What the prefix length actually means
An IPv4 address is 32 bits. Writing 192.168.1.0/24 says "the first 24 bits identify the network; the remaining 8 bits identify hosts inside it". Those 8 host bits give 2⁸ = 256 addresses, from 192.168.1.0 to 192.168.1.255. Every subnet question reduces to that one piece of arithmetic: host bits = 32 − prefix, and addresses = 2^(host bits).
The netmask is the same information in dotted form. A /24 is 255.255.255.0, which in binary is 24 ones followed by 8 zeros. The wildcard mask is its bitwise inverse (0.0.0.255) and is what Cisco ACLs and some firewall syntaxes expect — getting the two confused is one of the most common causes of a rule that silently matches nothing or everything.
| CIDR | Netmask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point link (classic) |
| /31 | 255.255.255.254 | 2 | 2 | Point-to-point link (RFC 3021) |
| /29 | 255.255.255.248 | 8 | 6 | Small block of static IPs from an ISP |
| /28 | 255.255.255.240 | 16 | 14 | A rack of servers, a DMZ |
| /26 | 255.255.255.192 | 64 | 62 | A department VLAN |
| /24 | 255.255.255.0 | 256 | 254 | The default office/VLAN size |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Four /24s joined |
| /16 | 255.255.0.0 | 65,536 | 65,534 | A whole site (rarely a single L2 domain) |
Why usable hosts is total minus two
In an ordinary IPv4 subnet, two addresses are not assignable to hosts. The network address — all host bits zero — names the subnet itself and appears in routing tables. The broadcast address — all host bits one — reaches every host on the segment at once. Assigning either to an interface breaks things in ways that are hard to diagnose, so 254 is the real capacity of a /24, not 256.
Read the full explanation of subnet calculator results ↓Show less ↑
There are two exceptions the calculator handles correctly. A /31 has no network or broadcast address at all: RFC 3021 defines it specifically for point-to-point links where the two addresses are both usable, and it is now the normal choice for router-to-router links because it wastes nothing. A /32 is a single host route — one address, used for loopbacks, anycast service addresses, and firewall rules that match exactly one machine.
Working out which subnet an address is in
The network address is the address ANDed with the mask. Take 172.16.5.130/26: a /26 has 6 host bits, so subnets step every 64 addresses in the last octet — .0, .64, .128, .192. 130 falls in the .128 block, so the network is 172.16.5.128, the broadcast is 172.16.5.191, and the usable range is 172.16.5.129 to 172.16.5.190.
That "step size" shortcut works for any prefix: the increment is 256 minus the interesting octet of the mask. For /26 the mask octet is 192, so the step is 64. For /28 it is 240, so the step is 16. Once you can do that in your head, most subnetting questions become arithmetic you can check on a whiteboard — and this tool becomes the thing you use to confirm it rather than to work it out.
Private, reserved, and special-purpose ranges
Not every address is routable on the public internet. The calculator labels the block you enter; these are the ones that matter day to day:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16— private (RFC 1918). Usable inside your network, never routed on the internet.100.64.0.0/10— carrier-grade NAT (RFC 6598). If your "public" address is in here, your ISP is sharing it and you cannot accept inbound connections.127.0.0.0/8— loopback. Only ever reaches the local machine.169.254.0.0/16— link-local / APIPA. An address here usually means DHCP failed. The single address169.254.169.254is also the cloud instance-metadata endpoint, which is why every tool on this site refuses to connect to it.192.0.2.0/24,198.51.100.0/24,203.0.113.0/24— documentation ranges (RFC 5737). Safe to use in examples and in docs, because they are guaranteed never to be live.224.0.0.0/4— multicast.240.0.0.0/4— reserved.
IPv6 prefixes: simpler than they look
IPv6 uses the same CIDR notation over 128 bits, and drops the two complications that make IPv4 fiddly: there is no broadcast address, and no address in a prefix is reserved, so every address is usable. The conventions are what you need to remember rather than the arithmetic:
- /64 is the standard size for any subnet that has hosts on it. SLAAC (stateless address autoconfiguration) assumes 64 host bits; making a host subnet smaller than /64 breaks it.
- /56 or /48 is what a site is typically assigned. A /56 contains 256 /64s; a /48 contains 65,536 — you subnet by handing out /64s, not by squeezing them.
- /128 is a single address, the IPv6 equivalent of a /32 host route.
fe80::/10is link-local,fc00::/7is unique-local (the rough IPv6 analogue of RFC 1918),ff00::/8is multicast, and2001:db8::/32is the documentation range.
The command-line equivalent
ipcalc is the classic tool, and sipcalc handles IPv6 well. Both are packaged on every mainstream distribution:
# Debian/Ubuntu: apt install ipcalc sipcalc
ipcalc 172.16.5.130/26
# Address: 172.16.5.130
# Netmask: 255.255.255.192 = 26
# Network: 172.16.5.128/26
# HostMin: 172.16.5.129
# HostMax: 172.16.5.190
# Broadcast: 172.16.5.191
# Hosts/Net: 62
# IPv6:
sipcalc 2001:db8::/48
# Check whether an address falls inside a prefix, using only iproute2:
ip route get 172.16.5.130Practical planning advice
Size subnets for the broadcast domain, not for the address count. A /16 of hosts on one flat VLAN will drown in ARP and broadcast traffic long before it runs out of addresses; /24 is the conventional ceiling for a single segment for exactly that reason. Leave gaps between allocations so you can grow a subnet by shortening its prefix instead of renumbering. And write down the plan — a documented allocation table is worth more than any calculator when someone else has to extend it two years later.