IPv4 CIDR (Classless Inter-Domain Routing) and Subnet Calculator

01What Is IPv4 CIDR, Key Subnetting Rules, and Common Subnet Sizes?

CIDR (Classless Inter-Domain Routing) is the notation and system that lets a single IPv4 address be paired with a number describing exactly how many bits of that address represent the network, and how many remain for individual hosts. Written as 192.168.1.0/24, the number after the slash — the CIDR prefix — is the single most important piece of information in modern IP networking.

Every IPv4 address is a 32-bit number, conventionally written as four decimal numbers (0–255) separated by dots, called "dotted-decimal notation." CIDR simply states how that 32-bit number is divided: the first n bits identify the network, and the remaining 32 − n bits identify a specific host within that network.

Key Subnetting Rules to Remember

• An IPv4 address always has exactly 32 bits, giving a CIDR prefix a possible range from /0 (the entire address space) to /32 (a single host).
• A larger prefix number means a smaller network. A /28 network is much smaller than a /16 network, even though 28 is a bigger number — more network bits leaves fewer host bits.
• The number of addresses in a subnet is 2 raised to the power of the remaining host bits. A /24 leaves 8 host bits, giving 2⁸ = 256 addresses.
• Two addresses in every subnet are reserved in traditional usage: the network address (all host bits zero) and the broadcast address (all host bits one) — neither can be assigned to a device.
• Usable host count is total addresses minus 2 for any subnet /30 or larger (point-to-point /31 and single-host /32 links are special exceptions used in specific routing scenarios).
• Every subnet mask is a string of consecutive 1s followed by consecutive 0s — a valid mask can never have a 0 bit followed by a 1 bit.

Common Subnet Sizes at a Glance

02Different Classes of IPv4 Classful IP Addressing

Before CIDR existed, IPv4 addresses were divided into fixed-size categories called classes, determined entirely by the value of the first octet. This "classful" system, defined in the 1980s, assigned a rigid, predetermined network/host split to every address depending on which class it fell into — a simpler but far less flexible approach than the CIDR system used almost universally today.

Why Classful Addressing Existed

In the early internet, this fixed-class system made routing simple: a router could determine a network's size just by looking at the first few bits of its first octet, with no additional configuration needed. Class A networks were handed out to enormous organizations and early internet pioneers (some of which still hold huge address blocks today), Class B to mid-sized institutions like universities, and Class C to smaller organizations.

Why Classful Addressing Was Abandoned

The rigid class boundaries wasted enormous numbers of addresses. An organization needing 300 addresses did not fit into a Class C network (254 usable addresses) and would be given an entire Class B network instead — over 65,000 addresses, more than 99% of which would sit unused. As the internet grew explosively in the early 1990s, this waste threatened to exhaust the entire IPv4 address space years ahead of schedule.

How CIDR Solved the Problem

CIDR, introduced in 1993, eliminated the rigid class boundaries entirely, allowing the network/host split to happen at any bit boundary rather than only at the 8, 16, or 24-bit marks that classes A, B, and C enforced. An organization needing 300 addresses could now be allocated a precisely sized /23 block (510 usable addresses) instead of an oversized Class B network — dramatically improving how efficiently the finite IPv4 address space could be distributed.

Where Classful Terms Still Show Up Today

Although routers no longer enforce classful boundaries, the terms "Class A," "Class B," and "Class C" persist informally in casual conversation and documentation — usually as shorthand for network size (a "Class C network" often just means "a /24") rather than a literal reference to the old rigid system. Understanding the classful legacy also explains why certain private IP ranges, covered later in this guide, look the way they do.

03IPv4 CIDR (Classless Inter-Domain Routing) and Subnetting Explained

CIDR is both a notation and a routing philosophy. As notation, it's the familiar address/prefix format. As a routing philosophy, it allows networks of arbitrary size to be represented as a single routing table entry, and allows a large network to be broken down — "subnetted" — into smaller networks that still route efficiently.

Reading CIDR Notation

10.20.30.0/22↑ base network address ↑ prefix length (network bits)

The prefix length tells you immediately, without needing the subnet mask spelled out separately, how large the network is and how many host addresses it contains. This compactness is exactly why CIDR replaced writing out a full subnet mask in most modern documentation and configuration.

