Subnet Mask & IPv4 CIDR Range Calculator
Calculate IPv4 network ranges, broadcast addresses, usable IP spans, wildcard masks, and VLSM subnets client-side.
Subnet Architecture & Bounds
Binary Octet Representation
| # | Network | Usable IP Range | Hosts |
|---|---|---|---|
| 1 | 192.168.1.0/26 | 192.168.1.1 - 192.168.1.62 | 62 |
| 2 | 192.168.1.64/26 | 192.168.1.65 - 192.168.1.126 | 62 |
| 3 | 192.168.1.128/26 | 192.168.1.129 - 192.168.1.190 | 62 |
| 4 | 192.168.1.192/26 | 192.168.1.193 - 192.168.1.254 | 62 |
IPv4 Subnetting & CIDR Architecture: Core Engineering Foundations
Classless Inter-Domain Routing (CIDR) is the foundational addressing architecture of the global Internet, codified in RFC 4632 to eliminate the rigid inefficiencies of historical Class A, B, and C networks. By utilizing variable-length subnet masks (VLSM), systems architects, cloud engineers, and network administrators can partition address spaces with precision down to the exact bit, conserving scarce IPv4 allocations and structuring secure, isolated virtual private clouds (VPCs).
Deterministic Masking
Subnet masks designate the boundary line between the network identifier and the host identifier. A bitwise AND between an IPv4 address and its mask yields the immutable base network address.
Cloud VPC Segmentation
Designing AWS VPCs, Azure VNets, or Kubernetes pod CIDRs requires meticulous subnetting to segregate public dmz subnets, application containers, and private isolated databases.
Route Summarization
CIDR supernetting collapses thousands of regional routing table entries into consolidated upstream prefixes, protecting BGP core routers from global routing table exhaustion.
Complete IPv4 CIDR Reference Matrix & Host Capacities
Refer to the authoritative table below to quickly correlate prefix lengths, dotted quad masks, wildcard inverses, and usable host allowances across standard subnets:
| CIDR Prefix | Subnet Mask | Wildcard Mask | Total IPs | Usable Hosts | Typical Enterprise Use Case |
|---|---|---|---|---|---|
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 | Host route, loopback interface, firewall rule |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 | Point-to-point links (RFC 3021, no broadcast waste) |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 | Legacy point-to-point router links |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 | ISP static IP block for small firewalls / HA pairs |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 | Demilitarized Zones (DMZs), small server clusters |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 | Departmental subnets, branch office staging |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 | Cloud microservice clusters, database replica tiers |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 | Standard corporate LANs, Class C equivalent |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 | Standard Cloud VPC tier (AWS / GCP / Azure) |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 | Large enterprise VPC root supernet, Class B equivalent |
Private RFC 1918 Address Blocks & Security Routing Rules
The Internet Assigned Numbers Authority (IANA) reserved three blocks of IPv4 space exclusively for internal enterprise operations under RFC 1918. Routers on the public Internet are explicitly configured to drop traffic originating from or addressed to these ranges without NAT translation.
Large Enterprise & Cloud
Encompasses 10.0.0.0 through 10.255.255.255 (16,777,216 addresses). Ideal for multi-region VPC topologies, Kubernetes pod overlays, and massive interconnected branch networks.
Medium Enterprise & Docker
Spans 172.16.0.0 through 172.31.255.255 (1,048,576 addresses). The standard default CIDR block utilized by Docker bridge network drivers and regional data centers.
Small Office & Home (SOHO)
Covers 192.168.0.0 through 192.168.255.255 (65,536 addresses). Divided almost ubiquitously into /24 subnets (like 192.168.1.0/24) for residential routers and small branch switches.
