CIDR & Subnet Calculator

What the slash actually means

192.168.1.0/24 is not a range written in a strange way — it is a prefix. The number after the slash is how many bits, counted from the left, are fixed. Everything to the right is free. So /24 fixes 24 bits and leaves 8, which is 28 = 256 addresses.

That is why the usable host count is 254 and not 256: the first address in a subnet is the network address and the last is the broadcast address, and neither is assigned to a host. The arithmetic is the whole thing — /24 means 256 addresses, /25 means 128, /30 means 4 of which 2 are usable, which is exactly what you want on a point-to-point link between two routers.

Prefix	Addresses	Usable hosts	Typical use
/8	16 777 216	16 777 214	An entire class A allocation
/16	65 536	65 534	A campus or large office
/24	256	254	The default small subnet
/28	16	14	A rack or a small DMZ
/30	4	2	Router-to-router link
/31	2	2 (RFC 3021 exception)	Point-to-point, no broadcast
/32	1	1	A single host route

The netmask is the same fact written differently

255.255.255.0 is /24 in dotted decimal. Convert each octet to binary and you get 24 ones followed by 8 zeros. There is no extra information in the netmask; it is just the prefix length written in a form that is easier to mistype.

The wildcard mask is the inverse, and it exists mainly for Cisco ACLs and firewall rules: 0.0.0.255 means "the first 24 bits must match, the last 8 can be anything". If you have ever wondered why one vendor wants a netmask and another wants a wildcard, this is why — same predicate, opposite polarity.

Private ranges, and why they keep causing trouble

Three IPv4 blocks are reserved for private use and are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Anything else is public. Two things follow that bite people:

• Two different companies both use 10.0.0.0/8 internally. When they merge, or set up a VPN between them, the ranges collide and traffic has nowhere to go. This is the single most common cause of a VPN that "connects but nothing works".
• 172.16.0.0/12 is not 172.16.0.0/16. It spans 172.16.0.0 through 172.31.255.255 — sixteen consecutive /16 blocks. Assuming the /16 is the whole range is a classic misconfiguration.

IPv6 changes the arithmetic, not the idea

The prefix means the same thing; there are just 128 bits instead of 32. A home network is typically handed a /56 or /64, and a /64 contains 2⁶⁴ addresses — a number large enough that "how many hosts fit" stops being a meaningful question. There is no broadcast address in IPv6, so every address in the prefix is assignable, and the convention is that a /64 is the smallest subnet you should ever delegate, because stateless address autoconfiguration expects 64 bits of interface identifier.

Frequently asked questions

Why is /31 allowed to have two usable hosts?

RFC 3021 carved out an exception for point-to-point links: with only two addresses and no need for broadcast, reserving both as network and broadcast would leave nothing. Routers accept /31 for exactly this case.

What does a /0 mean?

Zero fixed bits — the whole address space. In routing table terms it is the default route, 0.0.0.0/0, which matches everything and is what your machine uses to reach the internet.

Can I split a subnet into three equal parts?

Not into equal-sized CIDR blocks, because subnetting halves: one block becomes 2, 4, 8, 16. Three unequal parts is possible (one /25 plus two /26), but truly equal thirds is not expressible.

Does this send my network ranges anywhere?

No. All arithmetic happens in your browser. Internal addressing is exactly the kind of thing you should not paste into an unknown server.