What a subnet calculator actually resolves
A router does not store the address you configured on an interface. It stores the prefix — a network number and a length — and it derives that prefix by masking the host bits out of whatever address you typed. This calculator performs the same derivation, which is why you can paste any host address from a running configuration and get the block it belongs to.
Three facts drive every field on the page. First, a prefix of length n leaves 32 − n host bits, so the block holds 232−n addresses. Second, blocks are aligned: a block of size B always begins at an address that is an exact multiple of B. That is not a convention, it is forced by the definition — the network number is the address with its low bits zeroed, and zeroing the low bits is the same operation as rounding down to a multiple of the block size. Third, the lowest address in the block names the network and the highest is the directed broadcast, so neither goes on an interface.
Alignment is what surprises people. 192.168.1.130/26 does not create a subnet starting at .130. A /26 has a block size of 64, so the blocks in that /24 start at .0, .64, .128 and .192, and .130 falls in the third one. The network is 192.168.1.128, the broadcast is 192.168.1.191, and the usable range is .129 to .190.
The mask, the wildcard, and why AND is really division
The subnet mask is a 32-bit value with n leading ones followed by 32 − n zeros. Written as an integer it is 232 − 232−n. Written in dotted decimal it is one of just nine legal octet values — 0, 128, 192, 224, 240, 248, 252, 254, 255 — because a valid mask can never have a zero followed by a one.
To find the network you AND the address with the mask, which clears every host bit. AND with a mask of leading ones is exactly the same arithmetic as dividing by the block size, discarding the remainder and multiplying back — and that form is safer to implement, because JavaScript's bitwise operators work on signed 32-bit integers and turn any address above 127.255.255.255 negative. This page uses the division form for that reason.
The wildcard mask is the bitwise complement of the subnet mask, or equivalently the block size minus one. Cisco IOS access lists and OSPF network statements take wildcards rather than masks, so a /26 is 0.0.0.63 in an ACL and 255.255.255.192 on the interface. They are the same information written upside down; confusing them is one of the most common lab errors on the CCNA.
To split a block, add bits. Dividing a /24 into four subnets needs two extra bits, giving four /26s that start at the multiples of 64. Dividing into eight needs three bits and eight /27s. The rule is simply child prefix = parent prefix + log2(number of subnets), and the number of subnets must be a power of two because you can only add whole bits.
Worked example: 172.16.35.200/22 by hand
You find 172.16.35.200/22 on a firewall interface and need the block.
- Find the host bits. 32 − 22 = 10 host bits.
- Find the block size. 210 = 1,024 addresses. Since 1,024 = 4 × 256, the block spans four whole third-octet values, so the increment is 4 in the third octet.
- Find the mask. Twenty-two ones is 255.255.252.0 — the third octet holds 6 of the ones, and 256 − 28−6 = 256 − 4 = 252.
- Round the third octet down to a multiple of 4. 35 ÷ 4 = 8 remainder 3, so 8 × 4 = 32. The network is 172.16.32.0.
- Add the block and step back one. The block covers third octets 32, 33, 34 and 35, so the last address is 172.16.35.255 — the directed broadcast.
- Take the usable range. First host 172.16.32.1, last host 172.16.35.254, for 1,024 − 2 = 1,022 usable addresses.
- Write the wildcard. 1,024 − 1 = 1,023 =
0.0.3.255, which is what an ACL entry for this subnet uses. - Classify it. 172.16.0.0/12 runs from 172.16.0.0 to 172.31.255.255, so this address is RFC 1918 private space.
The only step that needs thought is step 4, and the shortcut is always the same: divide the octet the mask lands in by the increment, discard the remainder, multiply back.
How to read the result
If the network address differs from the address you typed, that is normal and correct. It means you entered a host, not the block. Configure the host address on the interface and use the network address in routing statements, ACLs and documentation.
Check the scope field before you assume an address is routable. Anything in 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 is private and needs NAT to reach the internet. 100.64.0.0/10 is carrier-grade NAT space that some ISPs hand to customers and that will collide with your internal plan if you also use it. 169.254.0.0/16 means DHCP failed. 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 exist only for documentation and examples — if you find one in production, someone copied a book.
