Subnetting mistakes are rarely dramatic at first. A firewall rule written for 10.20.30.40/28 silently matches 10.20.30.32 through 10.20.30.47, a DHCP pool overlaps a gateway, or a point-to-point link is planned as a /30 when the router supports a /31. The arithmetic is simple, but doing it by hand under time pressure is where errors creep in.
The Subnet Calculator takes an IPv4 or IPv6 address with a prefix length and shows the network address, netmask, wildcard mask, broadcast address, usable host range, total addresses, usable host count and address scope. It runs entirely in your browser.
What is subnetting?
In simple terms
An IP address has two parts: the network part, shared by every device on the same subnet, and the host part, which is unique per device. The prefix length (the number after the slash) says how many leading bits belong to the network. A bigger prefix means a smaller subnet: /24 gives 256 addresses, /28 gives 16, /30 gives 4.
Technical background
Classless Inter-Domain Routing (CIDR, RFC 4632) replaced the old class A/B/C system with arbitrary prefix lengths. For a prefix length p:
- Netmask = p one-bits followed by (32 − p) zero-bits, e.g. /26 =
255.255.255.192. - Wildcard mask = bitwise NOT of the netmask, e.g.
0.0.0.63. - Network address = address AND netmask.
- Broadcast address = network address OR wildcard.
- Total addresses = 2^(32 − p).
- Usable hosts = total − 2 for prefixes up to /30, because the network and broadcast addresses cannot be assigned to hosts. A /31 is the exception for point-to-point links (RFC 3021): both addresses are usable. A /32 is a single host route.
IPv6 (RFC 4291) uses 128-bit addresses and prefix lengths only. There is no broadcast; LANs are normally /64, sites commonly receive a /48 or /56. The number of addresses in a /64 is 2^64, so counts are better expressed as powers of two.
The address scope matters as well: private ranges (RFC 1918), carrier-grade NAT (100.64.0.0/10), documentation ranges, link-local, multicast and reserved space all behave differently from public unicast addresses.
Why use the Subnet Calculator?
- Firewall and ACL rules. Confirm exactly which addresses a CIDR or wildcard mask covers before deploying a rule.
- Network planning. Check the host capacity and boundaries of a VLAN, DHCP scope or cloud subnet.
- Interface configuration. Get the netmask and gateway candidates (first and last usable) for a static configuration.
- Troubleshooting. Find out whether two hosts are really on the same subnet, or why a host outside the range cannot reach its gateway.
- Normalizing input. Turn an address with host bits set into the correct network address.
Who should use it?
- Network engineers designing addressing plans and writing ACLs.
- System administrators configuring servers, VLANs and DHCP.
- Cloud and DevOps engineers sizing VPC subnets and security group rules.
- Students learning subnetting for networking certifications.
How the Subnet Calculator works
All calculation happens in your browser with integer arithmetic on the address bits; nothing is sent to a server. The input is parsed as an address with an optional /prefix:
- The address is validated as IPv4 or IPv6. A missing prefix means /32 (IPv4) or /128 (IPv6). Prefixes above 32 or 128 are rejected.
- IPv4: the netmask is built from the prefix, the network address is the address AND the mask, the broadcast is the network OR the wildcard. For prefixes up to /30, first usable = network + 1 and last usable = broadcast − 1, and usable = total − 2. For /31 and /32 every address is usable and no broadcast is shown.
- IPv6: the network is the address with the host bits cleared, and the last address has all host bits set. There is no netmask, wildcard or broadcast row, and the first and last addresses of the prefix are shown as the usable range. When there are more than 64 host bits, totals are written as
2^n. - Scope: the network address is classified (Public, Private (RFC 1918), Carrier-grade NAT, Loopback, Link-local, Documentation, Multicast, Reserved, IPv6 unique local and so on).
The same logic runs behind the /subnet command in the NetTools terminal. An equivalent command-line check on Linux is ipcalc 198.51.100.77/26 (output format differs between distributions).
How to use the NetTools.tech Subnet Calculator
- Open the Subnet Calculator.
- Type an address with a prefix into the IP address with prefix field, for example
192.168.1.0/24,172.16.5.4/20or2001:db8::/48. - Press Calculate, or click one of the example chips.
- Read the result rows. If the input had host bits set, compare the CIDR row with what you typed.
- If you get an error, check the notation: the calculator expects
address/prefixwithout spaces, and an IPv4 prefix between 0 and 32 (IPv6: 0 to 128).
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| CIDR | Normalized network in CIDR notation | Differs from your input if host bits were set |
| Network address | First address of the block (host bits all zero) | Use this in routes and ACLs |
| Netmask (IPv4) | Dotted-decimal mask for the prefix | Needed by older device configurations |
| Wildcard mask (IPv4) | Inverse of the netmask | Used in Cisco ACLs and OSPF |
| Broadcast (IPv4) | Last address of the block; "—" for /31 and /32 | Not assignable to hosts |
| First usable / Last usable | The range assignable to hosts | Gateways are conventionally the first or last usable |
| Total addresses | Size of the block | Shown as 2^n for very large IPv6 prefixes |
| Usable hosts | Assignable addresses | For IPv6 equals the total, since there is no broadcast |
| Address scope | Classification of the network address | Private and documentation ranges are not routed on the internet |
Example: checking a firewall rule
A colleague writes an allow rule for 198.51.100.77/26, intending to allow a single server. The calculator shows:
CIDR 198.51.100.64/26
Network address 198.51.100.64
Netmask 255.255.255.192
Wildcard mask 0.0.0.63
Broadcast 198.51.100.127
First usable 198.51.100.65
Last usable 198.51.100.126
Total addresses 64
Usable hosts 62
Address scope Documentation (TEST-NET-2)The rule actually matches 64 addresses. For a single server it should be 198.51.100.77/32.
