How to Calculate a Subnet Mask | Network Address, Broadcast Address and Host Count from CIDR, with a Cheat Sheet

The short answer: subnet maths comes down to the block size

An IPv4 address is 32 bits long, and the number in CIDR notation such as “/26” (the prefix length) says how many bits from the left belong to the network part. The remaining 32 − 26 = 6 bits are the host part, so one subnet holds 2 to the power of 6 = 64 addresses (the block size). Subnets are lined up in blocks of 64 (0–63, 64–127, 128–191, 192–255), so once you see which block an IP address falls into, both the network address and the broadcast address are fixed.

• Number of addresses: 2 to the power of (32 − prefix length). A /24 has 256, a /26 has 64, a /27 has 32
• Network address: the IP address AND the subnet mask (the start of the block). Not assigned to devices
• Broadcast address: the address with every host bit set to 1 (the end of the block). Not assigned to devices
• Usable IP range: network address + 1 to broadcast address − 1
• Usable hosts: number of addresses − 2. A /24 gives 254, a /26 gives 62, a /27 gives 30

Take 192.168.1.100/26. The block size is 64, so 100 falls in the 64–127 block. The network address is 192.168.1.64, the broadcast address is 192.168.1.127, and the usable range is 192.168.1.65 to 192.168.1.126, which is 62 hosts. The subnet mask is 255.255.255.192 (256 − 64 = 192). The sections below walk through this both in binary and as mental arithmetic.

How CIDR notation relates to the subnet mask

A subnet mask is a 32-bit value with 1s for the network part and 0s for the host part, written as four 8-bit groups in decimal. For a /26 there are 26 ones from the left followed by 6 zeros. The CIDR “/26” and the mask “255.255.255.192” are simply two ways of writing the same thing.

Within one octet (8 bits), the decimal value depends only on how many 1s line up from the left, so there are just nine possibilities. Memorise these nine and converting between masks and prefix lengths becomes instant.

• Mask to prefix length: count each 255 as 8 and convert the last octet using the table. 255.255.240.0 is 8 + 8 + 4 = /20; 255.255.255.224 is 8 + 8 + 8 + 3 = /27
• Prefix length to mask: divide by 8. /20 is 8 × 2 remainder 4, so after 255.255 comes 240 (four 1s) and the rest is 0: 255.255.240.0
• The quotient of dividing by 8 tells you which octet is split. /17 to /24 split in the third octet; /25 to /32 split in the fourth

How to find the network address and broadcast address

There are two methods. Taking an AND in binary shows how it works; using the block size in your head is faster in exams and on the job. Both give the same answer. As an example, here is 192.168.1.100/26.

1. 1

   Convert the IP address and mask to binary

   192.168.1.100 is 11000000.10101000.00000001.01100100 and the /26 mask 255.255.255.192 is 11111111.11111111.11111111.11000000. The first three octets have a mask of 255, so they stay as they are; you only need to look at the fourth octet.

2. 2

   AND them to get the network address

   AND gives 1 only where both bits are 1. In the fourth octet, 01100100 AND 11000000 = 01000000, which is 64 in decimal. The network address is 192.168.1.64.

3. 3

   Set the host bits to 1 to get the broadcast address

   Take the network address 01000000 and set the right-hand 6 bits, where the mask was 0, to 1: 01111111, which is 127. The broadcast address is 192.168.1.127.

4. 4

   Work out the usable range and host count

   Devices can use everything from 192.168.1.65, just after the network address, to 192.168.1.126, just before the broadcast address. That is 64 − 2 = 62 hosts.

The mental method skips binary. In the octet that is split (the fourth octet for a /26), find the largest multiple of the block size 256 − 192 = 64 that is not greater than the IP address value (100). 64 × 1 = 64 is the largest, so the network address is 192.168.1.64. The broadcast address is 127, one less than the start of the next block (128).

Worked examples: /20 and /18 split in the third octet, plus a small /29

With a prefix shorter than /24 the split moves to the third octet. The method is the same: find the multiple of the block size in the split octet, then set every octet to its right to 0 for the network address and 255 for the broadcast address.

