How IPv4 Subnetting Works
An IPv4 address is a 32-bit binary number traditionally represented as four decimal numbers from 0 to 255 separated by dots (dotted-decimal notation, such as 192.168.1.1). Every IP address is divided into two parts: the network prefix (which identifies the network or broadcast domain) and the host identifier (which identifies the individual device, server, or virtual machine within that network).
The subnet mask determines where the network portion ends and the host portion begins. In modern networking, Classless Inter-Domain Routing (CIDR) notation expresses this division with a forward slash followed by the prefix length (such as /24), indicating how many of the 32 bits belong to the network.
Key Network Parameters Calculated
- Network Address (Network ID): The first address in any subnet block, obtained by performing a bitwise logical
ANDoperation between the 32-bit IP address and the subnet mask. All host bits are set to 0. It designates the subnet itself and cannot be assigned to an interface. - Broadcast Address: The highest address in the block, obtained by setting all host bits to 1 (or a bitwise
ORof the network address and the inverted wildcard mask). Packets sent to this destination are delivered to all hosts on the subnet. - Usable Host Range: The IP addresses between the network address and the broadcast address (from
Network + 1toBroadcast - 1). For example, in192.168.1.0/24, the usable range is192.168.1.1through192.168.1.254. - Cisco Wildcard Mask: The inverse of the subnet mask (computed as
255.255.255.255 - Subnet Mask). In a wildcard mask, a0bit means the corresponding bit must match, while a1bit means "don't care." Wildcard masks are widely used in Cisco IOS Access Control Lists (ACLs) and OSPF/EIGRP routing protocol configurations.
Step-by-Step Worked Example: Calculating a /27 Subnet
Suppose you are assigned the IP address 192.168.10.130/27. Here is how the subnet parameters are determined mathematically:
- Convert the CIDR prefix to a subnet mask: A
/27prefix means the first 27 bits are 1s and the remaining 5 bits are 0s:11111111.11111111.11111111.11100000=255.255.255.224. - Determine total and usable host capacities: With 5 host bits remaining, the total number of IP addresses in the subnet is 25 = 32. Subtracting 2 (one for the network ID, one for the broadcast IP) yields 30 usable host addresses.
- Calculate the block size (magic number): Subtract the last non-zero octet of the mask from 256:
256 - 224 = 32. Subnets in this octet increment in multiples of 32: 0, 32, 64, 96, 128, 160, 192, 224. - Locate the network address: Since the host IP's fourth octet is 130, it falls within the block starting at 128 (between 128 and 159). Thus, the Network Address is
192.168.10.128. - Identify the broadcast address and range: The next subnet starts at 160, so the current subnet ends at
160 - 1 = 159. The Broadcast Address is192.168.10.159, and the Usable Host Range is192.168.10.129to192.168.10.158. - Compute the wildcard mask:
255.255.255.255 - 255.255.255.224 = 0.0.0.31.
IPv4 Subnetting Cheat Sheet
| CIDR Prefix | Subnet Mask | Total Addresses | Usable Hosts | Common Use Case |
|---|---|---|---|---|
/32 |
255.255.255.255 | 1 | 1 | Host route, loopback interface, firewall single-IP rule |
/31 |
255.255.255.254 | 2 | 2 | Point-to-point router links (RFC 3021) |
/30 |
255.255.255.252 | 4 | 2 | Traditional point-to-point links |
/29 |
255.255.255.248 | 8 | 6 | Small public IP blocks from ISPs, small DMZ |
/28 |
255.255.255.240 | 16 | 14 | Server VLANs, database tiers |
/27 |
255.255.255.224 | 32 | 30 | Department subnets, cloud application tiers |
/26 |
255.255.255.192 | 64 | 62 | Medium office branches |
/25 |
255.255.255.128 | 128 | 126 | Half of a traditional Class C block |
/24 |
255.255.255.0 | 256 | 254 | Standard home LAN, small business, office Wi-Fi |
/22 |
255.255.252.0 | 1,024 | 1,022 | Large enterprise campus, university building |
/16 |
255.255.0.0 | 65,536 | 65,534 | Amazon Web Services (AWS) VPC, corporate enterprise network |
/8 |
255.0.0.0 | 16,777,216 | 16,777,214 | Class A private network (10.0.0.0/8), large telecom backbone |
Private IP Address Ranges (RFC 1918)
The Internet Engineering Task Force (IETF) reserved three blocks of IPv4 address space for private networks that are not routed on the public Internet:
- 10.0.0.0/8 (10.0.0.0 – 10.255.255.255): 16,777,216 addresses, commonly used by enterprise intranets and large data centers.
- 172.16.0.0/12 (172.16.0.0 – 172.31.255.255): 1,048,576 addresses, spanning 16 contiguous /16 blocks.
- 192.168.0.0/16 (192.168.0.0 – 192.168.255.255): 65,536 addresses, standard for home routers and small office Wi-Fi networks (e.g.
192.168.1.0/24or192.168.0.0/24).
In addition, 127.0.0.0/8 is reserved for host loopback testing, 169.254.0.0/16 for Automatic Private IP Addressing (APIPA / link-local), and 100.64.0.0/10 for Carrier-Grade NAT (CGNAT, RFC 6598).
Frequently asked questions
Why are two IP addresses subtracted from the total host count in a subnet?
In standard IPv4 subnets, the very first address represents the Network Identifier (used by routers to direct packets to the correct subnet), and the very last address is reserved as the Directed Broadcast Address (used to communicate simultaneously with every device on the subnet). Because these two addresses cannot be assigned to network interfaces (hosts, servers, or printers), the usable host capacity is always 2(32 - prefix) - 2.
What is RFC 3021 and why does a /31 subnet have 2 usable hosts?
Under RFC 3021, point-to-point links between two routers can utilize a 31-bit prefix (such as /31). Because there are only two devices on the link, broadcast and network identifier designations are unnecessary, conserving valuable IPv4 address space. Both addresses (e.g., 10.0.0.0 and 10.0.0.1) can be assigned to router interfaces.
What is a Cisco Wildcard Mask and how is it used?
A wildcard mask is the exact bitwise inverse of a subnet mask (where 0 indicates a bit that must match exactly, and 1 indicates an unconstrained or "don't care" bit). For example, a 255.255.255.0 mask translates to a wildcard mask of 0.0.0.255. Network engineers use wildcard masks in Cisco Access Control Lists (ACLs) and routing protocols like OSPF to specify matching IP ranges.
Can I type a combined CIDR string like 10.0.0.1/28 directly?
Yes. You can enter an address with its CIDR slash notation directly into the IP Address field (such as 172.16.0.1/22 or 192.168.1.50/26). The calculator automatically detects the prefix, adjusts the mask dropdown, and computes the exact subnet boundaries immediately.
Does this subnet calculation send my internal IP addresses over the network?
No. The calculator executes entirely inside your web browser using client-side JavaScript bitwise operators. Your internal network topologies, private subnets, and host addresses never leave your computer or phone.
Last updated: October 18, 2026