IP Subnet Calculator: CIDR, Netmask, Broadcast, Binary and VLSM Planner

What this IP subnet calculator is for

Subnet math is easy to get almost right. And that “almost” is the part that burns you. An address can look completely at home and still sit in a different block than the firewall rule you wrote for it. A /24 feels comfortable right up until someone asks you to carve a VLAN out of it. Honestly, I think most outages I’ve chased back to “networking” were really just a mask somebody eyeballed. I’ve watched a VPN design that was flawless on the whiteboard collide head-on with an office network the second it went live. So this does the boring part. Feed it an address and a prefix, get back the numbers I’d otherwise check by hand before I change a route, a DHCP pool, an ACL, or a wiki page.

The summary tab covers what you reach for most: network ID, broadcast, first and last usable address, the total count, the real host count, the mask, the wildcard. The other tabs exist to show the why. Binary boundary lights up the exact spot where network bits stop and host bits start. The membership check just tells you, yes or no, whether a second address lives in the same block. Then the two planners. Even splits and VLSM are there for the day one parent network has to feed a whole pile of smaller ones, which is most days, in my experience.

How to read an IPv4 subnet report

• The network ID names the block. Don’t hand it to a host. It’s the label on the door, not a seat inside.
• The broadcast is the very last address in a classic IPv4 subnet, and it’s spoken for too.
• Everything between network and broadcast is your usable range. For most prefixes, anyway.
• The subnet mask is just the prefix written out in dotted form. A /24 shows up as 255.255.255.0.
• The wildcard mask is that same mask flipped inside out, which is the form a lot of ACL and routing syntax actually wants.
• Host bits set how big the block gets. Network bits decide which block you’re even looking at.

Why /31 and /32 need a careful reading

Every IPv4 lesson I’ve sat through teaches network plus usable hosts plus broadcast, always with a tidy /24 or /30. Fine. That gets you 90% of the way. But it skips the two cases that trip people up later. A /31 goes on a point-to-point link, where both addresses are real endpoints and there’s no broadcast left to waste. A /32 is one address standing alone: a host route, a loopback in your docs, a single line in an allowlist. So a calculator that just subtracts two from every prefix is quietly lying to you on the edges. Mine refuses to.

Subnet planning and VLSM in practice

Even splits are the easy call when your VLANs all want roughly the same room. Cut a /24 into four, every child lands on a /26, and you’re done thinking about it. VLSM is for when the sizes are all over the place: a user network screaming for 120 hosts sitting right next to a management VLAN that needs a grand total of 12. The one rule I never break is to place the biggest need first. It keeps the gaps from piling up, and it keeps the plan readable for whoever reviews it six months from now (probably you, having forgotten everything). Leave headroom. Carve out the gateway and the infrastructure addresses on purpose. And write down which parent each chunk came out of, because nobody remembers that part.

Common mistakes worth catching early

• Dropping a host IP into a firewall or a route where it really wanted the network ID. Classic.
• Mixing up the prefix, the dotted mask, and the wildcard. Same idea worn three ways, and they do not forgive a swap.
• Letting a DHCP pool sprawl over the gateway and the infrastructure addresses you meant to keep reserved.
• Designing a private range that quietly overlaps a VPN, a cloud VPC, or a remote office. You won’t notice until traffic just vanishes.
• Assuming a public range plays by the same relaxed rules as your RFC1918 lab. It doesn’t.

Common questions

Can I enter a netmask instead of a CIDR prefix?

Go for it. Type a prefix like /23, or the dotted 255.255.254.0, whichever you’ve got in front of you. One thing I check: the dotted mask has to be contiguous. So a typo that scatters the one-bits gets caught here instead of quietly poisoning your math three steps later.

Does the compare field prove routing will work?

Nope. Don’t let it fool you. All it tells you is whether two addresses land in the same calculated subnet. Whether packets actually move is a separate question entirely, and it depends on your routing, your VLANs, your firewall, and the masks sitting on the hosts themselves. Same subnet is the floor, not the proof.

Should I use VLSM for every design?

I wouldn’t, honestly. Reach for VLSM when your subnets genuinely need different sizes. If the only win is clawing back a handful of private addresses, even blocks are easier to read and easier to run, and that matters more than it sounds when you’re squinting at a config on a 3 a.m. call. Maybe that’s just me being lazy. I’ll take lazy and correct.

What does a /24 subnet mean?

The 24 is the prefix length. So 24 bits belong to the network and 8 are left for hosts. That works out to 256 addresses, 254 of them usable. Slide the number around and the scale jumps fast: a /16 hands you 65536, while a /30 leaves a grand total of 4 (2 usable).

How many usable hosts are in a subnet?

Take the total, lop off two. The network address and the broadcast are both reserved on a classic subnet, so they don’t count. A /24 lands at 254 usable. The /31 and /32 cases break this rule though, which is the whole reason I call them out on their own.

What is CIDR notation?

CIDR (Classless Inter-Domain Routing) just means writing an address with its prefix tacked on, like 192.168.1.0/24. It buried the old class A/B/C system years back. The point was simple: size a subnet to fit the need, instead of swallowing a whole class at a time and wasting most of it.