Subnetting: Dividing One Network Into Many

Subnetting is the process of taking a larger network block and dividing it into smaller, separately addressable networks by "borrowing" bits from the host portion and reassigning them to the network portion. Each bit borrowed doubles the number of resulting subnets while halving the number of hosts available in each one.

Why Organizations Subnet Their Networks

• Isolating traffic and reducing broadcast domains — smaller subnets mean broadcast traffic stays contained to a smaller group of devices, improving performance.
• Applying different security policies per segment — a subnet for guest Wi-Fi can be firewalled away from a subnet holding internal servers.
• Matching physical or organizational structure — separate subnets per office floor, department, or building.
• Efficient address allocation — assigning precisely sized subnets instead of wasting an oversized block on a small team.
• Simplifying routing tables through route summarization, where multiple smaller subnets are represented by one larger CIDR block at a router boundary.

Supernetting: CIDR's Other Direction

CIDR also works in reverse, called supernetting or route aggregation: combining several contiguous smaller networks into one larger CIDR block for the purpose of routing efficiency. An ISP holding four contiguous /24 blocks can advertise them to the rest of the internet as a single /22 announcement, dramatically shrinking the size of global routing tables compared to advertising each /24 individually.

04Core Concepts of IPv4 Subnet Masks

A subnet mask is the "older sibling" of CIDR notation — the same information expressed as a full 32-bit number written in dotted-decimal form instead of a single prefix digit. Both describe exactly the same thing: where the network portion of an address ends and the host portion begins.

What a Subnet Mask Actually Is

A subnet mask is a 32-bit pattern where every bit set to 1 marks a network bit, and every bit set to 0 marks a host bit. Laid directly alongside an IP address, the mask tells a device or router which portion of that address to treat as the "network identifier" and which portion identifies an individual host on that network.

IP address: 192.168.10.55Subnet mask: 255.255.255.0In binary: 11111111.11111111.11111111.00000000 ↑ 24 network bits (1s) ↑ 8 host bits (0s)

CIDR Prefix vs. Dotted-Decimal Mask: Same Information, Two Formats

Both formats are used interchangeably depending on context: CIDR notation dominates modern documentation and cloud platform interfaces, while dotted-decimal masks remain standard in many router and operating system network configuration screens.

The Three Key Addresses Inside Every Subnet

• Network address: the first address in the range, with every host bit set to 0. This identifies the subnet itself and is never assigned to a device.
• Broadcast address: the last address in the range, with every host bit set to 1. Traffic sent here reaches every device on that subnet simultaneously.
• Usable host range: every address between the network and broadcast addresses, available for assignment to actual devices.

Wildcard Masks: The Inverted Cousin

Some networking equipment, particularly older Cisco access control lists, use a "wildcard mask" — the exact bitwise inverse of a subnet mask, where 0 means "must match" and 1 means "don't care." A /24 subnet mask of 255.255.255.0 becomes a wildcard mask of 0.0.0.255. Confusing the two is a very common configuration mistake for anyone new to command-line network equipment.

05How IPv4 Subnet Masks Work

A subnet mask does its actual work through a binary operation called AND. When a device needs to decide whether another IP address is on its local network or needs to be reached through a router, it performs a bitwise AND between its own IP address and the subnet mask, and separately between the destination IP address and the same mask — if both results match, the destination is local.

The Bitwise AND Operation

AND is a simple rule applied bit by bit: the result is 1 only when both input bits are 1; otherwise the result is 0. Applying this rule between an IP address and its subnet mask effectively "zeroes out" every host bit, leaving only the network portion behind.

11000000.10101000.00001010.00110111(192.168.10.55)& 11111111.11111111.11111111.00000000(255.255.255.0)——————————————————————————————————— 11000000.10101000.00001010.00000000(192.168.10.0 — the network address)

Step-by-Step: How a Device Decides "Local or Remote?"

1. The device applies its own subnet mask to its own IP address, calculating its own network address.
2. The device applies the same subnet mask to the destination IP address it wants to reach.
3. If the two resulting network addresses match, the destination is on the same local network, and the device sends traffic directly.
4. If they don't match, the destination is remote, and the device forwards the traffic to its configured default gateway (router) instead of trying to reach it directly.

