IPv4 Subnet Allocation Planner

Allocated Gap Free

{{ message }}

Parent CIDR:

Use CIDR notation such as 10.24.0.0/20; host bits are normalized to the network boundary.

Demand segments:

One line per subnet need, for example: Core services, 120, data center.

Allocation strategy:

Choose how the demand list is ordered before the planner assigns CIDR blocks.

Reservation model:

Standard reserves network and broadcast; cloud VPC reserves five addresses; point-to-point allows /31 links.

Reserve headroom: {{ reservePercentValue }}%

Use 0-90%; 15-30% is common for VLANs that are expected to grow.

0% {{ reservePercentValue }}% selected 90%

Gateway policy:

Use first usable for most VLANs, last usable for legacy networks, or none for routed-only notes.

Calculations run locally from the current fields and remain disabled until a separate enablement pass.

Smallest child subnet:

Use /30 for normal gateway-capable IPv4 LANs; /31 is only suitable for point-to-point links.

Note column:

Keep notes for handoff exports, or compact them when the ledger must stay address-only.

{{ header }}	Copy
{{ row.Metric }}	{{ row.Value }}	{{ row.Signal }}	{{ row.Detail }}

{{ header }}	Copy
{{ row[header] }}

{{ header }}	Copy
{{ row.Check }}	{{ row.Finding }}	{{ row.Impact }}	{{ row.Action }}

Embed:

Customize

Include current inputs

Size

Advanced

Width

Height

Aspect ratio

Max height

Collapsible embed

Allow fullscreen

Referrer policy

Sandbox tokens

A subnet plan is a capacity map before it is an address list. It decides which teams, VLANs, links, cloud zones, or service groups receive their own IPv4 ranges, how much growth each range can absorb, and how much of the parent block stays available for later work. The hard part is rarely writing the first CIDR. It is choosing sizes that fit today's host counts without creating awkward gaps, overlap, or renumbering pressure after the network is already in use.

IPv4 still treats every address as one value in a 32-bit space. Classless Inter-Domain Routing (CIDR) writes a block as an address plus a prefix length, such as 10.24.0.0/20. The prefix says how many leading bits identify the network. A shorter prefix leaves more host bits and therefore more addresses; a longer prefix makes a smaller child block. Variable-length subnet masking (VLSM) uses several prefix lengths inside one parent range, so a large office VLAN, a small printer subnet, and a point-to-point link do not all consume equal space.

A parent IPv4 CIDR range split into child subnets, alignment gaps, and remaining unassigned tail space

Host demand is only one part of sizing. A subnet also has total addresses, usable addresses, reserved addresses, and sometimes a gateway convention. In a normal IPv4 LAN, the network address and broadcast address are not assigned to ordinary hosts. Some point-to-point links can use a /31 with two endpoint addresses, while many cloud networks reserve extra addresses for platform functions such as routing and DNS.

Parent block: The larger CIDR range being divided, such as a branch, lab, VPC, campus, or routing-domain pool.
Demand segment: A planned child subnet requirement, usually a VLAN, application zone, link, or service network with a host count.
Reserve headroom: Extra usable host capacity added before the child prefix is chosen, so growth does not force immediate renumbering.
Alignment gap: Unused addresses skipped because the next child subnet must begin on a valid CIDR boundary.

Order matters because every child block must begin on a boundary that matches its size. Large subnets have larger block sizes and stricter start points, so placing them first often reduces skipped addresses. Preserving business order can still be useful when addresses must follow floors, racks, migration waves, or firewall-zone sequences. A good plan wastes little space while remaining easy for operations teams to read later.

A calculated allocation is still a draft. Private ranges can overlap with partner networks, documentation ranges should not appear in production, public ranges require routing authority, and provider subnet rules can be stricter than raw IPv4 arithmetic. Review the ledger against IPAM, DHCP, routing, firewall, and cloud records before provisioning.

How to Use This Tool:

Build the first pass from the parent block and demand rows, then adjust policy choices only when the ledger needs to match a real network convention.

Enter Parent CIDR in IPv4 CIDR notation, such as 10.24.0.0/20. If the typed address contains host bits, the result normalizes it to the network boundary shown in Capacity Brief.
Paste Demand segments as one line per need: name, host count, optional note. Blank lines and lines that start with # are ignored; rows with missing or non-positive host counts appear as parser notes in Fit Review.
Choose Allocation strategy. Largest host demand first is the usual VLSM starting point, Preserve pasted order keeps an operational sequence, and Smallest host demand first helps compare how early fragmentation appears.
Set Reservation model. Use Standard IPv4 LAN for ordinary subnets, Cloud VPC, five reserved when provider-reserved addresses must be included, or Point-to-point friendly when the plan is for link-style prefixes.
Adjust Reserve headroom from 0% to 90%. The planner adds this percentage to each requested host count before selecting the child prefix, so a high reserve can move a segment into a larger subnet.
Choose Gateway policy and, if needed, open Advanced to set Smallest child subnet and Note column. Keep /30 for normal gateway-capable LANs; use /31 or /32 only when your routing design supports those assignments.
Review the summary fit count, Capacity Brief, Allocation Ledger, and Fit Review. If any row is marked Overflow, increase the parent block, reduce reserve, split the segment, or compare another allocation strategy before copying the plan.

