A subnet (subnetwork) is a logical division of an IP network into smaller, isolated segments. Subnets matter for three reasons: (1) Routing efficiency — routers use subnet information to forward packets to the correct network segment without needing to know every individual host IP. (2) Security segmentation — devices in different subnets cannot communicate directly without passing through a router or firewall, enabling access control between segments. (3) Broadcast containment — layer-2 broadcasts are contained within their subnet, preventing broadcast storms that would cripple a large flat network. A /24 subnet of 254 hosts generates a manageable broadcast domain; a single flat network of 10,000 devices would be unmanageable.

CIDR (Classless Inter-Domain Routing) notation represents an IP address and its routing prefix as IP/prefix-length — for example, 192.168.1.0/24. The /24 means the first 24 of 32 bits are the network portion (equivalent to subnet mask 255.255.255.0), leaving 8 bits for hosts (256 total addresses, 254 usable). The prefix can be any number from /0 (covers all 4 billion IPv4 addresses, the default route) to /32 (covers exactly one IP address, a host route). CIDR replaced the older classful A/B/C system because it allows allocating any size block — a /22 for 1,022 hosts, a /28 for 14 hosts — rather than being forced into 256 or 65,536.

Perform a bitwise AND between the IP address and the subnet mask. Both must be in 32-bit binary form. For 192.168.1.100 with subnet mask 255.255.255.0: wherever the mask has a 1, keep the IP's bit; wherever the mask has a 0, set to 0. This gives 192.168.1.0 — the network address. Our calculator accepts any host IP (e.g. 192.168.1.100/24) and automatically computes the network address for you — the binary visualizer shows exactly which bits are the network portion (blue) and which are the host portion (grey).

Every subnet reserves its first and last addresses. The first address (all host bits = 0) is the network address — it identifies the subnet itself and is used in routing tables. For 192.168.1.0/24, this is 192.168.1.0. The last address (all host bits = 1) is the broadcast address — sending a packet here reaches every device on the subnet simultaneously. For 192.168.1.0/24, this is 192.168.1.255. Neither can be assigned to a device. Therefore /24 has 254 usable hosts. Exception: /31 subnets per RFC 3021 have no reserved addresses and are used for point-to-point router links where no broadcast is needed. /32 is a single-host route with 1 usable address.

The formula is 2^(32−prefix) − 2: /24 = 254 hosts (256 − 2), /25 = 126 hosts (128 − 2), /26 = 62 hosts, /27 = 30 hosts, /28 = 14 hosts, /29 = 6 hosts, /30 = 2 hosts (standard for WAN point-to-point), /31 = 2 hosts with 0 reserved (RFC 3021), /32 = 1 address (single host route). For larger networks: /23 = 510, /22 = 1,022, /21 = 2,046, /20 = 4,094, /16 = 65,534, /8 = 16,777,214. In AWS, subtract 5 additional IPs per subnet (AWS reserves 5 addresses in every subnet for its infrastructure).

A wildcard mask is the bitwise complement (inverse) of the subnet mask — calculated as 255.255.255.255 minus the subnet mask. For /24 (mask 255.255.255.0), the wildcard is 0.0.0.255. Wildcard masks specify which bits must match (0 = must match) and which can be anything (1 = ignore). They are used in: Cisco IOS ACLs (access-list 10 permit 192.168.1.0 0.0.0.255 — permit entire /24 subnet), OSPF network statements (network 10.0.0.0 0.255.255.255 area 0), BGP prefix-list, and Cisco IOS extended ping. AWS Security Groups and iptables use CIDR notation instead.

VLSM (Variable Length Subnet Masking) uses different-sized subnets within the same parent block to match actual host requirements rather than wasting space with identically-sized subnets. Use VLSM when different segments need different numbers of hosts — /25 for 100 hosts, /27 for 25 hosts, /30 for a WAN point-to-point link. VLSM is supported by all modern routing protocols (OSPF, EIGRP, BGP, RIP v2) and is the standard for modern network design. RIP v1 is the only protocol that doesn't support VLSM — it requires all subnets to use the same mask (called "classful" routing).

Both serve point-to-point router links but differ in efficiency. /30 has 4 addresses: network, 2 usable hosts, broadcast — wasting 2 of 4 addresses (50%). /31 per RFC 3021 has 2 addresses with no network or broadcast reservation — both addresses are usable, giving zero waste. /31 is more efficient and is recommended for modern networks. Most current Cisco, Juniper, and Linux implementations support RFC 3021. /30 is still common due to legacy equipment compatibility. The practical difference: a /30 WAN link uses 4 IPs from your addressing scheme; a /31 uses only 2.

/32 is a host route — it represents exactly one single IP address (all 32 bits are the network portion, zero host bits). /32 is used in: routing tables to create a specific route to a single host (often for loopback addresses or policy-based routing), firewall rules to permit or deny exactly one IP address, AWS security group rules (203.0.113.42/32 allows only that one IP), anycast configurations where one IP needs to be reachable from multiple locations, and load balancer virtual IPs. In a routing table, /32 has the highest specificity and always wins over less-specific routes by the longest-prefix-match rule.

Yes — completely free, no signup, no account required. All calculations run entirely in your browser using JavaScript bitwise operations. No IP addresses, network configurations, or any input data is transmitted to our servers — there are no API calls to any external service. This makes it completely safe to use with sensitive internal network addressing schemes, corporate infrastructure planning, or any private IP ranges. Results are available instantly as you type, with no page reloads.