Why This Matters for Everyday Troubleshooting

A shockingly common real-world networking bug is a device configured with the wrong subnet mask — one that's too large or too small for the actual network. If the mask is wrong, the device miscalculates which addresses are "local," either trying to reach genuinely remote devices directly (which fails) or unnecessarily routing local traffic through a gateway (which adds latency and can also fail if the gateway doesn't expect that traffic).

How Routers Use the Same Logic at Scale

Routers apply this exact same AND-and-compare logic against every entry in their routing table for every packet, just at a much larger scale, checking a destination address against many subnet mask and network address pairs simultaneously to determine the correct next hop. This is precisely why CIDR-based route summarization, mentioned earlier, is so valuable — fewer, larger table entries mean less computation per packet across the entire internet's backbone routers.

06Table: Typical Subnets for IPv4

The full reference table below covers every standard IPv4 CIDR prefix, useful for quick lookups without running a calculation by hand.

Special Cases Worth Noting

/31 networks break the usual "subtract 2" rule. Defined specifically by RFC 3021 for point-to-point links, a /31 has no distinct network or broadcast address — both of its two addresses are usable as host addresses, since a direct link between exactly two routers has no need for a broadcast address at all.

/32 addresses represent a single, specific host — commonly used in routing tables to specify an exact destination (a "host route") rather than an entire network, and often seen in firewall rules that need to reference one precise IP address.

07Private vs. Public IPv4 Address Ranges

Not every IPv4 address is reachable from the public internet. A specific set of ranges, defined by RFC 1918, is set aside exclusively for use inside private networks — home routers, office LANs, and internal cloud infrastructure — and these ranges are never assigned to any organization for public internet use.

Why Private Ranges Exist

The IPv4 address space holds roughly 4.3 billion total addresses — nowhere near enough for every device on earth to have a unique, globally routable address, especially with the explosion of internet-connected devices since the 2000s. Private ranges solve this by allowing the same private addresses to be reused independently inside millions of separate networks simultaneously, since these addresses are never routed across the public internet and therefore never collide with each other globally.

How Private Networks Reach the Public Internet: NAT

Network Address Translation (NAT), typically performed by a home or office router, rewrites the source address of outgoing traffic from a private IP to the router's single public IP address, and tracks the translation so return traffic can be routed back to the correct internal device. This is the mechanism that lets an entire household of devices, all using private 192.168.x.x addresses, share one public IP address to browse the internet simultaneously.

Public IP Addresses

Every address not falling into a reserved private or special-use range is a public address, globally unique and routable across the internet. Public IPv4 addresses are allocated by Regional Internet Registries to internet service providers and large organizations, and the pool of available new allocations has been effectively exhausted for years — a major driver behind both the adoption of NAT and the ongoing, gradual transition toward IPv6.

Other Reserved and Special-Use Ranges

08VLSM (Variable Length Subnet Masking) Explained

VLSM takes the flexibility of CIDR one step further: instead of splitting a network into equally sized subnets, VLSM allows every subnet carved from the same block to have its own independently sized mask, matched exactly to how many hosts that particular subnet actually needs.

The Problem VLSM Solves

Imagine an office network needing four subnets: one for 100 employees, one for 50 employees, one for a 6-device server room, and one 2-address point-to-point link to another building. Without VLSM, all four subnets would be forced to the same size — large enough to fit the biggest requirement, wasting hundreds of addresses on the smaller segments. VLSM lets each subnet be sized independently and precisely.

A Worked VLSM Example

Starting from a 192.168.1.0/24 block, here is one valid way to allocate it using VLSM, largest requirement first:

Notice each subnet is exactly sized to its requirement with a small margin, and every subnet begins precisely where the previous one ends — no addresses are wasted between allocations, and there's still a large unused remainder of the original /24 left for future growth.

The Golden Rule of VLSM

Always allocate from largest requirement to smallest. Assigning the biggest subnets first and working down to the smallest keeps the math clean and avoids awkward gaps or overlaps that are much more likely if you allocate in a random or ascending order.

VLSM vs. Fixed-Length Subnetting

09Use Cases and Applications

Subnet calculation is not a purely academic exercise — it underlies practical decisions made constantly across home networking, business IT, cloud infrastructure, and network security.

Home and Small Office Networking

Configuring a router, setting a static IP for a printer or NAS device, or troubleshooting why one device can't see another on the same Wi-Fi network all rely on understanding the local subnet — most home networks default to a simple 192.168.x.0/24 configuration, but understanding it helps when something doesn't work as expected.

