clearing or setting all host bits, not from the decimal dots in the printed address.

Formula Core

The boundary calculation is fixed once the IPv4 address and prefix length are known.

\begin{array}{lcl} HostBits & = & 32 - p \\ Total & = & 2^{HostBits} \\ Network & = & IP bitwise AND Mask \\ Wildcard & = & 32-bit inverse of Mask \\ Broadcast & = & Network bitwise OR Wildcard \end{array}

For 192.168.14.99/26, the mask is 255.255.255.192. Clearing the six host bits gives network 192.168.14.64. Setting those six host bits gives broadcast 192.168.14.127. The block has 64 total addresses and, under ordinary subnet rules, 62 usable hosts from 192.168.14.65 through 192.168.14.126.

IPv4 usable-host rules by prefix edge case
Prefix case	Total addresses	Usable-host rule	Planning meaning
`/0` through `/30`	`2^(32 - p)`	Subtract the network and broadcast addresses.	Ordinary IPv4 subnet model for routed or switched host pools.
`/31`	2	Both addresses are usable endpoints.	Point-to-point link prefix described by RFC 3021.
`/32`	1	The single address is the endpoint.	Host route, loopback address, or exact host target.

Input and Validation Rules

Good subnet output depends on rejecting ambiguous notation before the bit math begins.

Input validation rules used for IPv4 subnet calculations
Input	Accepted values	Important behavior
IPv4 seed	CIDR, address plus dotted mask, or a bare IPv4 address.	A bare address uses `/24` unless Prefix length is overriding it.
Prefix length	Whole number from 0 to 32.	An override changes the effective prefix even when the seed contains CIDR or a dotted mask.
Dotted subnet mask	Four IPv4 octets whose binary bits are contiguous ones followed by contiguous zeros.	Non-contiguous masks are rejected instead of guessed.
Host target	Optional positive whole number.	The reserve percentage is added and rounded up before the fit check.
Split demand list	Up to 32 positive whole numbers separated by commas, spaces, or semicolons.	Extra valid requests after the first 32 are ignored and reported in the split summary.
Host window size	16, 32, 64, 128, 256, or all usable hosts.	All usable hosts is capped at 4,096 rows so very large subnets stay usable.

VLSM Split Rules

Variable-length subnet masking fits different child prefixes inside one parent block. Each demand is increased by the selected reserve percentage, rounded up, converted to the smallest prefix with enough usable-host capacity, and placed on the next valid binary boundary inside the parent.

VLSM child subnet planning rules
Stage	Rule	Output fields to check
Demand sizing	Planned equals requested hosts plus reserve, rounded up.	Demand, Planned
Prefix choice	The chosen child prefix is the smallest standard block whose usable capacity covers Planned.	Capacity, CIDR
Alignment	Each child begins at the next natural boundary for its block size.	First, Last, Broadcast
Blocked demand	A row fails when it needs a larger parent or aligned space has run out.	Status, Waste

Special-Use Address Context

Special-use labels help prevent arithmetic from being mistaken for routing approval. A range can have valid CIDR boundaries while still being inappropriate for ordinary host addressing.

Selected IPv4 special-use ranges relevant to subnet planning
Range	Displayed context
`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`	RFC 1918 private address space for internal networks.
`100.64.0.0/10`	Shared carrier-grade NAT space, not ordinary private LAN space.
`127.0.0.0/8` and `169.254.0.0/16`	Loopback and link-local ranges with limited forwarding meaning.
`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`	Documentation-only TEST-NET ranges.
`224.0.0.0/4` and `240.0.0.0/4`	Multicast and reserved address space rather than normal host pools.

Limitations and Privacy:

Subnet arithmetic is deterministic, but network readiness is not. Use the calculated values as an address-plan check and verify live ownership, routing, policy, and allocation records separately.

