Why a subnet never gives you every address it contains
An IPv4 address is 32 bits. A prefix length splits those 32 bits into a network part and a host part: in 10.20.30.0/24 the first 24 bits identify the network and the remaining 8 bits identify hosts inside it. Eight host bits give 28 = 256 distinct combinations, so the block contains 256 addresses. That is the block size, and it is always a power of two.
You cannot assign all 256. The combination in which every host bit is 0 is the network number — the name of the subnet itself, the thing that appears in a routing table. The combination in which every host bit is 1 is the directed broadcast, which reaches every host on the segment. Neither can sit on an interface, so a /24 offers 254 usable addresses, a /26 offers 62, and a /30 offers 2.
That two-address tax is fixed no matter how big the block is, which is why it hurts small subnets far more than large ones. On a /30 you lose half the block. On a /16 you lose 0.003% of it. The practical consequence shows up when you carve a range into point-to-point links: a hundred router-to-router links built as /30s burn 400 addresses to carry 200 interfaces.
Everything else on this page follows from those two facts — block size is a power of two, and two addresses per block are reserved.
The two formulas, and why the logarithm appears
Going forwards from a prefix is arithmetic you can do in your head. Subtract the prefix from 32 to get the host bits, raise 2 to that power for the block size, subtract 2 for the usable count. A /27 has 5 host bits, 32 addresses, 30 usable.
Going backwards from a host count is where the base-2 logarithm comes in. You need the smallest power of two that is at least hosts + 2, because you must buy the two reserved addresses along with the ones you use. The smallest exponent satisfying 2b ≥ h + 2 is b = ⌈log2(h + 2)⌉, and the prefix is 32 − b. For 500 hosts: 500 + 2 = 502, log2(502) = 8.97, ceiling 9, so 9 host bits and a /23.
The ceiling is the whole story. Because b must be a whole number, capacity jumps in doublings and there is no such thing as a block sized to fit. Ask for 130 hosts and you get a /24 with 254 usable addresses; ask for 126 and a /25 suffices. Requirements that land one host above a power-of-two boundary are the expensive ones, and the utilisation figure on this page is there to make that visible before you commit the range.
This calculator applies your growth allowance before the ceiling, and adds infrastructure reservations before it too, because a gateway address consumes capacity exactly as a client does. If you want the raw arithmetic with no allowance, set growth to 0 and reservations to 0.
Worked example: a 500-user floor with 20% growth and three infrastructure addresses
You are addressing a campus floor. There are 500 devices today, you want 20% headroom, and the segment needs a gateway plus two VRRP peer addresses.
- Apply the growth allowance. 500 × 1.20 = 600 devices.
- Add the infrastructure reservations. 600 + 3 = 603 addresses that must be assignable.
- Add the two reserved addresses. 603 + 2 = 605 addresses that must exist in the block.
- Find the host bits. 29 = 512, which is less than 605. 210 = 1,024, which is enough. So b = 10 host bits.
- Convert to a prefix. n = 32 − 10 = /22, mask 255.255.252.0.
- Check the usable count. 1,024 − 2 = 1,022 usable, of which 3 go to infrastructure, leaving 1,019 for clients — comfortably above the 600 you planned for.
- Measure the waste. 1,024 − 605 = 419 addresses spare, so utilisation is 605 / 1,024 = 59.1%.
That 59% is the interesting number. The requirement sits just past the 512 boundary, so you are paying for a block nearly twice the size you need. Two levers change the answer. Drop the growth allowance to zero and the requirement falls to 500 + 3 = 503 assignable addresses, or 505 including the two reserved ones, which fits inside 512 — so the block becomes a /23 and utilisation rises to 505 / 512 = 98.6%. Alternatively, split the floor into two VLANs of 250 devices each and give each one a /24: that costs 512 addresses in total rather than 1,024, and halves the broadcast domain at the same time.
How to read the result
The usable host count is a ceiling, not a target. Running a DHCP scope at 95% of its usable capacity means the next classroom full of laptops gets no address. Aim to size so that steady-state occupancy is 50–70% of the usable count; that leaves room for a burst of guests without wasting an entire doubling.
Address math is rarely the binding constraint. A /16 is legal and gives 65,534 hosts, but nobody builds one, because every host in a subnet shares a broadcast domain. ARP, DHCP discovery, mDNS and IPv6 neighbour discovery all flood it. Most enterprise designs cap a user VLAN at a /22 (1,022 hosts) and many cap it at /24. When this calculator recommends a prefix shorter than /22, treat that as a signal to split the segment rather than to build one enormous one.
Utilisation below about 55% means you are one host over a boundary. The calculator flags it. It is not automatically wrong — in an RFC 1918 range you have addresses to burn — but in a public allocation or a tightly summarised private plan it is worth a second look.
Reservations are not just the gateway. Count first-hop redundancy peers, the virtual IP, any firewall interface, wireless controllers, printers with static leases and management addresses. Three to five is typical for a user VLAN; a data-centre segment can easily reserve twenty.