Enterprise Network Design

Designing the IP addressing scheme for an office, campus, or multi-site organization means allocating subnets per department, floor, or function, planning for growth, and documenting exactly which ranges are reserved for what — a process that leans directly on the CIDR, VLSM, and subnet mask concepts covered throughout this guide.

Cloud Infrastructure (VPC Design)

Every major cloud provider's virtual private network offering — AWS VPC, Azure Virtual Network, Google Cloud VPC — requires specifying a CIDR block for the network and further subnetting it into smaller ranges for different tiers: public-facing web servers, private application servers, and isolated database subnets, each typically in a separate CIDR block with its own routing and firewall rules.

Firewall and Access Control Rules

Security rules are frequently written against entire CIDR blocks rather than individual addresses — "allow traffic from 10.20.0.0/16" is far more maintainable than listing every individual permitted address, and correctly understanding CIDR notation prevents accidentally opening a rule far wider (or narrower) than intended.

DHCP Scope Configuration

DHCP servers hand out IP addresses automatically to devices joining a network, and the scope they're configured to distribute from must align precisely with the subnet's actual size and mask — a mismatched DHCP scope is a common cause of devices receiving addresses that conflict with statically assigned equipment.

Network Troubleshooting and Documentation

Reading a network diagram, interpreting a traceroute output, or understanding why a VPN client can't reach an internal resource all require comfortably translating between CIDR notation, subnet masks, and the actual range of addresses they represent.

IPv4 Address Space Planning During Mergers

When two companies merge their networks, overlapping private IP ranges (both using 192.168.1.0/24, for example) are a genuinely common and disruptive problem, requiring careful subnet redesign — often the very first technical task in a network integration project.

10How to Calculate an IPv4 Subnet Network, With a Full Example

Manually calculating a subnet is a skill worth understanding even though tools automate it instantly — knowing the underlying math makes it far easier to sanity-check a calculator's output and troubleshoot confidently. Here is a complete worked example, step by step.

The Scenario

You've been given the address 172.20.14.130 with a /26 prefix, and need to determine: the subnet mask, the network address, the broadcast address, the usable host range, and the total number of usable hosts.

Step 1: Convert the Prefix to a Subnet Mask

/26 means 26 network bits (1s) followed by 6 host bits (0s):

11111111.11111111.11111111.11000000→ 255.255.255.192

Step 2: Find the Block Size

With 6 host bits remaining, the total block size is 2⁶ = 64 addresses. This means valid subnets increase in steps of 64 within the last octet: 0, 64, 128, 192.

Step 3: Find the Network Address

The given address is 172.20.14.130. Looking at the block boundaries (0, 64, 128, 192), 130 falls between 128 and 192 — so the network this address belongs to starts at 172.20.14.128.

Network address: 172.20.14.128

Step 4: Find the Broadcast Address

The broadcast address is the last address before the next block boundary — one less than 192:

Broadcast address: 172.20.14.191

Step 5: Find the Usable Host Range

The usable range is everything between the network and broadcast addresses, exclusive of both:

Usable range: 172.20.14.129 — 172.20.14.190

Step 6: Count the Usable Hosts

Total addresses: 64Usable hosts: 64 − 2 = 62

Full Summary

A Faster Shortcut: The "Magic Number" Method

Experienced network engineers often skip full binary conversion using a shortcut: subtract the relevant octet's mask value from 256 to get the block size directly. For a /26, the last mask octet is 192, so 256 − 192 = 64 — instantly confirming the block size without writing out any binary at all. This single trick covers the vast majority of everyday subnetting calculations.

Second Example: A Smaller Subnet

For the address 10.5.5.20/29: the mask is 255.255.255.248, giving a block size of 256 − 248 = 8. The boundaries near 20 are 16 and 24, so the network address is 10.5.5.16, the broadcast address is 10.5.5.23, and the usable range is 10.5.5.17 – 10.5.5.22, giving 6 usable hosts.

11Common Subnetting Mistakes to Avoid

Subnetting mistakes are among the most common causes of hard-to-diagnose connectivity problems, precisely because a slightly wrong mask or overlapping range often "mostly works," failing only in specific, confusing situations.

