IPv4 Subnet Calculator

It is a count of bits, not a count of addresses. An IPv4 address is 32 bits, and the prefix says how many of them from the left are fixed for every machine on the network. /24 fixes the first 24 bits (192.168.1) and leaves 8 bits free, which is 256 combinations. That notation is called CIDR, and it replaced the old class system in 1993 precisely because a network's size stopped having to match an octet boundary: /23 and /25 are just as legal as /24, and are how blocks are actually allocated.

Two of the 256 are spoken for. The address with every host bit set to 0 (192.168.1.0) is the network address, which names the subnet in a routing table and is not assignable to an interface. The address with every host bit set to 1 (192.168.1.255) is the directed broadcast, received by every host on the segment. That leaves .1 through .254. The same subtraction applies at every size, which is why a /26 gives 62 rather than 64, and why a /30 gives only 2 out of 4.

Because RFC 3021 waived the reservation for that one case. A /31 holds exactly two addresses, so reserving one for the network and one for the broadcast would leave nothing at all. On a point-to-point link between two routers there is no need for a broadcast address (there is only one other device, and sending to it is the same as broadcasting), so both addresses are assigned and the link stops wasting half a /30. Every current router supports it; some older host stacks still refuse, which is the only reason /30 remains common.

It is the bitwise inverse of the subnet mask: where the mask has 1 bits, the wildcard has 0. The mask for a /24 is 255.255.255.0, so the wildcard is 0.0.0.255. The convention is inverted because it answers a different question: a mask marks the bits that must match, a wildcard marks the bits that are free to vary. Cisco IOS access lists and OSPF network statements take wildcard masks, which is why an ACL reads 192.168.1.0 0.0.0.255 rather than the mask you would put on an interface. Getting the two the wrong way round is a classic way to write a rule that matches far more than intended.

Because its 1 bits are not contiguous. A mask has to be an unbroken run of 1s followed by an unbroken run of 0s, because that is the only shape a prefix can take: routing hardware matches a leading run of bits and can express “the first N bits” but not “these particular scattered bits”. Early implementations technically permitted discontiguous masks and the results were unroutable, so CIDR ruled them out. If you find yourself wanting one, what you actually need is either a different prefix or a firewall rule.

Work out the number of interfaces (not people, and remembering that printers, access points, and the gateway itself each take one), then find the smallest block whose usable count still exceeds it. 25 hosts needs a /27, because a /27 gives 30 and a /28 gives only 14. Then take one more bit than the arithmetic demands if the segment could plausibly grow, because re-addressing a live subnet is far more disruptive than allocating a slightly larger block on day one. The sizing panel on this page does the lookup, and the reference table shows the whole ladder.

No. RFC 1918 addresses are unroutable on the public internet, which means no ISP will carry them; it does not mean nothing can reach them. Anything already inside the perimeter reaches them perfectly well: a VPN client, a compromised laptop, a container on the same host, or a misconfigured route between two sites that both used 192.168.1.0/24. Private addressing is an addressing decision that conserves public space and forces traffic through a NAT; treat the firewall, not the address range, as the control.

Because the /12 boundary does not fall on an octet. Twelve fixed bits cover the first octet and the top four bits of the second, so the second octet is free to range over 16 through 31: 172.16.0.0 up to 172.31.255.255. It catches people out in both directions: 172.15.0.0 and 172.32.0.0 are public addresses belonging to someone else, and writing the block as 172.16.0.0/16 quietly discards fifteen sixteenths of the private space available.