IPv4 prefix reference: block size, usable hosts and mask
| Prefix | Subnet mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 | Whole private range, never one VLAN |
| /17 | 255.255.128.0 | 32,768 | 32,766 | Site summary |
| /18 | 255.255.192.0 | 16,384 | 16,382 | Site summary |
| /19 | 255.255.224.0 | 8,192 | 8,190 | Building summary |
| /20 | 255.255.240.0 | 4,096 | 4,094 | Building summary |
| /21 | 255.255.248.0 | 2,048 | 2,046 | Large campus VLAN (rare) |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Practical upper limit for a user VLAN |
| /23 | 255.255.254.0 | 512 | 510 | Large floor or wireless SSID |
| /24 | 255.255.255.0 | 256 | 254 | The default user VLAN everywhere |
| /25 | 255.255.255.128 | 128 | 126 | Small office, server segment |
| /26 | 255.255.255.192 | 64 | 62 | Branch LAN, DMZ |
| /27 | 255.255.255.224 | 32 | 30 | Management VLAN |
| /28 | 255.255.255.240 | 16 | 14 | Small DMZ, ISP handoff |
| /29 | 255.255.255.248 | 8 | 6 | ISP handoff with a few VIPs |
| /30 | 255.255.255.252 | 4 | 2 | Classic point-to-point link |
| /31 | 255.255.255.254 | 2 | 2 | Point-to-point link (RFC 3021) |
| /32 | 255.255.255.255 | 1 | 1 | Loopback, host route, VIP |
Total addresses = 2^(32−n). Usable = total − 2 except at /31 and /32, where no network or broadcast address is reserved.
RFC 3021 and the /31 link
RFC 3021, Using 31-Bit Prefixes on IPv4 Point-to-Point Links, removes the network and broadcast reservation for /31 prefixes. On a link with exactly two interfaces there is nobody to broadcast to and nothing to name, so both addresses become assignable. Every mainstream router platform has supported it for well over a decade, and using /31s instead of /30s halves the address cost of a routed core. The one place it fails is a shared segment: if a third device could ever appear, or the interface is a broadcast Ethernet LAN rather than a routed point-to-point link, stay with /30.
Mistakes that make a host count wrong
- Forgetting that the gateway is a host. A /24 has 254 usable addresses, not 254 client addresses. Subtract the gateway, the HSRP or VRRP peers, and the virtual IP before you set the DHCP pool size.
- Sizing the DHCP scope to the whole subnet. Static assignments, reservations and the router all live inside the same range. Overlapping a scope with a statically assigned server is one of the most common causes of an address conflict.
- Assuming subtract-2 always applies. It does not at /31 or /32, and it never applied inside IPv6, where the equivalent reservation does not exist.
- Confusing the block size with the increment. The block size and the increment in the interesting octet are the same number, but only in the octet where the mask is neither 0 nor 255. A /26 increments by 64 in the fourth octet; a /18 increments by 64 in the third.
- Ignoring the broadcast domain. The arithmetic will happily hand you a /16. The switch fabric will not thank you for it.
- Planning with no growth allowance at all. Renumbering a live VLAN is far more expensive than allocating a block one size larger on day one — provided you are not crossing a boundary that doubles your consumption for nothing.
Where this fits with the other addressing tools
This calculator answers how big. It deliberately does not care which block: it takes no IP address, so the answer for a /26 is the same whether the range is 192.168.4.64/26 or 203.0.113.128/26. When you need the actual network number, broadcast address and first and last usable host for a specific address, use the IPv4 subnet calculator. When you only need to translate between /26 and 255.255.255.192, the subnet mask to CIDR converter is faster.
The design method that uses all three is variable-length subnet masking (VLSM). You list every segment with its host requirement, size each one with the logarithm above, sort the list largest-first, and allocate from a single parent block in that order. Sorting largest-first matters: allocate a /30 out of the middle of a /24 and you can no longer carve a /25 from it, because CIDR blocks must start on an address that is a multiple of their own size. Allocating big-to-small keeps every boundary aligned automatically.
Two practical extensions sit outside this tool. Summarisation asks the reverse question — given a set of contiguous, aligned subnets, what is the shortest prefix that covers exactly them — and is what keeps a routing table small. And IPv6 changes the arithmetic entirely: interface identifiers are 64 bits by convention, so every LAN gets a /64 regardless of how many hosts it holds, and host-count sizing simply stops being a design activity. If your capacity problem is really a throughput problem, the bandwidth requirement calculator sizes the circuit those hosts will share, and the Mbps to MB/s converter translates the answer into the units an end user recognises.
Key terms
- Prefix length
- The number of leading bits in an IPv4 address that identify the network, written after a slash. /24 means the first 24 bits are the network.
- Block size
- The total number of addresses in a prefix, 2 raised to the number of host bits. Always a power of two, and always the spacing between consecutive subnets of the same size.
- Directed broadcast
- The address in which every host bit is 1. Historically it reached every host on the segment; most modern routers drop directed broadcasts arriving from off-link, but the address stays unassignable.
- VLSM
- Variable-length subnet masking — dividing one parent block into subnets of different sizes so each segment gets a prefix matched to its host count instead of a uniform /24.