Calculations run in the browser; there is no remote subnet lookup for entered addresses.
A copied result link can include the entered values in the page URL, so avoid sharing sensitive internal addressing scenarios in public channels.
Browser requests for normal page assets may still occur when the page loads, but the subnet result itself is calculated locally.
Address type labels come from built-in special-use checks and do not prove whether a range is announced, delegated, or blocked by policy.

Worked Examples:

Checking a handoff subnet

Enter 192.168.14.99/26. Deploy Brief reports CIDR as 192.168.14.64/26, Subnet mask as 255.255.255.192, First host as 192.168.14.65, Last host as 192.168.14.126, Broadcast as 192.168.14.127, and Usable hosts as 62. A proposed gateway such as 192.168.14.130 is outside that range.

Reading a point-to-point prefix

Enter 203.0.113.10/31. Host Window shows two usable endpoints, 203.0.113.10 and 203.0.113.11, instead of subtracting network and broadcast addresses. Address type marks the seed as TEST-NET-3 203.0.113.0/24, so the example is suitable for documentation but not production addressing.

Sizing a reserve-adjusted split plan

Enter 10.0.8.0/24, set Split demand list to 60, 30, 12, keep Growth reserve at 10%, and leave Split ordering as largest to smallest. Split Plan raises the planned demands to 66, 33, and 14 usable hosts, then allocates 10.0.8.0/25, 10.0.8.128/26, and 10.0.8.192/28. If a later row says Insufficient address space, choose a larger parent block, reduce demand, or revisit the ordering.

Fixing an invalid mask

Entering 10.0.0.5 255.0.255.0 fails because the dotted mask does not have contiguous network bits. Replace it with a valid mask such as 255.255.0.0 or use slash notation such as 10.0.0.5/16, then confirm the corrected CIDR and Wildcard mask.

FAQ:

Why did my typed IPv4 address change in the CIDR result?

The typed value is a seed address. CIDR reports the network boundary for the selected prefix, so 192.168.14.99/26 becomes 192.168.14.64/26.

Why does a /31 show two usable addresses?

A /31 is treated as a point-to-point prefix. Both addresses can be endpoints, so the ordinary network-and-broadcast subtraction is not used.

What happens if I enter only an IPv4 address?

A bare address uses /24 unless Prefix length has an active override. Confirm the real prefix before treating the result as a final plan.

Can I use any dotted subnet mask?

No. The dotted mask must have contiguous network bits. Non-contiguous masks are rejected so the calculator does not guess an ambiguous prefix.

Why does largest-first split ordering often fit better?

Large child blocks have fewer valid alignment positions. Allocating them first often leaves smaller gaps that later, smaller demands can still use.

Does Public / unclassified mean the range is safe to use?

No. It only means the seed did not match the built-in special-use list. Ownership, routing, upstream filtering, and change approval still need separate checks.

Do subnet values leave the browser?

The subnet calculation runs in the browser. The main sharing caution is the page URL: copied result links can include the entered scenario.

Glossary:

CIDR: Classless Inter-Domain Routing notation, written as an IPv4 address plus a slash prefix.
Prefix length: The slash number that says how many leading IPv4 bits belong to the network portion.
Subnet mask: The dotted-decimal mask whose one bits mark the network portion of the IPv4 address.
Wildcard mask: The inverse of the subnet mask, often used in access-control matching.
Usable hosts: Addresses assignable to endpoints under the prefix rules for the current block.
VLSM: Variable-length subnet masking, where child subnets inside one parent use different prefix sizes.
Host probe: A 0-based usable-host offset used to inspect a specific address inside the subnet.

References:

RFC 4632: Classless Inter-domain Routing (CIDR), RFC Editor, August 2006.
RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links, RFC Editor, December 2000.
RFC 1918: Address Allocation for Private Internets, RFC Editor, February 1996.
RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space, RFC Editor, April 2012.
RFC 5737: IPv4 Address Blocks Reserved for Documentation, RFC Editor, January 2010.
IPv4 Special-Purpose Address Space Registry, IANA.