1. 1

   172.16.45.200/20

   /20 is 8 × 2 remainder 4, so the split is in the third octet; the mask is 255.255.240.0 and the block size is 256 − 240 = 16. The largest multiple of 16 not above 45 is 32, so the network address is 172.16.32.0 and the broadcast address is 172.16.47.255 (32 + 16 − 1 = 47). The usable range is 172.16.32.1 to 172.16.47.254: 4,096 − 2 = 4,094 hosts.

2. 2

   10.1.130.7/18

   The /18 mask is 255.255.192.0, and the block size in the third octet is 64. The largest multiple of 64 not above 130 is 128, so the network address is 10.1.128.0 and the broadcast address is 10.1.191.255. The usable range is 10.1.128.1 to 10.1.191.254: 16,384 − 2 = 16,382 hosts.

3. 3

   192.168.10.77/29

   The /29 mask is 255.255.255.248 and the block size is 8. The largest multiple of 8 not above 77 is 72, so the network address is 192.168.10.72 and the broadcast address is 192.168.10.79. The usable range is 192.168.10.73 to 192.168.10.78: 6 hosts.

In the /20 example, the easy mistake is the fourth octet of the network address. The split is in the third octet, so the whole fourth octet belongs to the host part: it is 0 in the network address and 255 in the broadcast address. Do not leave the original value behind, as in 172.16.45.0 or 172.16.32.200.

Counting hosts, and /31, /32 and cloud reserved addresses

The number of usable addresses (hosts) is 2 to the power of (32 − prefix length), minus 2. The two you subtract are the network address at the start and the broadcast address at the end. On a real LAN the router (default gateway) also takes one, so one fewer is left for PCs and phones. In a /24, 254 addresses minus the gateway at 192.168.1.1 leaves 253 for ordinary devices.

• /30: 4 addresses, 2 usable. Long used for one-to-one links between routers
• /31: 2 addresses with no network or broadcast address, so both are usable (RFC 3021). Used for router-to-router links
• /32: a single address. Used in firewall rules and routes to point at one specific host

Cloud subnets reserve even more addresses. An AWS VPC reserves the first 4 (network address, VPC router, DNS, future use) and the last 1 in every subnet, 5 in total; Azure also reserves 5, and Google Cloud reserves 4.

The smallest subnet AWS lets you create is a /28, which leaves 16 − 5 = 11 usable addresses. For subnets that will host services that consume many IPs later, such as load balancers or containers, it is safer to size them generously to allow for the reserved addresses and future growth.

Subnet mask and CIDR cheat sheet (/16 to /32)

Here are the subnet mask, wildcard mask, address count and usable hosts for the commonly used /16 to /32. Larger blocks such as /8 or /12 are listed from /0 on the “Cheat sheet” tab of the Subnet Calculator.

Each step down in prefix length doubles the number of addresses, and each step up halves it. Starting from 256 for a /24, a /23 is 512, a /22 is 1,024, a /25 is 128 and a /26 is 64. Thinking in doubles and halves lets you produce the table without looking it up.

Choosing a prefix length from the number of devices

When designing, you calculate in reverse. Add 2 (network and broadcast) to the number of devices you need; the smallest power of 2 that is at least that number is the block size. The prefix length is 32 minus that exponent.

Thirty devices fit exactly into a /27, but that leaves no room for the gateway or growth. In practice, sizing for 1.5 to 2 times today’s count saves you from renumbering later. In the cloud, add the number of reserved addresses instead of 2 (5 for AWS and Azure, 4 for Google Cloud): 11 devices on AWS is 11 + 5 = 16, a /28.

Splitting subnets: equal splits and VLSM

To split one network into equal parts, lengthening the prefix by n bits gives 2 to the power of n subnets. Turning 192.168.1.0/24 into /26 adds 2 bits, giving four subnets: 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26 and 192.168.1.192/26, each with 62 hosts. Splitting 10.0.0.0/16 into /24 adds 8 bits and gives 256 subnets.

When departments or floors need different numbers of hosts, use VLSM (variable length subnet masking) to allocate subnets of different sizes. The procedure is simply “in descending order of size, pack blocks of the required size from the start”. Packing the largest first keeps every block on a proper boundary and leaves no gaps.

1. 1

   List the required host counts from largest to smallest

   In this example 192.168.1.0/24 is split into four segments of 100, 50, 20 and 2 hosts (a router link).

