Internet Protocol version 4 (IPv4) Subnet Calculator

IPv4 seed:

Use CIDR or dotted mask, e.g. 10.0.12.8/21 or 10.0.12.8 255.255.248.0.

Prefix length: /{{ prefixControl }}

Tune /0-/32 for what-if sizing, or return to Auto to parse the seed notation.

bits

/0 all IPv4 {{ prefixOverrideStatus }} /32 host

Host target:

Optional positive whole number of usable hosts, e.g. 80.

Split demand list:

Enter up to 32 host counts separated by commas, spaces, or semicolons: 120, 60, 30.

Host probe index:

Use 0 for first usable host; /31 and /32 treat endpoint offsets as usable.

Host window focus:

Start shows low hosts, Around uses the probe, End jumps to the tail of the range.

Host window size:

Pick 16-256 rows; All usable hosts still stops at 4,096 rows.

Growth reserve: {{ reserve_percent }}%

Set 0-40%; applies only to Host target and Split demand list.

Split ordering:

Largest-first usually packs best; Keep entered order follows your demand list.

Metric	Value	Copy
{{ row.key }}	{{ row.value }}

Offset	Address	Role	Copy
{{ row.row }}	{{ row.address }}	{{ row.role }}

Prefix	Mask	Wildcard	Total	Usable	Relative size	Host target fit	Copy
{{ row.prefix }}	{{ row.mask }}	{{ row.wildcard }}	{{ row.totalAddresses }}	{{ row.usableHosts }}	{{ row.relativeSize }}	{{ row.fitLabel }}

#	Demand	Planned	Capacity	CIDR	First	Last	Broadcast	Waste	Status	Copy
{{ row.order }}	{{ row.requestedDisplay }}	{{ row.plannedDisplay }}	{{ row.capacityDisplay }}	{{ row.cidr }}	{{ row.firstHost }}	{{ row.lastHost }}	{{ row.broadcast }}	{{ row.wasteDisplay }}	{{ row.status }}
No split plan is active Add host counts in Split demand list to generate VLSM child subnet rows.

Topic	Value	Copy
{{ row.key }}	{{ row.value }}

Embed:

Customize

Include current inputs

Size

Advanced

Width

Height

Aspect ratio

Max height

Collapsible embed

Allow fullscreen

Referrer policy

Sandbox tokens

IPv4 subnetting turns a dotted address into a bounded range of 32-bit values. A route, gateway, DHCP scope, firewall rule, or access list is only as accurate as the boundary behind it, because the boundary decides which addresses are inside the same network and which addresses are outside it.

The compact form for that boundary is CIDR notation. A value such as 192.168.14.99/26 is not a promise that the network starts at .99; it says that the first 26 bits are fixed and the remaining 6 bits vary. Masking the host bits reveals the actual network address, while setting those same host bits reveals the broadcast edge for ordinary IPv4 subnets.

Common IPv4 subnet planning questions and the subnet facts they depend on
Planning question	Subnet fact that usually answers it
Is this host in the intended local range?	The normalized network, prefix length, first host, and last host.
Will the range fit a VLAN, site, or pool?	The usable-host count after network, broadcast, /31, and /32 rules are applied.
Will a route or ACL match the right span?	The subnet mask, wildcard mask, integer span, and binary network/host split.
Can several requested pools fit without overlap?	Aligned child CIDR blocks sized from reserve-adjusted host counts.

Dotted subnet masks and wildcard masks are alternate views of the same bit boundary. A valid subnet mask contains contiguous one bits followed by contiguous zero bits, such as 255.255.255.192 for /26. The wildcard mask flips those bits, so the same /26 becomes 0.0.0.63. That inverse form is common in router and firewall syntax because it names the variable bits rather than the fixed bits.

IPv4 CIDR diagram showing a 32-bit address split into network bits and host bits, with network, first host, last host, and broadcast markers.

The most common subnet mistake is treating a sample host address as the network address. 10.0.12.8/21 belongs to 10.0.8.0/21, so a gateway, DHCP pool, or firewall object copied from the typed address can drift outside the intended block. A second mistake is counting every address as assignable. In ordinary subnets, the edge values name the network and broadcast, while /31 and /32 use endpoint-specific rules.

