What this tool helps you work out
A subnet mask separates the network portion of an IPv4 address from the host portion. CIDR notation writes the same idea as a slash followed by the number of network bits, such as /24.
Enter your details
Before you begin
Check whether the address is intended for a normal LAN, a point-to-point link or a routed block. Traditional usable-host counts exclude the network and broadcast addresses, but special prefixes such as /31 and /32 have different uses.
Use measured values where possible and leave headroom for busy periods, overhead and future growth.
How the result is worked out
IPv4 addresses contain 32 bits. The prefix length fixes the network bits and leaves the remainder for host addresses. For a conventional subnet, total addresses = 2^(32 − prefix), and usable hosts are normally total addresses minus two.
Worked example
For 192.168.10.37/24, the mask is 255.255.255.0. The network is 192.168.10.0, the broadcast address is 192.168.10.255 and the conventional usable range is 192.168.10.1 to 192.168.10.254.
Practical tips
- Do not assign the same static address to two devices.
- Keep the DHCP pool separate from manually assigned addresses unless reservations are used.
- Record the gateway, DNS servers, VLAN and prefix—not just the IP address.
- Check the router or network design before changing an address on a managed network.
Why subnetting exists at all
An IPv4 address is 32 bits, written as four numbers so humans can read it. Those bits are split into a network part and a host part, and the prefix length is simply where the split falls. A /24 puts the boundary after 24 bits, leaving 8 bits for hosts; a /25 moves it one bit along, halving the hosts and doubling the number of networks.
The reason to split a network at all is rarely address conservation on a home or small office network — there are more than enough private addresses to go round. The real reasons are containment and control. Broadcast traffic stays within its subnet, so a chatty device or a broadcast storm affects one segment rather than everything. Traffic between subnets has to pass through a router, which is where filtering, logging and rate limiting can be applied. And segments can be given different rules: guest wireless that cannot reach the file server, cameras that cannot reach the internet, a lab network that cannot break the rest of the house.
Each bit added to the prefix halves the host space, because binary. Going /24 to /25 to /26 to /27 gives 254, 126, 62 and 30 usable hosts. This is why subnet sizes come in the sequence they do, and why there is no such thing as a subnet holding exactly 100 hosts — you take the 126 and waste the remainder, or you take 62 and it does not fit.
The private ranges, and picking one sensibly
Three IPv4 ranges are reserved for private use and are never routed on the public internet. Any of them can be used on an internal network.
| Range | Prefix | Addresses | Typically used by |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | ~16.7 million | Larger organisations, and anyone wanting room to segment |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | ~1 million | Docker and various virtualisation platforms by default |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 | Almost every home router out of the box |
There is a practical argument for moving off the defaults. Nearly every consumer router ships on 192.168.0.0/24 or 192.168.1.0/24, which means that when you connect to a VPN — for work, or from a hotel — there is a good chance the network at the other end uses the same range as the one you are sitting on. When that happens the routing is ambiguous and the connection behaves strangely or not at all. Choosing something unusual, such as 192.168.87.0/24 or a slice of 10.x, avoids a problem that is tedious to diagnose after the fact.
Common prefix lengths and what they are for
| Prefix | Mask | Usable hosts | Typical use |
|---|---|---|---|
| /30 | 255.255.255.252 | 2 | A point-to-point link between two routers |
| /29 | 255.255.255.248 | 6 | A small block of static addresses from an ISP |
| /28 | 255.255.255.240 | 14 | A rack of servers, or an isolated segment |
| /27 | 255.255.255.224 | 30 | Guest wireless, or a camera VLAN |
| /26 | 255.255.255.192 | 62 | A department or a floor |
| /24 | 255.255.255.0 | 254 | The default almost everywhere |
| /23 | 255.255.254.0 | 510 | Where a /24 has run out and splitting is not wanted |
A /31 is a special case: it has no usable hosts by the normal rules, but is permitted on point-to-point links where the network and broadcast addresses have no meaning, which saves two addresses per link on networks with many of them.
Where subnetting goes wrong in practice
- Overlapping ranges. Two networks using the same private range cannot route to each other without translation. It is the single most common cause of a VPN that connects but carries no traffic.
- A DHCP pool that spans the whole subnet. Leave room outside the pool for static addresses — printers, servers, access points, anything that needs to be found at a fixed address. Reserving the bottom or top fifty is a common convention.
- Mismatched masks on the same segment. Two devices with the same network address but different prefix lengths will disagree about who is local. One can reach the other and not vice versa, which produces symptoms that look like anything but a mask error.
- Assuming a bigger subnet is better. A /16 on a flat network puts 65,000 potential hosts in one broadcast domain. Long before it fills, broadcast traffic becomes the limiting factor.
- Forgetting the gateway. Every host needs to know the router's address on its own subnet, and that address must sit inside the subnet. It usually does not matter whether it is the first or last usable address, but it should be consistent across the network.
- Renumbering without planning. Changing a subnet means every static address, every DHCP reservation, every firewall rule and every hard-coded reference has to change with it. Choose sensibly at the start.
Frequently asked questions
What does /24 mean?
It means the first 24 of the 32 IPv4 bits identify the network. It is equivalent to subnet mask 255.255.255.0.
Why are two addresses usually unavailable to hosts?
The all-zero host value identifies the network and the all-one host value is the broadcast address in a conventional subnet.
What is a /32 address?
It represents one IPv4 address with no host bits, commonly used for routes, loopbacks or host-specific rules.
Can I use any private IPv4 range at home?
Private ranges are intended for internal networks, but avoiding overlap matters when connecting sites or VPNs.
How can I see my Windows subnet mask?
Run ipconfig in Command Prompt, or use Get-NetIPConfiguration and related NetTCPIP PowerShell commands.
What is the difference between a subnet mask and a CIDR prefix?
They express exactly the same thing in two notations. The prefix counts how many leading bits identify the network; the mask writes those bits out as an address with all the network bits set to one. A /24 and 255.255.255.0 are identical. Older equipment and Windows dialogue boxes tend to use masks, while routers, documentation and anything modern use prefixes.
Can I use any private range I like?
On your own network, yes — the three private ranges exist precisely so that anyone can use them internally without coordination. The practical constraint is avoiding collisions with networks you connect to. If you use a work VPN, avoid whatever range that network uses, and avoid the consumer defaults of 192.168.0.x and 192.168.1.x, which are the ranges most likely to clash with someone else's.
Why can I not use the first and last addresses?
The all-zeros host value identifies the network itself, and the all-ones value is the broadcast address for that network. Neither can be assigned to a device, which is why a /24 has 256 addresses but 254 usable ones. The exception is a /31 on a point-to-point link, where both addresses are usable because there is no meaningful broadcast between exactly two devices.
Does any of this apply to IPv6?
The principle does, but the arithmetic is entirely different. IPv6 addresses are 128 bits, and a /64 is the standard size for a single network segment — an address space so large that host counting stops being meaningful. Subnetting in IPv6 is about hierarchy and routing rather than conserving addresses.
Related networking tools
References
- RFC 4632: Classless Inter-domain Routing
- Microsoft: TCP/IP addressing and subnetting basics
- Microsoft: ipconfig command
Official guidance and standards can change. Check the linked source when applying the result to an important network.