Interpreting Results:

Start with the fit count. A value such as 5/5 fit means every parsed demand row received a child subnet inside the normalized parent. A smaller numerator means at least one row overflowed after host demand, reserve headroom, prefix limits, and boundary alignment were applied.

Use Allocation Ledger as the handoff table, then check Status, Spare, and Gap before treating any row as ready. Spare is usable capacity left inside the assigned child subnet after requested hosts and reserve are covered. Gap is skipped address space before the row, not spare capacity inside the row.

IPv4 subnet allocation result interpretation guide
Result area	Main signal	Verification cue
Capacity Brief	Parent block, scope label, usable host model, demand count, reserve, utilization, gaps, unassigned tail space, and gateway policy.	Confirm the normalized parent CIDR and reservation model before comparing addresses with IPAM.
Allocation Ledger	One row per demand segment with CIDR, network, first usable, gateway, last usable, broadcast, usable count, spare count, gap, note, and status.	Resolve every Overflow row and check gateway conventions against the actual network design.
Fit Review	CIDR parsing, demand parsing, fit result, ordering, headroom, and reservation-model warnings.	Fix skipped demand lines and review any high reserve or provider-reservation warning before exporting.
Address Space Map	Allocated address blocks, alignment gaps, and remaining unassigned tail space as portions of the parent range.	Large gaps often point to an ordering choice or a segment that needed a larger power-of-two block.
Demand Pressure Chart	Requested hosts, reserve hosts, spare usable capacity, and overflow status by demand segment.	Look for rows where spare capacity is tight or reserve pushes a segment into a larger child subnet.

A complete fit does not prove the addresses are unused in the live environment. Compare the ledger with IPAM records, DHCP scopes, static assignments, cloud subnets, route tables, firewall zones, and reserved ranges before provisioning.

Technical Details:

IPv4 subnet allocation is integer arithmetic over a 32-bit address space. A dotted address can be represented as an unsigned number, the parent prefix masks that number down to the network boundary, and the parent broadcast address is the final number in the block. Child subnets are placed by advancing through that numeric range.

Each child subnet is sized from required usable hosts, not from requested hosts alone. Reserve headroom is rounded up to a whole host count, added to the request, and compared with the usable capacity available at each candidate prefix. The selected child prefix is the longest prefix that still satisfies the usable-host requirement within the allowed child-size limit.

Formula Core:

The governing block-size formula is based on the number of host bits left after the prefix. Reservation rules then decide how many of those total addresses are usable for a segment.

\begin{array}{lcl} TotalAddresses (p) & = & 2^{32 - p} \\ ReserveHosts & = & ⌈ RequestedHosts \times ReservePercent \div 100 ⌉ \\ RequiredUsable & = & RequestedHosts + ReserveHosts \\ UsableStandard (p) & = & 2^{32 - p} - 2 for p \leq 30 \\ Utilization & = & AllocatedAddresses \div ParentTotalAddresses \end{array}

For a row requesting 90 hosts with 20% reserve, reserve is ceil(90 x 20 / 100) = 18. Required usable capacity is therefore 108. Under the standard LAN rule, /26 has 64 total addresses and 62 usable addresses, while /25 has 128 total addresses and 126 usable addresses. The smallest fitting child subnet is /25.

Reservation Rules:

IPv4 subnet reservation rules by model
Model	Usable-count rule	Address-range effect	Planning note
Standard IPv4 LAN	Total addresses minus two for prefixes through `/30`; total count for `/31` and `/32` when those sizes are allowed.	First usable is network plus one, and last usable is broadcast minus one for ordinary LAN-sized subnets.	Keep the smallest child subnet at `/30` unless longer prefixes are intentional.
Cloud VPC, five reserved	Total addresses minus five; very small blocks can reach zero usable addresses after reservation.	First assignable host is shown after the reserved platform addresses; the gateway suggestion is marked reserved.	This models the common five-address reservation pattern but does not enforce every provider's allowed prefix-size range.
Point-to-point friendly	Uses the same arithmetic for total addresses, with longer child prefixes useful only when the allowed child-size setting permits them.	`/31` and `/32` rows can be planned as link or host-route style allocations.	Confirm device, routing, and monitoring support before using these rows outside point-to-point or host-route cases.

Allocation Rules:

After a child prefix is selected, the next candidate network address is rounded up to the next multiple of that child block size. Any skipped addresses are counted as an alignment gap. The row fits only when the resulting child broadcast address remains inside the parent broadcast address.