One prefix bit changes capacity fast. Moving from /24 to /25 halves the block; moving from /24 to /23 doubles it.
Masks must be contiguous. A dotted mask with mixed one and zero runs is ambiguous for CIDR-style planning and should be rejected, not interpreted by guesswork.
Special-use ranges still calculate cleanly. Private, CGNAT, loopback, link-local, documentation, multicast, benchmark, and reserved ranges have valid boundaries, but their deployment meanings differ.
VLSM planning depends on alignment. Different-size child blocks must start on natural binary boundaries, so placing the largest requests first usually wastes less space.

Subnet arithmetic can prove a CIDR boundary, host capacity, wildcard mask, and mathematical split layout. It cannot prove that a live network is unused, delegated, routed, reachable, or safe to announce. Treat the numbers as an address-plan check, then compare the range with IPAM records, DHCP exclusions, router summaries, firewall objects, and change history before deployment.

How to Use This Tool:

Start with the notation from the ticket, router config, spreadsheet, or design note. The calculator accepts CIDR, an IPv4 address followed by a dotted subnet mask, or a bare IPv4 address that can be tested with the prefix control.

Enter the starting value in IPv4 seed. Use 10.0.12.8/21 for slash notation or 10.0.12.8 255.255.248.0 for dotted-mask notation.
Check Prefix length. Auto follows the prefix or contiguous dotted mask in the seed. Move the number field or slider for a what-if prefix, and press Auto to return to the parsed seed.
If an error appears, fix the exact input rule first. CIDR prefixes must be from /0 to /32, IPv4 octets must be 0-255, and dotted masks must have contiguous network bits.
Use Deploy Brief for the main handoff values: CIDR, Subnet mask, Wildcard mask, First host, Last host, Broadcast, Total addresses, Usable hosts, Address type, and nearby subnet values.
Set Host target and Growth reserve when capacity is the question. Fit verdict, Smallest fitting prefix, and Prefix Ladder show whether the current block covers the reserve-adjusted load.
Use Host probe index, Host window focus, and Host window size to inspect a small slice of a large subnet. Probe index 0 means the first usable host in ordinary subnets; /31 and /32 use endpoint offsets instead.
Add positive host counts in Split demand list to build a VLSM child plan. Choose Split ordering for largest-first packing, smallest-first review, or entered-order rollout, then check Split Plan and Split Utilization Stack for allocated or blocked rows.

Interpreting Results:

Read the normalized CIDR first. If the First host, Last host, or Broadcast value does not describe the network you meant to review, the capacity verdict, host window, and split rows are all describing a different block.

IPv4 subnet result interpretation guide
Result area	What to trust	What to double-check
Deploy Brief	The normalized block, masks, host range, and address category.	Compare gateway, DHCP pool, and ACL values against the first and last usable hosts.
Prefix Ladder	Nearby prefix sizes, wildcard masks, total addresses, and usable-host counts.	Use Host target fit, not raw address count alone, when a reserve was entered.
Host Window	A sampled view of usable addresses near the start, end, or probe offset.	Large subnets are intentionally sampled; do not mistake hidden rows for unavailable addresses.
Split Plan	Whether reserve-adjusted child demands fit inside the current parent block.	Allocated means mathematically placed, not confirmed unused in production.
Address Math	Binary, hexadecimal, integer span, and ACL wildcard representations.	Confirm your firewall or router syntax before pasting a wildcard line.

Address type is a context label, not a reachability test. Private, CGNAT, Loopback, Link-local, Test net, Multicast, Benchmark, and Reserved labels describe special-purpose meaning. Public / unclassified address space only means the seed did not match the built-in special-use list; it does not prove ownership, routing, or permission to use the range.

Technical Details:

IPv4 subnet math treats an address as a 32-bit unsigned integer. The prefix length p determines how many leading bits must stay fixed for the network. The remaining 32 - p bits form the host portion, so each one-bit prefix change doubles or halves the address block.