A second example, a point-to-point link planned as 203.0.113.4/31, yields network 203.0.113.4, netmask 255.255.255.254, broadcast —, first usable 203.0.113.4, last usable 203.0.113.5 and 2 usable hosts, so both ends of the link get an address.
For IPv6, 2001:db8:abcd::/48 gives a range from 2001:db8:abcd:: to 2001:db8:abcd:ffff:ffff:ffff:ffff:ffff, with 2^80 addresses, enough for 65,536 /64 subnets.
Common use cases
- Verifying ACL and security group CIDRs before deployment.
- Choosing DHCP scope boundaries that do not collide with static addresses.
- Documenting VLAN addressing with network, gateway and broadcast.
- Planning /31 or /30 point-to-point links.
- Explaining to a customer how many addresses a provider-assigned block contains.
Troubleshooting
"Use CIDR notation"
The input contains spaces, more than one slash or other characters. Enter it as 192.168.1.0/24. To convert a dotted netmask to a prefix, use the Subnet Mask Converter.
"IPv4 prefix length must be between 0 and 32"
A prefix like /33 or a typo such as /240. IPv6 accepts up to /128.
"Not a valid IPv4 or IPv6 address"
An octet above 255, a missing octet, or an IPv6 address with more than one ::. Check the address with the IP Address Converter if it came from another format.
Two hosts can't talk although they "are in the same subnet"
Enter each host with its configured prefix. If the CIDR rows differ, one host has a wrong mask. A host with a /24 mask in a /25 network will send traffic for the other half directly instead of via the router.
Common mistakes
- Writing a rule with host bits set and assuming it matches only that host.
- Forgetting the network and broadcast addresses when counting hosts on prefixes up to /30.
- Assuming /31 is unusable; most modern routers support it on point-to-point links.
- Applying IPv4 broadcast thinking to IPv6, or subnetting IPv6 LANs smaller than /64 without a specific reason.
- Mixing up netmask and wildcard mask in ACLs.
Limitations
- The calculator handles one block at a time. To split a network into subnets or plan VLSM, use the Subnet Mask Converter, which includes a splitter.
- It does not check whether a block is assigned to you or in use; for public addresses use IP Lookup.
- Only CIDR prefix notation is accepted, not dotted masks or address ranges.
- For IPv6 the first and last addresses of the prefix are shown as the usable range; reserved anycast addresses such as the subnet-router anycast address are not excluded.
Security & privacy
Everything is calculated in your browser. Addresses you enter are not sent to the NetTools server or stored. You can safely use it with internal addressing plans.
Related tools
- Subnet Mask Converter – convert masks and prefixes, split networks and plan VLSM. Guide: Subnet Mask Converter guide.
- IP Address Converter – convert addresses between decimal, binary, hexadecimal and other forms. Guide: IP Address Converter guide.
- IP Lookup – who holds and routes a public block. Guide: IP Lookup guide.
- MAC Lookup – identify devices on the subnet by vendor. Guide: MAC Lookup guide.
- Overview: IP & Network Utilities.
Summary
The Subnet Calculator turns an address and prefix into the network address, masks, broadcast, usable range, host counts and address scope, for IPv4 and IPv6, entirely in your browser. It normalizes inputs with host bits set, which is the most common source of oversized firewall rules, and handles /31 and /32 the way RFC 3021 and routers do.
Frequently asked questions
How many usable hosts are in a /24?
A /24 has 256 addresses. The first is the network address and the last is the broadcast address, so 254 are usable for hosts.
How do I calculate the number of hosts in a subnet?
For IPv4, the number of addresses is 2 to the power of (32 minus the prefix length). Subtract 2 for the network and broadcast addresses for prefixes up to /30; a /31 has two usable addresses and a /32 has one.
What is a wildcard mask?
A wildcard mask is the bitwise inverse of the netmask, for example 0.0.0.255 for 255.255.255.0. Cisco ACLs and OSPF network statements use it to say which bits may vary.
Why can a /31 be used on point-to-point links?
RFC 3021 allows both addresses of a /31 to be used on point-to-point links, because a link with two endpoints needs no network or broadcast address. The calculator shows both addresses as usable and no broadcast.
Why does the calculator change my address to a different network address?
If you enter an address with host bits set, such as 192.168.1.77/24, the calculator clears the host bits and shows the network it belongs to, 192.168.1.0/24. That is how routers and firewalls interpret the prefix as well.
Why does IPv6 show no broadcast or netmask?
IPv6 has no broadcast addresses and expresses masks only as prefix lengths. The calculator shows the first and last address of the prefix and the address count, written as a power of two for very large prefixes.
What happens if I enter an address without a prefix?
The calculator assumes a single host: /32 for IPv4 and /128 for IPv6.