IP Subnet Calculator
Split this network
| # | Network | First host | Last host | Broadcast |
|---|
The two addresses you lose, and when the rule stops applying
The usual mistake is treating any address ending in .0 or .255 as unusable. What is reserved depends on the prefix, not on the final octet. In 10.20.0.0/23 the network address is 10.20.0.0 and the broadcast is 10.20.1.255, so 10.20.0.255 and 10.20.1.0 are ordinary host addresses. Enter an address and a prefix and the boundaries come from the mask, not habit.
Where the two go
Set every host bit to 0 and you have the network address, which names the subnet; set them all to 1 and you have the directed broadcast. Neither may be assigned to an interface, which is where usable = 2^(32 - prefix) - 2 comes from. It holds from /0 through /30. Two prefixes are exceptions:
- /31 - RFC 3021 allows a /31 on a point-to-point link. It has no network or broadcast address, so both addresses are usable and a router-to-router hop stops wasting half a /30. Support is not universal, so confirm the platform accepts it.
- /32 - a single address, with no host bits left to reserve: loopbacks, host routes and single-address firewall rules, not a segment with hosts.
| Prefix | Mask | Addresses | Usable |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /26 | 255.255.255.192 | 64 | 62 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 |
| /32 | 255.255.255.255 | 1 | 1 |
Cloud subnets lose more, by provider policy not protocol: AWS reserves five per VPC subnet, the first four and the last, so a /28 leaves eleven. Other providers reserve their own set - check their docs.
Private ranges, and the cost of borrowing public space
RFC 1918 sets aside 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for internal use; they are not routed across the public internet. The middle block runs 172.16.0.0 to 172.31.255.255 only, so 172.32.0.0 is public space that people pick by accident. Number a network out of a range somebody else owns and your hosts can never reach that organisation's real services: the connected route wins locally, so traffic never leaves your LAN. The bill arrives later, when a VPN, a partner link or an acquisition brings the real owner's prefixes into scope and the overlap must be NATed or renumbered. Keep clear of 100.64.0.0/10 (carrier-grade NAT, RFC 6598) and 169.254.0.0/16 (IPv4 link-local).
CIDR against the old classes
Classful addressing read the mask off the leading bits of the address, fixing a network at /8, /16 or /24. CIDR states the prefix length explicitly, independent of the address value, so any length is legal and blocks can be split or aggregated to fit the host count. Calling a /24 a class C is shorthand now; the class of a unicast address decides nothing. Separate reservations did survive: 224.0.0.0/4 multicast, 240.0.0.0/4 reserved.
Share this tool with friends
Free to use, no sign-up, works on any phone.
Frequently Asked Questions
Because the first address in the block is the network address and the last is the directed broadcast, and neither can be assigned to an interface. A /24 contains 256 addresses, so 254 remain for hosts. The same arithmetic applies at every prefix length from /0 through /30: usable hosts = 2^(32 - prefix) - 2. Only /31 and /32 behave differently.
No. It holds for prefixes from /24 to /30, where every block boundary falls inside the last octet, so .0 is always a network address and .255 always a broadcast. It does not hold for shorter prefixes: in 192.168.0.0/23 the block runs 192.168.0.0 to 192.168.1.255, so 192.168.0.255 and 192.168.1.0 are usable host addresses and only the first and last of the whole block are reserved. On a /31 both addresses are usable, including one that may end in .0. Work it out from the mask, not from the last number.
Yes, on platforms that implement RFC 3021. A /31 on a point-to-point link has no network or broadcast address, so both of its two addresses are usable, rather than the two that a /30 throws away. Support is not universal and some devices or interface types still refuse a /31, so check before renumbering links.
A /32 is a single address rather than a segment with hosts attached. It is what you use for a loopback interface, a host route in a routing table, or a one-address firewall or ACL entry. There are no host bits left, so there is nothing to set to all-zeros or all-ones and nothing is reserved: the block is that one address, and it is usable.
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use, and traffic for them is not routed across the public internet. The 172 block covers 172.16.0.0 to 172.31.255.255 only, so 172.32.x.x is public and should not be used internally. Pick a range with room for future subnets and record what is allocated. A common source of collisions is two sites both defaulting to 192.168.1.0/24, which then has to be NATed or renumbered when a VPN joins them.
Classful addressing derived the mask from the leading bits of the address, so a network was fixed at /8, /16 or /24 whether that fitted or not. CIDR writes the prefix length explicitly and independently of the address value, so a /26 or a /19 is legal and adjacent blocks can be aggregated into one route. Calling a /24 a class C is only shorthand now; the class of a unicast address decides nothing. Separate reservations such as 224.0.0.0/4 for multicast are still in force.