ToolSite

How to Calculate a Subnet from an IP/CIDR Address

Learn to calculate subnet masks, network and broadcast addresses, host ranges, and usable IPs from CIDR notation. Use our free IP/CIDR calculator to check.

By ToolSite5 min readguides

What CIDR Notation Means

CIDR (Classless Inter-Domain Routing) notation combines an IP address with a prefix length to define a network:

192.168.1.0/24

The /24 means the first 24 bits are the network portion. The remaining 8 bits (32 minus 24) are the host portion. This single line replaces the old pair of an IP address and subnet mask like 255.255.255.0.

The number after the slash tells you everything: how many IPs are in the block, what the subnet mask is, and how many hosts you can connect.

Subnet Mask from Prefix Length

A /24 prefix means 24 ones, then 8 zeros:

11111111.11111111.11111111.00000000 = 255.255.255.0

Each octet represents 8 bits. To convert, write the prefix as that many ones followed by zeros to fill 32 bits, then split into four 8-bit groups and convert each to decimal.

Common prefix lengths and their subnet masks:

| Prefix | Subnet Mask | Total IPs | Usable IPs | |---|---|---|---| | /32 | 255.255.255.255 | 1 | 1 (host route) | | /31 | 255.255.255.254 | 2 | 2 (point-to-point, RFC 3021) | | /30 | 255.255.255.252 | 4 | 2 | | /29 | 255.255.255.248 | 8 | 6 | | /28 | 255.255.255.240 | 16 | 14 | | /27 | 255.255.255.224 | 32 | 30 | | /26 | 255.255.255.192 | 64 | 62 | | /25 | 255.255.255.128 | 128 | 126 | | /24 | 255.255.255.0 | 256 | 254 | | /23 | 255.255.254.0 | 512 | 510 | | /22 | 255.255.252.0 | 1,024 | 1,022 | | /16 | 255.255.0.0 | 65,536 | 65,534 | | /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |

The usable IP count is always total minus 2. One address is the network address (all host bits zero). One is the broadcast address (all host bits one). The /31 exception (RFC 3021) allows both addresses to be used for point-to-point links, saving addresses on connections that don't need a broadcast.

How the Math Works

For any prefix length n:

  • Total addresses: 2^(32 - n)
  • Usable hosts: 2^(32 - n) - 2 (except /31 and /32)
  • Subnet mask: write n ones, then (32 - n) zeros, split into octets

The subnet mask in each octet follows this pattern:

Bits borrowed from octet:  1    2    3    4    5    6    7    8
Decimal value:           128  192  224  240  248  252  254  255

For a /27, the prefix goes 3 bits into the last octet (24 + 3 = 27). The last octet of the mask is 224. For /28, it's 240. For /25, it's 128. These eight values repeat across every non-standard prefix.

Walkthrough: 192.168.1.0/24

Network address: the first address in the block, where all host bits are zero. For /24, this is 192.168.1.0.

Broadcast address: the last address in the block, where all host bits are one. For /24, this is 192.168.1.255.

Host range: everything between network and broadcast. For /24, this is 192.168.1.1 through 192.168.1.254. That's 254 usable addresses.

Subnet mask: 24 ones as the most significant bits. In dotted decimal: 255.255.255.0.

Walkthrough: 10.0.0.0/28

A /28 leaves 4 bits for hosts. Total addresses: 2^4 = 16. Usable: 16 - 2 = 14.

Network:    10.0.0.0
First host: 10.0.0.1
Last host:  10.0.0.14
Broadcast:  10.0.0.15
Subnet mask: 255.255.255.240

In binary, the last octet of the mask is 11110000 = 240.

Walkthrough: 172.16.0.0/20

A /20 prefix leaves 12 bits for hosts: 2^12 = 4,096 total, 4,094 usable. This is a common size for a medium department or a VPC subnet in cloud environments.

Network:    172.16.0.0
First host: 172.16.0.1
Last host:  172.16.15.254
Broadcast:  172.16.15.255
Subnet mask: 255.255.240.0

Notice the third octet changes. The /20 prefix spans part of the third octet: 16 bits for the first two octets plus 4 bits into the third. The third octet of the mask is 11110000 = 240. The network increment is 16 in the third octet (256 minus 240 = 16). The next /20 block starts at 172.16.16.0.

Checking If an IP Belongs to a Subnet

Given 192.168.1.100/27, is 192.168.1.90 in the same subnet?

A /27 has 32 addresses per block (30 usable). The block boundaries for 192.168.1.0/27 are:

192.168.1.0   to 192.168.1.31   (block 0)
192.168.1.32  to 192.168.1.63   (block 1)
192.168.1.64  to 192.168.1.95   (block 2)  ← .90 is here
192.168.1.96  to 192.168.1.127  (block 3)  ← .100 is here

.90 is in block 2 (192.168.1.64/27). .100 is in block 3 (192.168.1.96/27). They are in different subnets and need a router to communicate.

The quick check: divide the host portion by the block size. For /27, the block size is 2^(32 - 27) = 32. Integer-divide the last octet:

floor(100 / 32) = 3  → block starting at .96
floor(90 / 32)  = 2  → block starting at .64

Different blocks, different subnets.

When You Need This

  • Configuring VPC subnets: AWS, GCP, and Azure all use CIDR notation for VPC and subnet definitions. Getting the mask wrong means overlapping subnets or insufficient IPs for your workloads.
  • Firewall rules: iptables, ufw, cloud security groups . all accept CIDR ranges. 192.168.1.0/24 says "allow this entire subnet" without listing individual IPs. A single rule covers 254 hosts.
  • Docker networking: the default bridge network is 172.17.0.0/16. Custom networks use CIDR blocks you define. If you attach too many containers to a small subnet, DHCP exhaustion breaks new container starts.
  • Debugging connectivity: an IP with the wrong subnet mask can't reach its gateway. The calculator confirms whether an IP belongs in a given subnet and whether two IPs share a broadcast domain.
  • Kubernetes pod CIDRs: each node gets a /24 (or similar) allocation for pods. Overlap with the cluster service CIDR or node network causes routing failures that are hard to diagnose without CIDR arithmetic.

Try it yourself: open the IP/CIDR Calculator. Enter 192.168.1.0/24 and observe the network address (.0), broadcast address (.255), and host range (.1 through .254). Then try a non-obvious prefix like /27 and see how the subnet mask changes to 255.255.255.224 with 30 usable IPs. Enter two IP/CIDR pairs to check if they overlap.

Related Reading