2. 2

   Choose a prefix length for each

   100 hosts need a /25 (126), 50 need a /26 (62), 20 need a /27 (30) and 2 need a /30 (2).

3. 3

   Allocate from the start, packing them together

   The order is 192.168.1.0/25 (.0 to .127), 192.168.1.128/26 (.128 to .191), 192.168.1.192/27 (.192 to .223) and 192.168.1.224/30 (.224 to .227).

4. 4

   Check what is left

   228 of the 256 addresses are used, leaving the 28 from 192.168.1.228 onwards. Keep them for future segments, or allocate larger blocks from the start.

As a larger example, splitting 10.0.0.0/22 into 300, 120, 60 and 10 hosts gives 10.0.0.0/23 (510 hosts), 10.0.2.0/25 (126), 10.0.2.128/26 (62) and 10.0.2.192/28 (14). If you pack the smallest first, then for example a /23 placed after a /28 will not line up with a boundary, and the addresses in between are wasted.

Checking whether two IPs are in the same subnet

Whether a device given 192.168.1.130 can talk on a segment depends on whether its network address matches that subnet’s network address. AND both with the same mask: the same result means the same subnet; a different result means a different subnet, and traffic has to go through a router.

• 192.168.1.100 is in 192.168.1.0/25 (.0 to .127): 100 is inside the 0–127 block
• 192.168.1.130 is not in 192.168.1.0/25: from 128 onwards is the next block, 192.168.1.128/25
• 192.168.1.130 is not in 192.168.1.64/26 (.64 to .127) either: it belongs to the /26 block 128–191
• Two addresses that both start 192.168.1. are in the same subnet with a /24, but can be in different subnets with a /25 or /26

If a device with a static IP cannot communicate, check that it and the gateway use the same mask, and that the IP is not the network or broadcast address. Type the IP into the “Is this IP address in this subnet?” box in the Subnet Calculator and it tells you on the spot.

Converting an IP range to CIDR, and aggregating CIDRs

Firewall rules and AWS security groups often need an IP range written as CIDR rather than “first to last”. If both ends of the range sit on block boundaries one CIDR is enough; if not, the range breaks into several CIDRs.

The idea is to start at the beginning of the range and repeatedly take the largest block that can start at that position without running past the end. 10.0.0.5 is odd, so only a /32 fits; from 10.0.0.6 a /31 of 2 addresses, from 10.0.0.8 a /29 of 8, from 10.0.0.16 a /30 of 4, and finally a /32 for 10.0.0.20. Counting by hand is error-prone, so check on the “Range → CIDR & aggregation” tab before writing the rule.

The reverse, combining several CIDRs into one, is aggregation (supernetting or route summarisation). The four networks 192.168.0.0/24 to 192.168.3.0/24 make exactly 192.168.0.0/22. The two networks 192.168.0.0/24 and 192.168.2.0/24 stay as two if merged without gaps, but a single route covering both is 192.168.0.0/22, which also includes 192.168.1.0/24 and 192.168.3.0/24. When you advertise a summary route, make sure the extra ranges it swallows are not in use elsewhere.

Calculating a wildcard mask

A wildcard mask is the subnet mask with 0s and 1s swapped. In decimal, subtract each octet from 255. The /24 mask 255.255.255.0 gives 0.0.0.255, the /26 mask 255.255.255.192 gives 0.0.0.63, and the /20 mask 255.255.240.0 gives 0.0.15.255.

• Cisco ACL: access-list 10 permit 192.168.1.64 0.0.0.63 permits 192.168.1.64/26
• OSPF network command: network 10.1.128.0 0.0.63.255 area 0 specifies 10.1.128.0/18
• The wildcard value + 1 equals the block size in the split octet (63 + 1 = 64)

Strictly, a wildcard mask reads 0 bits as “must match” and 1 bits as “don’t care”, so unlike a subnet mask it does not have to be contiguous. Non-contiguous values are hard to read and invite configuration errors, though, so in practice you normally use only the inverted subnet mask.

Private IP addresses and special-purpose ranges

When you carve subnets for an office or home LAN, pick them from the private IP ranges that are not used on the internet. RFC 1918 defines these three.