Network and broadcast boundaries come from clearing or setting host bits, not from the decimal dots in the printed address. That is why a host inside the range can normalize to a different first address. The subnet mask keeps the fixed bits, the wildcard mask marks the varying bits, and the integer span gives the exact inclusive range.

Formula Core

The boundary calculation is fixed once the IPv4 address and prefix length are known.

\begin{array}{lcl} HostBits & = & 32 - p \\ Total & = & 2^{HostBits} \\ Network & = & IP bitwise AND Mask \\ Wildcard & = & 32-bit inverse of Mask \\ Broadcast & = & Network bitwise OR Wildcard \end{array}

For 192.168.14.99/26, the mask is 255.255.255.192. Clearing the six host bits gives network 192.168.14.64. Setting those six host bits gives broadcast 192.168.14.127. The block has 64 total addresses and, under ordinary subnet rules, 62 usable hosts from 192.168.14.65 through 192.168.14.126.

IPv4 usable-host rules by prefix edge case
Prefix case	Total addresses	Usable-host rule	Planning meaning
`/0` through `/30`	`2^(32 - p)`	Subtract the network and broadcast addresses.	Ordinary IPv4 subnet model for routed or switched host pools.
`/31`	2	Both addresses are usable endpoints.	Point-to-point link prefix described by RFC 3021.
`/32`	1	The single address is the endpoint.	Host route, loopback address, or exact host target.

Input and Validation Rules

Good subnet output depends on rejecting ambiguous notation before the bit math begins.

Input validation rules used for IPv4 subnet calculations
Input	Accepted values	Important behavior
IPv4 seed	CIDR, address plus dotted mask, or a bare IPv4 address.	A bare address uses `/24` unless Prefix length is overriding it.
Prefix length	Whole number from 0 to 32.	An override changes the effective prefix even when the seed contains CIDR or a dotted mask.
Dotted subnet mask	Four IPv4 octets whose binary bits are contiguous ones followed by contiguous zeros.	Non-contiguous masks are rejected instead of guessed.
Host target	Optional positive whole number.	The reserve percentage is added and rounded up before the fit check.
Split demand list	Up to 32 positive whole numbers separated by commas, spaces, or semicolons.	Extra valid requests after the first 32 are ignored and reported in the split summary.
Host window size	16, 32, 64, 128, 256, or all usable hosts.	All usable hosts is capped at 4,096 rows so very large subnets stay usable.

VLSM Split Rules

Variable-length subnet masking fits different child prefixes inside one parent block. Each demand is increased by the selected reserve percentage, rounded up, converted to the smallest prefix with enough usable-host capacity, and placed on the next valid binary boundary inside the parent. A demand that needs a prefix larger than the parent, or that reaches beyond the parent after alignment, is blocked rather than overlapped.

VLSM child subnet planning rules
Stage	Rule	Output fields to check
Demand sizing	Planned equals requested hosts plus reserve, rounded up.	Demand, Planned
Prefix choice	The chosen child prefix is the smallest standard block whose usable capacity covers Planned.	Capacity, CIDR
Alignment	Each child begins at the next natural boundary for its block size.	First, Last, Broadcast
Blocked demand	A row fails when it needs a larger parent or aligned space has run out.	Status, Waste

Special-Use Address Context

Special-use labels help prevent arithmetic from being mistaken for routing approval. A range can have valid CIDR boundaries while still being inappropriate for ordinary host addressing.

Selected IPv4 special-use ranges relevant to subnet planning
Range	Displayed context
`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`	RFC 1918 private address space for internal networks.
`100.64.0.0/10`	Shared carrier-grade NAT space, not ordinary private LAN space.
`127.0.0.0/8` and `169.254.0.0/16`	Loopback and link-local ranges with limited forwarding meaning.
`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`	Documentation-only TEST-NET ranges.
`224.0.0.0/4` and `240.0.0.0/4`	Multicast and reserved address space rather than normal host pools.

Limitations and Privacy:

Subnet arithmetic is deterministic, but network readiness is not. Use the calculated values as an address-plan check and verify live ownership, routing, policy, and allocation records separately.

