Tool · Network

Subnet Calculator

Enter an address with a prefix length — IPv4 or IPv6, the family is read from what you type. IPv4 gives the network and broadcast addresses, the usable host range, the wildcard mask and all four values in binary. IPv6 gives the canonical form, the subnet-router anycast address, the exact address count and the number of /64 links the prefix holds. It is bit arithmetic, so it runs instantly in this tab and nothing is sent anywhere.

IP address

CIDR Prefix: /24

What the result does not tell you

The arithmetic is exact and it is also the easy part. Three things the numbers deliberately do not establish:

Whether the subnet is free. That 10.20.30.0/24 is a mathematically valid subnet says nothing about whether a branch office has been using it for six years. The address space is a record, not a calculation — it lives in your IPAM, and if it does not, it lives in the routing table, which is the next best source. Carving a new block out of this calculator and deploying it is how two sites end up overlapping and the VPN between them stops being able to route.
Whether anything answers there. No packet is sent. First host and last host are the first and last addresses that are assignable, not addresses that exist.
Whether the mask on the device matches. The classic outage is two interfaces in the same wire with different prefix lengths. Each one computes a consistent, correct network for itself; they simply disagree about who is local, and the symptom is traffic that works in one direction. A calculator cannot see that, because it only ever looks at one end.

Usable hosts assumes a broadcast domain, and sometimes that is wrong

Usable is total minus two, because the all-zeros host is the network identifier and the all-ones host is the directed broadcast. That holds on an Ethernet segment and it is the figure you want nearly always. Two exceptions are worth knowing, because both appear in real configurations and both look like the calculator is wrong.

A /31 has two addresses and both are usable on a point-to-point link — RFC 3021 — because a link with exactly two interfaces has no use for a broadcast address. This tool reports two usable for a /31 rather than zero for that reason. It is the standard prefix for router-to-router links on platforms that support it, and it halves the address consumption of a /30. A /32 is one address and is reported as one usable: it is a loopback, a BGP peer address, or a host route, and subtracting two from it would be meaningless.

The wildcard mask is the inverse of the subnet mask, and it is there because Cisco ACLs and OSPF network statements take it instead. 0.0.0.255 rather than 255.255.255.0: the bits set to zero must match. Copying the subnet mask into an ACL where a wildcard belongs produces a line that is accepted and matches nothing you intended, which is a bad way to discover the difference.

The class shown next to the address is historical information and nothing more. CIDR replaced classful addressing, so A, B and C no longer imply a default mask, no longer imply anything about routing, and the only parts of the old scheme still worth recognising are D for multicast and E as reserved. It is displayed because exam questions and older documentation still use the vocabulary, not because any device will behave according to it.

Reading the binary row is the point of the binary row

It is not decoration. The mask in binary is an unbroken run of ones followed by an unbroken run of zeros — that is the definition of a valid mask, and seeing it makes a typo like 255.255.0.255 obvious instantly. Comparing the address row against the mask row shows you which bits are the network and which are left for hosts, and lining up two addresses in binary is the fastest way to answer "are these two in the same subnet?" without trusting anyone's arithmetic, including this page's. It is also how subnetting stops being memorised tables and starts being obvious.

IPv6 is not IPv4 with longer addresses

Four habits carried over from IPv4 produce wrong answers here, and the first one is the most common thing to see in a textbook that should know better.

There is no minus two. IPv6 has no broadcast address — that job belongs to the all-nodes multicast group ff02::1 — so there is nothing to subtract at the top of the range. A /64 holds 2⁶⁴ addresses, not 2⁶⁴−2. One address is set aside, and it is the one at the bottom: the subnet-router anycast address of RFC 4291, which every router on the link answers. It is not "the network address"; it is a destination that works.
/64 is the boundary, and not by convention. SLAAC derives the interface identifier from the bottom 64 bits, so a segment longer than a /64 gets no address from a Router Advertisement. A /120 is perfectly valid arithmetic and silently breaks autoconfiguration; this page says so when you enter one. Subnetting tighter than /64 to "save space" solves a scarcity problem that does not exist.
A /127 on a router-to-router link is correct. RFC 6164 recommends it precisely to avoid the subnet-router anycast ping-pong and the neighbour-cache exhaustion a /64 exposes on a point-to-point link. If a reviewer flags it as a typo, the reviewer is working from IPv4 instincts.
Text form is not free-form. RFC 5952 fixes one canonical spelling: lowercase, leading zeros suppressed, and :: used once over the longest run of zero groups, the first run when two tie. That matters because ACLs, log pipelines and config diffs compare strings: 2001:0DB8::0001 and 2001:db8::1 are the same address and not the same text. Any valid form is accepted as input, including the mixed ::ffff:192.0.2.1; the output is always canonical.

The number a planner actually uses is how many /64 links the prefix holds — 65,536 in a /48, 256 in a /56 — because IPv6 subnetting is allocation of links, not of hosts. Counting individual addresses in a /64 is arithmetic with no operational use.

When to use something else

For designing and operating an IPv6 estate rather than checking one prefix, ipv6-enterprise-operations covers planning it properly, with ipv6-security-audit for what that changes about exposure.

To find out what is actually in a range rather than what could be, subnet-scanner sweeps it, and vlan-audit checks that the VLAN carrying it is consistent across the switches that are meant to agree. If the address space itself is the problem — space nobody can account for, records that disagree with reality — infoblox-unused-ip-space finds the reclaimable blocks in a NIOS grid, and infoblox-ddi-fundamentals is the background for running IPAM as the source of truth a calculator can never be.