• 100.64.0.0/10: for carrier-grade NAT (CGNAT) on mobile networks and the like. Do not use it on your own LAN
• 169.254.0.0/16: link-local. A device assigns itself one of these when it fails to get an IP from DHCP, so seeing one points to a DHCP problem
• 127.0.0.0/8: loopback. 127.0.0.1 is the machine itself
• 172.16.0.0/12 runs only from 172.16 to 172.31. From 172.32.0.0 onwards the addresses are not private

If you plan to link sites by VPN or connect a cloud VPC to on-premises systems, decide from the start that their address ranges will not overlap. 192.168.0.0/24 and 192.168.1.0/24, which home routers use so often, are the ranges most likely to clash with a work-from-home VPN.

Common mistakes in subnet calculations

• Assigning the network or broadcast address to a device: in a /26, 192.168.1.64 and 192.168.1.127 are unusable. Do not assume only .0 and .255 of a /24 are special
• Keeping the octets to the right of the split: the network address of the /20 example is 172.16.32.0, not 172.16.32.200
• Forgetting to subtract 2 from the host count: a /27 has 32 addresses but only 30 usable hosts, and the gateway needs one of those
• Forgetting cloud reservations: an AWS /24 gives 251 addresses, not 254
• Thinking in classes: there is no longer a rule that 10.x.x.x is class A and therefore /8. With CIDR any range can be split freely by prefix length
• Packing VLSM from the smallest first: boundaries do not line up and unusable gaps appear
• Writing a mask that mixes 1s and 0s: values such as 255.255.255.200 are invalid masks

Most subnetting questions in certification exams such as CCNA test one of these seven points. Practise working out the answer in your head and then checking it gives the same values in the tool, and you will quickly develop a feel for block sizes. Note that this article and the tool cover IPv4 only. IPv6 addresses are 128 bits and LAN subnets are normally fixed at /64, so there is rarely any need to count hosts.

FAQ

How do I find the network address from a subnet mask?

Convert the IP address and the subnet mask to binary and AND them; the result is the network address. To do it in your head, subtract the mask value from 256 in the split octet to get the block size, then find the largest multiple of it that is not above the IP value. For 192.168.1.100/26 the block size is 256 − 192 = 64, the largest multiple of 64 not above 100 is 64, and the network address is 192.168.1.64.

How many devices can a /26 or /27 hold?

A /26 has 64 addresses, so 62 hosts once the network and broadcast addresses are removed; a /27 has 32 addresses and 30 hosts. A /24 gives 254, a /25 126, a /28 14, a /29 6 and a /30 2. The router (default gateway) also takes one address, so one fewer is left for PCs and phones.

What is 255.255.255.224 in CIDR?

It is /27. Each 255 has eight 1s, giving 24 for the first three octets, and 224 is 11100000 in binary with three 1s, for 27 in total. For the last octet, 128 means 1, 192 means 2, 224 means 3, 240 means 4, 248 means 5, 252 means 6 and 254 means 7.

How do I find the broadcast address?

It is the network address with every host bit (where the mask is 0) set to 1. Mentally, add the block size to the network address and subtract 1. For 172.16.45.200/20, the network address is 172.16.32.0; add 16 to the third octet and subtract 1 to get 47, set the fourth octet to 255, and the broadcast address is 172.16.47.255.

How do I choose a subnet mask from the number of devices?

Add 2 to the number of devices; the smallest power of 2 at least that large is the block size. For 50 devices that is 64 (2 to the 6th), so 32 − 6 = /26 (255.255.255.192). For 500 devices it is 512, a /23. In the cloud, add the number of reserved addresses instead of 2: 5 for AWS.

How many IP addresses can I use in an AWS subnet?

The subnet’s address count minus 5. AWS reserves the first 4 (network address, VPC router, DNS and future use) and the last 1, so a /24 gives 251, a /26 gives 59 and the smallest, a /28, gives 11. Azure also reserves 5 and Google Cloud reserves 4.

What is VLSM?

It is a way of splitting one network into subnets of different sizes (variable length subnet masking). Starting with the segment that needs the most hosts, you pack blocks of the required size from the start. Splitting 192.168.1.0/24 into 100, 50, 20 and 2 hosts gives a /25, /26, /27 and /30, leaving the 28 addresses from 192.168.1.228 onwards.