Why does a /24 have 254 usable addresses and not 256?

The first address is the network identifier and the last is the broadcast address, and neither can be assigned to a host. The exception is a /31, where RFC 3021 permits both addresses on a point-to-point link because broadcast is meaningless there.

What is the difference between a subnet mask and a wildcard mask?

They are bitwise complements. The subnet mask has ones where the network part is, 255.255.255.0. The wildcard mask has ones where the host part is, 0.0.0.255. Interface configuration wants the subnet mask; Cisco access control lists and OSPF network statements want the wildcard.

Why should IPv6 subnets always be /64?

Stateless address autoconfiguration builds the interface identifier from the lower 64 bits, so it stops working on a longer prefix. Neighbour discovery and privacy addressing assume the same boundary. Point-to-point links between routers are the accepted exception, where /127 is recommended by RFC 6164.

How many /64 subnets are in a /48?

65,536. Each additional bit of prefix length doubles the number of subnets, so /48 to /64 is 16 bits, giving 2 to the 16th. A /56 delegation gives 256 of them.

Can I use 10.0.0.0/8 for anything I want?

Inside your own network, yes. It is private space from RFC 1918 and is not routed on the internet. The practical constraint is overlap: if you and a network you will connect to by VPN both use 10.0.0.0/24, the tunnel will not work. Picking a random block inside 10/8 avoids the common collisions.

Subnet Calculator

Enter a CIDR block or an address and mask to get the network, broadcast, usable host range, counts, masks and prefix boundary.

Type a network such as 192.168.1.0/24. It also accepts 10.0.0.0/8, 10.0.0.1 255.0.0.0, 2001:db8::/48 and a bare address.

Canonical CIDR192.168.1.0/24

Network address192.168.1.0

Broadcast address192.168.1.255

First usable host192.168.1.1

Last usable host192.168.1.254

Usable hosts254

Total addresses256

Subnet mask255.255.255.0

Wildcard mask0.0.0.255

Prefix length/24

ClassClass CAn old way of grouping addresses. Classful addressing was replaced by CIDR in 1993 (RFC 1519), so the letter is history, not routing.

Reverse zone1.168.192.in-addr.arpa

Binary mask11111111.11111111.11111111.00000000

Binary network11000000.10101000.00000001.00000000Teal digits are the network part fixed by the /24 boundary, and never change inside this block. Grey digits are host bits, and they count the devices.

Split intoDivide this block into equal smaller blocks.

The calculator updates as you type once JavaScript runs. The block above was worked out on the server, so the numbers you see are real. Change the address in the URL, as in ?q=10.0.0.0/8, to calculate another network without JavaScript.

Private ranges worth remembering

Block	Prefix	Addresses	Typical use
10.0.0.0/8	RFC 1918	16,777,216	Large private networks, VPN address pools
172.16.0.0/12	RFC 1918	1,048,576	Docker defaults, mid-size networks
192.168.0.0/16	RFC 1918	65,536	Home routers, almost always as a /24
100.64.0.0/10	RFC 6598	4,194,304	Carrier-grade NAT, not yours to use
169.254.0.0/16	RFC 3927	65,536	Link-local, assigned when DHCP fails

100.64.0.0/10 is shared address space reserved for ISPs. Using it inside your own network collides with your ISP’s CGNAT and produces failures that are difficult to diagnose.

Everything runs locally

The calculator is client-side JavaScript. No network request carries the value you type. That matters because the blocks people paste into a subnet calculator are frequently internal network diagrams, and there is no reason for us to see them.

About this tool

Enter an IPv4 or IPv6 block in CIDR notation, or an address with a dotted-decimal mask. The calculator returns the network and broadcast addresses, the first and last usable host, the total and usable host counts, the subnet mask, the wildcard mask, and a binary view of the prefix boundary. Those are the numbers router and firewall configuration asks for, and all arithmetic happens in your browser.

How to read the result

Network address: The first address in the block, with every host bit set to zero, and it names the subnet and cannot be given to a host in IPv4. In IPv6 the all-zeros host part is the subnet-router anycast address (RFC 4291), reserved rather than usable.
Broadcast address: The last address in an IPv4 block, with every host bit set to one, and traffic sent to it reaches every host on the subnet. IPv6 has no broadcast address at all and uses multicast instead, so this row is absent for IPv6.
Usable host range and count: The addresses you can assign to devices, which for IPv4 is the total minus the network and broadcast addresses, so a /24 gives 254. The exceptions are /31, which gives 2 usable addresses for a point-to-point link (RFC 3021), and /32, a single host route.
Subnet mask and wildcard mask: Two ways of writing the same boundary. The subnet mask is the prefix in dotted decimal, so /24 is 255.255.255.0, and the wildcard mask is its bitwise complement, 0.0.0.255, which Cisco access lists and some routing protocol statements expect.
Binary boundary view: The address in ones and zeros with the prefix boundary marked, which is the fastest way to spot an overlap or to check whether a supernet aggregates cleanly. Two blocks aggregate only if they are the same size, adjacent, and the lower one starts on a boundary of the combined size.
IPv6 prefix notes: In IPv6 a subnet is normally a /64, which SLAAC requires, and a /56 or /48 is the usual delegation to a customer site, holding 256 or 65,536 of those /64 subnets. Subnetting longer than /64 breaks address autoconfiguration and is a common mistake.

Questions people ask

Why does a /24 have 254 usable addresses and not 256?: The first address is the network identifier and the last is the broadcast address, and neither can be assigned to a host. The exception is a /31, where RFC 3021 permits both addresses on a point-to-point link because broadcast is meaningless there.
What is the difference between a subnet mask and a wildcard mask?: They are bitwise complements. The subnet mask has ones where the network part is, 255.255.255.0. The wildcard mask has ones where the host part is, 0.0.0.255. Interface configuration wants the subnet mask; Cisco access control lists and OSPF network statements want the wildcard.
Why should IPv6 subnets always be /64?: Stateless address autoconfiguration builds the interface identifier from the lower 64 bits, so it stops working on a longer prefix. Neighbour discovery and privacy addressing assume the same boundary. Point-to-point links between routers are the accepted exception, where /127 is recommended by RFC 6164.
How many /64 subnets are in a /48?: 65,536. Each additional bit of prefix length doubles the number of subnets, so /48 to /64 is 16 bits, giving 2 to the 16th. A /56 delegation gives 256 of them.
Can I use 10.0.0.0/8 for anything I want?: Inside your own network, yes. It is private space from RFC 1918 and is not routed on the internet. The practical constraint is overlap: if you and a network you will connect to by VPN both use 10.0.0.0/24, the tunnel will not work. Picking a random block inside 10/8 avoids the common collisions.

Last reviewed 2026-09-05.