Address class is history, not policy. The A/B/C classification in the notes reflects the first octet only, and CIDR replaced classful routing in 1993. It still matters in exactly two places: a router's default classful boundary for automatic summarisation on some legacy platforms, and exam questions.
A split table with one row per child subnet is a VLAN plan. Read down the network column and you get the increment: /26s step by 64, /27s by 32, /28s by 16. Those numbers are worth memorising, because they let you sanity-check any subnet boundary in your head.
Mask octet values and what each one means
| Octet value | Binary | Network bits in this octet | Increment | Example prefix |
|---|---|---|---|---|
| 0 | 00000000 | 0 | 256 | /16 (third octet) |
| 128 | 10000000 | 1 | 128 | /25 |
| 192 | 11000000 | 2 | 64 | /26 |
| 224 | 11100000 | 3 | 32 | /27 |
| 240 | 11110000 | 4 | 16 | /28 |
| 248 | 11111000 | 5 | 8 | /29 |
| 252 | 11111100 | 6 | 4 | /30 |
| 254 | 11111110 | 7 | 2 | /31 |
| 255 | 11111111 | 8 | 1 | /32 |
Octet value = 256 − increment, and increment = 2^(8 − network bits in that octet). Any other value, such as 255.255.255.200, is not a valid contiguous mask.
Reserved ranges you should recognise on sight
0.0.0.0/8 is “this network” and 0.0.0.0/0 is the default route. 127.0.0.0/8 is loopback. 169.254.0.0/16 is link-local, assigned when DHCP fails. 100.64.0.0/10 is shared address space for carrier NAT under RFC 6598 — do not use it internally. 224.0.0.0/4 is multicast, and 240.0.0.0/4 is reserved and unroutable on the public internet. 255.255.255.255 is the limited broadcast, which never leaves the local link.
Errors this calculator is designed to catch
- Assuming the address you typed is the network. 192.168.1.100/26 is a host in 192.168.1.64/26, not the start of a block at .100.
- Using a non-contiguous mask. A mask must be leading ones then zeros. 255.255.255.200 is not a mask, even though every octet is a legal number on its own.
- Swapping mask and wildcard. An ACL entry written with 255.255.255.192 instead of 0.0.0.63 matches almost nothing, and it does so silently.
- Believing 172.32.0.0 is private. RFC 1918's middle block is 172.16.0.0/12, which stops at 172.31.255.255. Everything from 172.32.0.0 upwards is public space belonging to someone else.
- Overlapping child subnets. Splitting a /24 into three subnets is not possible; you can only add whole bits, so the choices are 2, 4, 8, 16 and so on. Unequal sizes require VLSM, allocated largest-first from the parent.
- Configuring a /31 on a shared LAN. RFC 3021 applies to point-to-point links only. On a broadcast segment a /31 leaves you with no broadcast address and, on some platforms, no working ARP.
Where this sits among the addressing tools
Three questions come up when you plan addresses, and each has its own tool. Which block does this address belong to? is this page. How big a block do I need? is the hosts per subnet calculator, which works backwards from a device count to a prefix. What is /26 in dotted decimal? is the subnet mask to CIDR converter, which is the fastest route when all you need is a notation change.
Beyond a single block, the design task is VLSM: taking one parent allocation and cutting it into segments of different sizes. The method is mechanical. List every segment with its host requirement, size each with the host-count tool, sort largest-first, then allocate consecutively from the top of the parent. Largest-first matters because of alignment — a /30 placed in the middle of a /24 destroys the ability to carve a /25 from it, while allocating in descending size order keeps every remaining boundary usable.
Summarisation is the inverse operation and is what keeps routing tables small: given a set of adjacent, aligned subnets, find the shortest prefix that covers exactly those and nothing else. It only works when the set is both contiguous and aligned, which is the real reason disciplined allocation pays off years later.
Finally, remember that address planning and capacity planning are different exercises. A /22 can hold a thousand hosts, but whether the link those hosts share can carry them is a bandwidth question — size that with the network bandwidth requirement calculator — and whether the segment stays up is a reliability question, which the MTBF and availability calculator covers.