Calculations run in the browser; there is no remote subnet lookup for entered addresses.
A copied result link can include the entered values in the page URL, so avoid sharing sensitive internal addressing scenarios in public channels.
Browser requests for normal page assets may still occur when the page loads, but the subnet result itself is calculated locally.
Address type labels come from built-in special-use checks and do not prove whether a range is announced, delegated, or blocked by policy.

Worked Examples:

Checking a handoff subnet

Enter 192.168.14.99/26. Deploy Brief reports CIDR as 192.168.14.64/26, Subnet mask as 255.255.255.192, First host as 192.168.14.65, Last host as 192.168.14.126, Broadcast as 192.168.14.127, and Usable hosts as 62. A proposed gateway such as 192.168.14.130 is outside that range.

Reading a point-to-point prefix

Enter 203.0.113.10/31. Host Window shows two usable endpoints, 203.0.113.10 and 203.0.113.11, instead of subtracting network and broadcast addresses. Address type marks the seed as TEST-NET-3 203.0.113.0/24, so the example is suitable for documentation but not production addressing.

Sizing a reserve-adjusted split plan

Enter 10.0.8.0/24, set Split demand list to 60, 30, 12, keep Growth reserve at 10%, and leave Split ordering as largest to smallest. Split Plan raises the planned demands to 66, 33, and 14 usable hosts, then allocates 10.0.8.0/25, 10.0.8.128/26, and 10.0.8.192/28. If a later row says Insufficient address space, choose a larger parent block, reduce demand, or revisit the ordering.

Fixing an invalid mask

Entering 10.0.0.5 255.0.255.0 fails because the dotted mask does not have contiguous network bits. Replace it with a valid mask such as 255.255.0.0 or use slash notation such as 10.0.0.5/16, then confirm the corrected CIDR and Wildcard mask.

FAQ:

Why did my typed IPv4 address change in the CIDR result?

The typed value is a seed address. CIDR reports the network boundary for the selected prefix, so 192.168.14.99/26 becomes 192.168.14.64/26.

Why does a /31 show two usable addresses?

A /31 is treated as a point-to-point prefix. Both addresses can be endpoints, so the ordinary network-and-broadcast subtraction is not used.

What happens if I enter only an IPv4 address?

A bare address uses /24 unless Prefix length has an active override. Confirm the real prefix before treating the result as a final plan.

Can I use any dotted subnet mask?

No. The dotted mask must have contiguous network bits. Non-contiguous masks are rejected so the calculator does not guess an ambiguous prefix.

Why does largest-first split ordering often fit better?

Large child blocks have fewer valid alignment positions. Allocating them first often leaves smaller gaps that later, smaller demands can still use.

Does Public / unclassified mean the range is safe to use?

No. It only means the seed did not match the built-in special-use list. Ownership, routing, upstream filtering, and change approval still need separate checks.

Do subnet values leave the browser?

The subnet calculation runs in the browser. The main sharing caution is the page URL: copied result links can include the entered scenario.

Glossary:

CIDR: Classless Inter-Domain Routing notation, written as an IPv4 address plus a slash prefix.
Prefix length: The slash number that says how many leading IPv4 bits belong to the network portion.
Subnet mask: The dotted-decimal mask whose one bits mark the network portion of the IPv4 address.
Wildcard mask: The inverse of the subnet mask, often used in access-control matching.
Usable hosts: Addresses assignable to endpoints under the prefix rules for the current block.
VLSM: Variable-length subnet masking, where child subnets inside one parent use different prefix sizes.
Host probe: A 0-based usable-host offset used to inspect a specific address inside the subnet.

References:

RFC 4632: Classless Inter-domain Routing (CIDR), RFC Editor, August 2006.
RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links, RFC Editor, December 2000.
RFC 1918: Address Allocation for Private Internets, RFC Editor, February 1996.
RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space, RFC Editor, April 2012.
RFC 5737: IPv4 Address Blocks Reserved for Documentation, RFC Editor, January 2010.
IPv4 Special-Purpose Address Space Registry, IANA.