IPv4 subnet allocation rules and output effects
Rule	Exact behavior	Output affected
Parent normalization	The entered address is masked to the parent prefix boundary.	Parent block may show `10.24.0.0/20` even if `10.24.1.5/20` was typed.
Demand parsing	Each valid line needs a label and a positive host count; only the first 80 valid rows are planned.	Fit Review reports skipped lines, missing counts, and row truncation.
Ordering	Rows are allocated largest-first, smallest-first, or in pasted order before the cursor moves through the parent.	Gap, unassigned tail space, and overflow results can change when order changes.
Overflow	A row is marked overflow when no allowed prefix can satisfy the required usable count or the aligned child block crosses the parent end.	CIDR, address-range fields, and usable counts show No fit or empty values for that row.
Scope label	The parent range is classified as private, loopback, link-local, documentation, or public or mixed scope when it fully matches a known range.	Capacity Brief gives context, not routing permission.

Mechanism Walkthrough:

With parent 10.24.0.0/20, the parent contains 4,096 total addresses. A 120-host segment with 20% reserve needs 144 usable host slots, so standard LAN sizing chooses /24 because /25 provides only 126 usable addresses. If that row is placed first, it starts at 10.24.0.0; a later 90-host row needs 108 usable slots and can fit in 10.24.1.0/25 if the cursor is already aligned. When the next needed block size does not align with the cursor, the difference appears as a gap before the row.

Limitations and Accuracy Notes:

The planning calculation uses the values already in the browser and does not query routers, DNS, DHCP, firewall rules, cloud APIs, or IPAM records. It can show whether the requested rows fit inside the entered parent CIDR, but it cannot prove that the addresses are available in your organization.

Provider rules can include minimum subnet sizes, reserved addresses, route-table constraints, service endpoints, or policy restrictions beyond the generic five-address cloud reservation model.
Gateway suggestions are conventions, not live device checks. A suggested address can still be wrong for a routed design or already used elsewhere.
Public or mixed-scope results require separate address ownership and routing review. Private ranges also need overlap checks before VPN, partner, or merger work.

Worked Examples:

Branch VLAN draft: A parent of 10.24.0.0/20 with Core services, 120, data center, Office VLAN, 90, users, and smaller segments fits cleanly under Largest host demand first with 20% reserve. Allocation Ledger gives each row a CIDR, gateway suggestion, usable count, spare count, and Fit status, while the unassigned tail keeps room for later VLANs.

Cloud subnet check: A demand of 27 hosts may look comfortable in a /27 under ordinary LAN arithmetic, because 32 total addresses become 30 ordinary usable addresses. Under Cloud VPC, five reserved, the same /27 has 27 usable addresses before reserve. Adding 20% headroom makes the required usable count 33, so Demand Pressure Chart and the ledger will push the row toward a larger child subnet or show overflow if the parent cannot hold it.

Parser and overflow repair: A pasted line such as Guest Wi-Fi, many is skipped because the host count is not positive numeric input, and Fit Review reports the parser note. After changing it to Guest Wi-Fi, 250, an Overflow status means the row was parsed but cannot fit with the current parent, reserve, and child-prefix limits. Increase the parent CIDR, lower reserve, split the segment, or compare the order before exporting.

FAQ:

Why does the parent CIDR change after I type it?

The parent address is normalized to the network boundary for its prefix. For example, 10.24.1.5/20 describes the same parent block as 10.24.0.0/20, so Capacity Brief shows the normalized version.

Why are some addresses counted as gaps?

Each child subnet must begin on a valid CIDR boundary for its block size. When the next available address is not aligned for the selected child prefix, the skipped addresses are counted as Gap.

Does the cloud VPC model match every provider rule?

No. It subtracts five reserved addresses per child subnet and marks the provider gateway suggestion as reserved. Check provider-specific minimum subnet sizes, service limits, and routing rules before provisioning.

What should I do with an Overflow row?

Check Required, Reserve, Gap, and Status in the ledger. A larger parent block, lower reserve, split demand, or different allocation strategy may be needed before the row can receive a CIDR.

Is a suggested gateway safe to configure?

Treat it as a convention only. The Gateway value follows the selected policy, but router configuration, cloud platform behavior, DHCP settings, and existing assignments remain authoritative.

Glossary:

CIDR: Classless Inter-Domain Routing notation, written as an IPv4 address and prefix length.
VLSM: Variable-length subnet masking, where child subnets can use different prefix lengths inside a parent block.
Parent block: The larger IPv4 CIDR range from which child subnets are allocated.
Child subnet: A smaller CIDR block assigned to one demand segment.
Usable address: An address that remains available for a host, endpoint, or workload after reservation rules are applied.
Alignment gap: Skipped address space needed to start a child subnet on a valid CIDR boundary.
Unassigned tail: Unassigned parent address space after the final fitted child subnet.

References:

RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan, RFC Editor, August 2006.
RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links, RFC Editor, December 2000.
RFC 1918: Address Allocation for Private Internets, IETF Datatracker, February 1996.
Subnet CIDR blocks, Amazon Virtual Private Cloud documentation.
Azure Virtual Network FAQ, Microsoft Learn.