IPv4 subnet calculator

Address  11000000.10101000.00000001.00001010
Netmask  11111111.11111111.11111111.00000000

How to use the subnet calculator

Type an IPv4 address with its prefix length, such as 192.168.1.10/24, or with a dotted netmask, such as 192.168.1.10 255.255.255.0. You can also type just the address and pick the prefix from the menu. The calculator shows the network address, netmask, wildcard mask, broadcast address, the first and last usable host, the number of usable hosts and what kind of address it is (private, public, loopback, CGNAT and so on). The binary view shows exactly which bits belong to the network and which to the host.

Below the results you get an ip addr command to assign the address, the network in CIDR form for firewall rules and routes, and a list of the smaller subnets you get if you split the network, for example a /24 into four /26 blocks.

To see the address and prefix your machine is using right now:

ip -br -4 addr
ip route

Example output:

lo               UNKNOWN        127.0.0.1/8
enp3s0           UP             192.168.1.23/24
default via 192.168.1.1 dev enp3s0 proto dhcp src 192.168.1.23 metric 100
192.168.1.0/24 dev enp3s0 proto kernel scope link src 192.168.1.23 metric 100

More ways to read and change addresses and routes are in the ip command cheat sheet.

CIDR prefixes and netmasks

An IPv4 address is 32 bits. The prefix length after the slash says how many of those bits, counted from the left, identify the network; the rest identify a host inside it. A netmask is the same information written as an address: 24 one-bits followed by 8 zero-bits is 255.255.255.0. The wildcard mask is the inverse (0.0.0.255) and is what Cisco ACLs and some routing software expect.

Each step of one bit doubles or halves the size of the network. A valid netmask always has its one-bits contiguous from the left, so 255.255.255.0 is valid and 255.0.255.0 is not; the calculator rejects masks like that and recognises wildcard masks typed by mistake.

Network, broadcast and usable hosts

In a normal subnet the first address (all host bits 0) is the network address and the last address (all host bits 1) is the broadcast address. Neither can be given to a machine, which is why a /24 has 256 addresses but only 254 usable hosts, and the router usually takes one of those. If you type the network or broadcast address itself, the calculator points this out.

Two prefixes are special. A /31 has only two addresses, and RFC 3021 lets both be used as hosts on a point-to-point link, with no network or broadcast address; Linux supports this, and it saves address space on router links. A /32 is a single address. You see it on loopback interfaces, WireGuard peers (AllowedIPs = 10.0.0.2/32), host routes and firewall rules that match exactly one machine.

Private and special address ranges

Home and office networks use the private ranges from RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These are not routed on the internet, so traffic reaches the outside through NAT on your router. Other ranges the calculator labels:

• 100.64.0.0/10: carrier-grade NAT. If your router's WAN address is in this range, your ISP shares one public IP between customers and port forwarding from the internet will not work.
• 169.254.0.0/16: link-local. A machine picks one of these when it asked for DHCP and nobody answered, which is a sign of a cable, Wi-Fi or DHCP server problem.
• 127.0.0.0/8: loopback, the machine itself.
• 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24: reserved for documentation and examples.

Two hosts can only talk directly when they are in the same subnet. If one has 192.168.1.20/24 and the other 192.168.2.20/24, packets must go through a router, and a missing route shows up as No route to host or Network is unreachable.

Using the result on Linux

The ip addr add command from the calculator is temporary. For an address that survives a reboot, put the same CIDR value into NetworkManager or netplan, as shown in the static IP guide and the nmcli cheat sheet:

sudo nmcli con mod 'Wired connection 1' ipv4.method manual \
  ipv4.addresses 192.168.1.10/24 ipv4.gateway 192.168.1.1
sudo nmcli con up 'Wired connection 1'

The network form (192.168.1.0/24) is what firewall rules and routes expect, for example sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp; see the firewall cheat sheet for the firewalld version. For the command line, ipcalc is packaged on Debian, Ubuntu, Fedora and Arch, although the Fedora version is a different program with different options.

A note on IPv6 prefixes

This calculator handles IPv4 only. IPv6 also uses prefix lengths, but the conventions are simpler: a LAN segment is almost always a /64, so stateless autoconfiguration (SLAAC) works, and an ISP typically delegates a /56 or /48 to a customer, giving 256 or 65,536 such LANs. There is no broadcast address (multicast replaces it) and no netmask notation. Every interface also has a link-local fe80::/64 address, which is why ip -6 addr shows an IPv6 address even on networks without IPv6 routing. The Linux networking basics guide covers both protocols.

Frequently asked questions