Automated Subnet Verification (Python 3 & Terraform)
Integrate programmatic CIDR subnet calculations into CI/CD pipelines and infrastructure-as-code deployments to prevent IP collision errors before provisioning cloud infrastructure:
Python 3 (ipaddress Standard Library)
import ipaddress
# Initialize IPv4 network object
net = ipaddress.ip_network('192.168.1.0/24', strict=False)
print("Network Address:", net.network_address)
print("Broadcast Address:", net.broadcast_address)
print("Subnet Mask:", net.netmask)
print("Wildcard Mask:", net.hostmask)
print("Usable Host Range:", f"{net[1]} - {net[-2]}")
print("Total Usable Hosts:", net.num_addresses - 2)
# Subdivide into smaller /26 micro-subnets
subnets = list(net.subnets(new_prefix=26))
for idx, sub in enumerate(subnets, 1):
print(f"Subnet {idx}: {sub.with_prefixlen}")Terraform (cidrsubnet Function)
variable "vpc_cidr" {
default = "10.0.0.0/16"
}
# Automatically carve /24 subnets from /16 VPC root
resource "aws_subnet" "public_subnets" {
count = 3
vpc_id = aws_vpc.main.id
# cidrsubnet(prefix, newbits, netnum)
# adds 8 bits to /16 -> yields /24
cidr_block = cidrsubnet(var.vpc_cidr, 8, count.index)
availability_zone = data.aws_availability_zones.available.names[count.index]
tags = {
Name = "Public-Subnet-${count.index + 1}"
}
}Frequently Asked Questions (FAQ)
What is CIDR and how does it relate to subnet masks?
CIDR (Classless Inter-Domain Routing) replaces historical Class A, B, and C addressing with flexible bitmask prefix notation (such as /24). The CIDR prefix indicates exactly how many contiguous bits from left to right represent the immutable network prefix, leaving the remaining bits for assigning unique host interfaces.
Why are two IP addresses subtracted when calculating usable hosts?
In standard IPv4 subnets (/30 and larger), two addresses are reserved by RFC specifications: the very first address (all host bits set to 0) represents the Network Address, while the final address (all host bits set to 1) is reserved for the Directed Broadcast Address. Hence, Usable Hosts = (2^(32 - CIDR)) - 2.
How does RFC 3021 handle /31 subnets for point-to-point links?
RFC 3021 standardizes the use of 31-bit prefixes on point-to-point links. In a /31 subnet, host addresses are limited to 2 total bits (0 and 1). Neither address is dedicated as a broadcast or standard network address, allowing both IPs to be assigned directly to the two connected router interfaces without address waste.
What is a wildcard mask and where is it used?
A wildcard mask is the exact bitwise inverse of a subnet mask (255.255.255.255 minus the subnet mask). Wildcard masks are widely deployed in Cisco IOS, Juniper Junos, and network access control lists (ACLs) as well as OSPF routing configurations to filter packets across IP ranges.
What are RFC 1918 Private IPv4 address allocations?
RFC 1918 reserves three specific address spaces for private local area networks that are non-routable on the public global Internet: 10.0.0.0/8 (10.0.0.0 - 10.255.255.255), 172.16.0.0/12 (172.16.0.0 - 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 - 192.168.255.255).
Is my network calculation data logged or transmitted to external servers?
No. All bitwise operations, integer masks, IP conversions, and VLSM partitions run completely client-side in your local browser sandbox. No IP addresses, corporate subnets, or topology data ever leave your machine.
Related & Complementary Utilities
Explore more privacy-first client-side web tools.
XML Sitemap Generator & URL Crawler Suite
Compile Sitemaps.org compliant XML, TXT, and HTML sitemaps for Google Search Console.
Meta Tag Generator & Social Preview Inspector
Generate SEO-optimized HTML meta tags, Open Graph properties, and Twitter Cards with live previews for Google, Facebook, & X. 100% client-side & secure.
WHOIS Domain Age Checker & Expiration Auditor
Query live WHOIS registries to inspect domain creation dates, total active age, registrar information, expiration milestones, and trust metrics.