What CIDR notation controls

An IPv4 address contains 32 binary bits, normally written as four decimal octets. CIDR notation adds a slash and prefix length. A /24 says that the first 24 bits identify the network and the remaining 8 bits identify addresses within that block. A longer prefix leaves fewer host bits and creates a smaller block; a shorter prefix creates a larger block.

The calculator converts the entered address into a 32-bit numeric position, determines the block size as 2 raised to the number of host bits, and rounds down to the block boundary. It then adds the block size minus one to find the final address. This arithmetic produces the network and broadcast boundaries without relying on a remote IP lookup.

Network, broadcast and host range

In a conventional multi-access IPv4 subnet, the first address identifies the network and the last is the directed broadcast address. Ordinary hosts are assigned between them, so a /24 block has 256 total addresses and traditionally 254 usable host addresses. This does not mean every address should be allocated; gateways, infrastructure, reservations and growth need a documented plan.

A /31 is a special case standardised for point-to-point links, where both addresses can be used because there is no need for a network and broadcast pair in the traditional sense. A /32 represents one address, often used as a host route or loopback. The page labels these cases instead of applying “subtract two” blindly to every prefix.

Reading the subnet mask

A subnet mask writes the prefix bits as ones followed by host bits as zeros. In dotted decimal, /24 becomes 255.255.255.0. A boundary need not fall between octets: /26 becomes 255.255.255.192 and creates blocks of 64 addresses in the last octet. The network boundaries are then .0, .64, .128 and .192 for that enclosing /24.

Mask and CIDR notation describe the same division. CIDR is usually more compact, while a device interface may request the dotted mask. Do not enter a wildcard mask in a subnet-mask field; wildcard masks invert the bits and appear in some access-control and routing configurations. For /24, the wildcard is 0.0.0.255, which is not the same value as the subnet mask.

A /26 planning example

Suppose the address is 192.168.10.70/26. Six host bits remain, so each block contains 64 addresses. The address 70 falls in the block from 64 through 127. The network is 192.168.10.64, the broadcast is 192.168.10.127, and the conventional host range is .65 through .126. There are 62 conventional host addresses.

A quick manual check uses the increment 256 minus the final mask octet: 256 − 192 = 64. Find the multiple of 64 at or below the entered final octet to get the boundary. This shortcut works when subnetting occurs in the final octet; for other prefixes, identify the “interesting” octet and preserve all earlier network octets.

Private addresses and internet routing

Ranges such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are reserved for private networks. They are not globally routed on the public internet. Network address translation is commonly used at an edge, but private addressing still needs coordination across sites, virtual networks and VPNs to avoid overlap.

This calculator does not determine ownership, geolocation, reachability or whether an address is currently assigned. It also does not fetch public routing data. An address block that is mathematically valid may be inappropriate because it overlaps another route, belongs to a provider, is reserved for documentation, or conflicts with an organisational standard.

Address capacity and real deployment

Choose a prefix from present need plus realistic growth, not from the host count alone. VLAN design, failure domains, security policy, DHCP reservations, high availability and operational simplicity can justify multiple smaller subnets. Conversely, an unnecessarily large broadcast domain can increase noise and make troubleshooting harder.

Cloud platforms sometimes reserve additional addresses inside every subnet, so their usable count can be lower than the conventional number shown here. Internet service providers may also prescribe a point-to-point arrangement or route a separate block. Always compare the calculation with the platform, router and provider documentation before deployment.

Input and implementation checks

Each octet must be an integer from 0 to 255, and the prefix must be a whole number from 0 to 32. Leading zeros are accepted as decimal text in this implementation, but avoiding them is clearer because older software has sometimes interpreted them differently. IPv6 uses 128-bit hexadecimal addresses and is outside this calculator’s scope.

Before changing a live network, record the current gateway, DHCP pool, static assignments, routes and access rules. A correct new boundary can still disconnect users if dependent configuration remains unchanged. Test in a controlled maintenance window and keep a rollback plan. The calculator supplies address arithmetic, not authorisation to reconfigure infrastructure.

Variable-length subnet planning

Variable-length subnet masking allows one allocated block to be divided into differently sized child subnets. Plan the largest host requirement first, choose a prefix that provides adequate capacity, place the next boundary after the whole block, and continue with smaller requirements. Every child must start on a valid boundary and remain inside the parent allocation.

For example, a /24 can contain two /25 blocks, four /26 blocks or a mixture whose binary boundaries do not overlap. Simply choosing visually convenient decimal endings can create overlaps or gaps. Calculate and record the network and broadcast boundary of every child, then compare the complete list before applying routes or DHCP pools.

Gateways and DHCP pools

The first or last usable address is often chosen for a gateway by convention, but IPv4 does not require that choice. The actual router configuration is authoritative. A DHCP pool should exclude the gateway and any static infrastructure assignments. Reservations, printers, access points and monitoring addresses need a documented owner so a mathematically valid host address is not accidentally assigned twice.

Route summaries and boundaries

A summary route can advertise several contiguous smaller blocks with one shorter prefix only when they align on the corresponding binary boundary. Covering too broad a range may direct traffic for addresses that are not actually reachable through that route. Covering too narrow a range leaves some child subnets unadvertised. List every component network, confirm contiguity and calculate the shared prefix before creating a summary. Routing policy, firewalls and return paths must then be checked separately from the address arithmetic.