Subnet Calculator

What this tool does

You give it an address with its prefix — 192.168.1.130/24 — and it returns everything that follows from it: network address, broadcast, first and last host, netmask, wildcard, how many addresses exist and how many you can assign. It works the same for IPv4 and IPv6, and it also splits a block into smaller subnets.

It accepts three ways of writing it: CIDR notation (192.168.1.0/24), address and mask separated as ipconfig prints them (192.168.1.0 255.255.255.0), and a bare address, read as /32.

Why a /24 has 254 hosts

The question that brings most people here.

A /24 leaves 8 bits for the host portion, so the block holds 2⁸ = 256 addresses. But two are reserved and cannot be assigned to a machine:

• The first is the network address. It identifies the whole segment, not a host. It is what appears in routing tables.
• The last is the broadcast address. Sending there reaches every machine on the segment at once.

That leaves 254 usable. The general IPv4 formula is 2^(host bits) − 2.

The two cases where that subtraction is wrong

And they are exactly the ones many calculators get wrong, because they apply the subtraction without looking.

/31 — point-to-point link

A /31 has exactly two addresses. Subtracting two would give zero hosts, which would be absurd. RFC 3021 settled this in 2000: on a link between two routers there are only two ends, no broadcast is needed, and therefore both addresses are usable.

It is the standard prefix for point-to-point links precisely because it does not waste two addresses out of every four, which is what happened using /30. In IPv6 the equivalent is /127, defined in RFC 6164.

/32 — a single address

A /32 does not describe a network: it describes one specific address. It shows up constantly in firewall rules, access lists and host routes. There is nothing to subtract because there is no network or broadcast: the only address there is is the one in use.

IPv6 works differently

Two differences worth having clear:

There is no broadcast. IPv6 removed it and replaced it with multicast. That means every address in the block is usable — nothing is subtracted.

The /64 is the practical unit. A /64 is 18.4 quintillion addresses, far more than any segment will ever need. It is used anyway because stateless address autoconfiguration — the mechanism by which a host assigns itself an address on connecting — assumes the last 64 bits belong to the host. Subdividing below /64 breaks that, so in practice it is not done except on point-to-point links.

The wildcard mask

It is the netmask inverted bit by bit: where the mask has ones, the wildcard has zeros. For a /24, mask 255.255.255.0 and wildcard 0.0.0.255.

This is not trivia: Cisco access control lists and OSPF express ranges with the wildcard, not the mask. If you are writing an ACL and put the ordinary mask in out of habit, the rule covers exactly the opposite range to the one you wanted.

The ranges the tool recognises

When the address falls in a reserved range, it says so. The ones that come up most:

• Private (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Not routed on the internet.
• CGNAT (RFC 6598): 100.64.0.0/10. Carriers use it to share one public IP among several customers. If your router has an address from here, you are behind carrier-grade NAT and cannot open ports.
• Link-local: 169.254.0.0/16 in IPv4, fe80::/10 in IPv6. This is what a machine assigns itself when it cannot reach DHCP — seeing one usually means something is broken.
• Documentation: 192.0.2.0/24 and 2001:db8::/32, reserved for examples. If they appear in a real configuration, someone copied a manual without changing the values.

About the calculation

It is all integer arithmetic, with no network lookup. IPv6 is 128 bits, so every calculation uses arbitrary-precision integers: with JavaScript’s floating-point numbers, precision would be lost above 2⁵³ and addresses would come out wrong without warning anyone.