1. Mismatched Subnet Masks Between Devices

Two devices on the same physical network segment configured with different subnet masks will disagree about which addresses count as "local," leading to intermittent and confusing connectivity failures that can be difficult to trace back to the actual cause.

2. Overlapping Subnets

Assigning two subnets that share part of the same address range — common after a merger, or when someone reuses a range without checking existing allocations — causes routing ambiguity and unpredictable behavior, since devices and routers cannot reliably determine which network a given address actually belongs to.

3. Forgetting to Reserve the Network and Broadcast Addresses

Manually assigning a device the network address (all host bits zero) or broadcast address (all host bits one) of its own subnet, instead of a genuine usable host address, causes it to malfunction in ways that vary depending on the operating system and network equipment involved.

4. Undersizing a Subnet Without Room to Grow

Choosing a subnet exactly matching today's device count, with zero headroom, forces a disruptive re-addressing project the moment the team or infrastructure grows even slightly — a small growth buffer is almost always worth the minor address inefficiency.

5. Oversizing a Subnet "Just in Case"

The opposite mistake: allocating a /16 for a segment that will only ever need a few dozen hosts wastes enormous amounts of address space that could have served other segments, especially significant in constrained private address plans or public IPv4 allocations.

6. Confusing CIDR Prefix Direction

Assuming a higher prefix number means a bigger network — the opposite of the truth — is an extremely common beginner mistake. Remembering that /30 is tiny and /8 is enormous takes deliberate practice until it becomes second nature.

7. Ignoring VLSM and Wasting Address Space

Applying the same fixed subnet size to every segment regardless of actual need, instead of using VLSM to size each subnet appropriately, quietly wastes address space across an entire network design.

8. Not Documenting the Addressing Plan

Failing to keep a clear, current record of which subnets are allocated to what purpose leads directly to accidental overlaps and duplicate assignments months or years later, especially as staff turnover erases institutional memory of "how the network was set up."

12Key Features of Our IPv4 Subnet Calculator Tool

A well-built subnet calculator should handle every calculation described throughout this guide instantly, removing the need for manual binary math while still surfacing enough detail to understand exactly what's happening.

Whether you're studying for a networking certification, designing a VPC for a cloud deployment, or just double-checking a home router's configuration, the tool automates every calculation walked through in this guide while remaining transparent about how it arrived at the answer.

13How to Use the IPv4 Network Calculator Tool

You can calculate a complete subnet breakdown in seconds using our free tool at onlinewebtoolkit.com/ipv4-network-calculator — no account, no installation, and no manual binary math required.

Step-by-Step Walkthrough

1. Open the tool. Visit onlinewebtoolkit.com/ipv4-network-calculator in any browser, on desktop or mobile.
2. Enter an IPv4 address. Type any valid address, such as 172.20.14.130.
3. Enter the CIDR prefix or subnet mask. Provide either format — /26 or 255.255.255.192 — the tool accepts both interchangeably.
4. Run the calculation. Click the calculate button to instantly generate the full breakdown.
5. Review the results. The tool returns the network address, broadcast address, usable host range, total and usable host counts, wildcard mask, and address class in one clear summary.
6. Adjust the prefix to compare sizes. Changing only the CIDR prefix while keeping the same base address lets you quickly compare how different subnet sizes would divide the same block — useful when planning a VLSM allocation like the one worked through earlier in this guide.
7. Use the results directly in your configuration. Copy the subnet mask, network address, or usable range straight into your router, firewall, DHCP scope, or cloud VPC configuration.

Example Input and Output

Input: IP address: 192.168.1.130 CIDR prefix: /27Output: Subnet mask: 255.255.255.224 Network address: 192.168.1.128 Broadcast address: 192.168.1.159 Usable range: 192.168.1.129 – 192.168.1.158 Usable hosts: 30 Address class: C (private)

Tips for Getting the Most Out of the Tool

• Use the tool before assigning a new subnet in production to confirm the range doesn't overlap with an existing allocation.
• When planning VLSM, calculate each segment's subnet individually, working from largest to smallest as described earlier in this guide.
• Double-check whether an address falls in a private or public range before assuming it's reachable from the internet.
• Bookmark the tool for quick reference during certification study, interviews, or day-to-day network administration tasks.

15Frequently Asked Questions

Quick answers to the questions people ask most often about IPv4 subnetting and the network calculator.