Subnet and CIDR Calculation, Explained

After reading this you will be able to take any IPv4 address in CIDR notation and work out its network address, broadcast address, usable host range and mask by hand, and know when the shortcuts break.

What CIDR notation actually says

An IPv4 address is 32 bits. You usually write it as four decimal numbers, each covering 8 bits: 192.168.1.10. A subnet takes a run of leading bits and freezes them. Those frozen bits identify the network; the remaining bits identify hosts inside it.

CIDR (Classless Inter-Domain Routing, RFC 4632) writes the count of frozen bits after a slash. So 192.168.1.0/24 means the first 24 bits are the network and the last 8 bits belong to hosts. The number after the slash is the prefix length.

One quick hook. A /24 leaves 8 host bits, so it holds 2^8 = 256 addresses. Two of those are reserved (network and broadcast), leaving 254 you can assign. That single fact, 254 usable hosts in a /24, is the number most people memorise first.

When to reach for this and when not

Use subnet math when you are handing out address ranges, writing firewall rules, reading a routing table, or checking whether two hosts sit in the same broadcast domain. Any time you see a slash-number, this is the calculation behind it.

Do not use it for IPv6. IPv6 uses the same prefix idea but 128 bits and hexadecimal, and the host-count arithmetic gets huge (a single /64 holds 2^{64} addresses). Do not use it to decide reachability either: being in the same subnet means two hosts can talk directly at layer 2, but routing, NAT and firewalls decide everything beyond that.

The formula and the intuition

Let p be the prefix length. The host bits number 32 - p. The total address count is:

N = 2^{32 - p}

Here N is every address in the block, including the two reserved ones. For a /24, N = 2^{8} = 256. For a /26, N = 2^{6} = 64.

Usable hosts, for any prefix from /1 to /30, subtract the network and broadcast addresses:

H = 2^{32 - p} - 2

H is the count of addresses you can assign to real interfaces. A /26 gives 64 - 2 = 62 hosts. The /31 and /32 cases are exceptions covered below.

The netmask is just the frozen bits written as an address: p ones followed by 32 - p zeros. The wildcard mask is its bitwise inverse (zeros where the netmask has ones). Cisco access lists use the wildcard form.

To find the network address, do a bitwise AND of the IP and the netmask. To find the broadcast address, set every host bit to 1, which is the same as an OR with the wildcard mask.

A worked example: 192.168.1.0/24

From CIDR to every field

Start with the tool's default, 192.168.1.0/24, and reconstruct each result.

Prefix is 24, so host bits are 32 - 24 = 8.
Total addresses: 2^{8} = 256.
Netmask: 24 ones then 8 zeros, which is 255.255.255.0. Each full octet of ones is 255; the last octet is all zeros.
Wildcard mask: invert every bit, giving 0.0.0.255.
Network address: AND the IP with the netmask. The first three octets stay, the last becomes 0: 192.168.1.0.
Broadcast address: set the 8 host bits to 1, so the last octet becomes 255: 192.168.1.255.
Usable range: everything between network and broadcast, so 192.168.1.1 through 192.168.1.254.
Usable host count: 256 - 2 = 254.

Every one of those values matches what the tool prints when you press Calculate on the default input.

How host count changes with the prefix

Each extra bit in the prefix halves the block. Going from /24 to /25 splits 256 addresses into two blocks of 128. Going to /26 gives four blocks of 64. This is why the numbers march in powers of two, and why memorising a handful of them speeds up every calculation.

Common IPv4 prefixes and their capacity
Prefix	Netmask	Total addresses	Usable hosts
/24	255.255.255.0	256	254
/25	255.255.255.128	128	126
/26	255.255.255.192	64	62
/27	255.255.255.224	32	30
/28	255.255.255.240	16	14
/30	255.255.255.252	4	2

Reading the results, and the special cases

Three values tell you almost everything: the network address (the floor of the block), the broadcast address (the ceiling), and the usable range in between. If an address falls between those two boundaries, it belongs to the subnet.

Network address: The lowest address in the block, all host bits zero. Not assignable to a host.
Broadcast address: The highest address, all host bits one. Traffic sent here reaches every host in the subnet. Not assignable.
Netmask: The prefix drawn as an address. Bitwise AND with any IP yields that IP's network address.
Wildcard mask: The netmask inverted. Used by Cisco ACLs to say which bits are free.

Two prefixes break the minus-two rule. A /31 (RFC 3021) has only 2 addresses and no room for a separate broadcast, so both addresses are usable. This is the standard choice for point-to-point links between routers. A /32 is a single address, a host route to exactly one machine.

The same 32-bit value can be written four ways. 192.168.1.10 in dotted decimal equals 3232235786 as an unsigned integer, 0xC0A8010A in hex, and 11000000.10101000.00000001.00001010 in binary. The tool's converter shows all four; they are the same number in different clothes.

Common mistakes

The most frequent error is picking a host address as the network address. If someone hands you 192.168.1.10/24, the .10 is just a host inside the block; the network is still 192.168.1.0. Always AND with the netmask before you trust the number.

The second is off-by-one on host count. A /26 has 64 addresses but 62 usable, not 64 and not 63. Subtract exactly two for any prefix from /1 to /30.

The third is treating a mask like 255.255.255.240 as if it were a decimal quantity. Read it in binary: 240 is 11110000, so that octet contributes 4 network bits, giving a /28. Only the values 0, 128, 192, 224, 240, 248, 252, 254 and 255 are valid mask octets, because a mask must be a solid run of ones.

A mask octet like 255.255.255.100 is invalid. 100 in binary is 01100100, which is not a contiguous run of ones. Valid octet values follow the pattern above and nothing else.

Related tools on this site

Once you have a subnet nailed down, other lookups often follow. To read the layer-2 side of a host, its hardware address and vendor, use the MAC Address Lookup. To resolve a name to the addresses in these ranges, use the DNS Lookup. For who owns a block or domain, try the WHOIS Lookup. If you are checking a service on a host in your subnet, the SSL Certificate Decoder shows its certificate details. And for the permissions on the machines you reach, the Chmod Calculator converts octal and symbolic Unix modes.

Frequently asked questions

Why does a /24 have 254 usable hosts and not 256?

A /24 holds 256 addresses. The lowest (.0) is the network address and the highest (.255) is the broadcast address. Neither can be assigned to an interface, so 256 - 2 = 254 remain.

What is the difference between a netmask and a wildcard mask?

They are bitwise inverses. A netmask marks network bits with 1 (255.255.255.0). The wildcard mask marks host bits with 1 (0.0.0.255). Cisco access control lists use the wildcard form.

Can I use every address in a /31?

Yes. RFC 3021 defines /31 as a 2-address block for point-to-point links with no broadcast address, so both addresses are assignable. This is the exception to the minus-two rule.

How do I turn a mask like 255.255.255.192 into a prefix?

Count the one bits. Full octets of 255 give 8 each, so three of them is 24. The final 192 is 11000000, two more ones, for a total of /26.

Does being in the same subnet mean two hosts can reach each other?

It means they can communicate directly at layer 2 without a router. Whether they actually reach each other still depends on cabling, switches, VLANs, host firewalls and any ACLs in the path.

Try it yourself in the tool