How to Calculate a Subnet Mask (With a Full CIDR Chart)

Subnetting has a reputation for being hard. It isn't. It has a reputation for being hard because it is almost always taught in binary first, and binary is the slowest possible way to understand it.

Here is the whole thing in one sentence: a subnet mask draws a line through an IP address, and everything left of the line is the network, everything right of it is the host. That's it. Every other rule in this guide is a consequence of that one idea.

If you just need the answer right now, open the free FileNaut Subnet Calculator, type your IP, pick the CIDR from the dropdown, and hit Calculate — you'll get the network address, broadcast address, subnet mask and usable host range instantly. It runs entirely in your browser, so nothing about your network topology is sent anywhere.

If you want to actually understand it — or you're sitting a CCNA exam where no calculator is allowed — the rest of this guide shows you how to do it by hand in about ten seconds using the block-size method, with a full CIDR chart you can bookmark.

An IPv4 address is 32 bits, written as four decimal numbers (octets) from 0 to 255. 192.168.1.130 is really this:

192      168      1        130
11000000.10101000.00000001.10000010

A subnet mask is also 32 bits, but with a strict rule: all the 1s come first, then all the 0s. Never mixed. The mask 255.255.255.192 is:

255      255      255      192
11111111.11111111.11111111.11000000
└──────────── 26 ones ────────┘└ 6 zeros ┘

Because there are 26 ones, we call this a /26. That's CIDR notation — it's just a count of the 1 bits, and it saves you writing the mask out in full.

The ones mark the network portion: the part every device on this subnet shares. The zeros mark the host portion: the part that changes from device to device. More ones means a bigger network prefix and therefore a smaller subnet with fewer hosts. This trips everyone up at first — a /30 is tiny and a /8 is enormous.

Because the 1s always come first, an octet in a subnet mask can only ever be one of nine values. Memorise this table and you can read any mask instantly:

Block size = 256 − the mask octet. That single formula is the whole shortcut, and it's what the next section is built on. A mask octet of 192 gives a block size of 64. A mask octet of 240 gives a block size of 16.

Let's do 192.168.1.130/26 without touching binary.

1. Write the mask. /26 = 8 + 8 + 8 + 2 bits. The first three octets are full (255), the fourth has 2 bits borrowed = 192. So the mask is 255.255.255.192.
2. Find the block size. 256 − 192 = 64. Your subnets start every 64 addresses in the last octet: 0, 64, 128, 192.
3. Find the network address. Which block does .130 fall into? It's between 128 and 191, so the network is 192.168.1.128.
4. Find the broadcast address. It's the last address in the block — one below the next block start. Next block starts at 192, so broadcast is 192.168.1.191.
5. Find the usable host range. Everything between the two, exclusive: 192.168.1.129 to 192.168.1.190.
6. Count the hosts. 64 addresses in the block, minus the network and broadcast = 62 usable hosts.

Six steps, no binary, about ten seconds once you've done it twice. Check yourself against the subnet calculator — enter 192.168.1.130 with /26 and you should get exactly those numbers back.

The general formulas, if you prefer them written out:

Total addresses  = 2 ^ (32 − CIDR)
Usable hosts     = 2 ^ (32 − CIDR) − 2
Block size       = 256 − (last non-255 mask octet)
Number of subnets when splitting = 2 ^ (bits borrowed)

By hand is good for learning and for exams. For actual work — sizing a VPC, writing a firewall rule, sanity-checking a colleague's diagram — use a calculator and move on.

1. Open the free FileNaut Subnet Calculator.
2. Type any IP address in the network into the IP Address field — it doesn't have to be the network address itself. 10.0.5.77 works just as well as 10.0.0.0.
3. Choose your prefix from the CIDR Mask dropdown, anywhere from /1 to /32.
4. Click Calculate.
5. Read off the network address, broadcast address, subnet mask, usable host count and full host range.

It's client-side JavaScript, so your addressing scheme is never uploaded — worth caring about, because internal IP ranges are exactly the kind of detail you shouldn't be pasting into a random website. Nothing to install, nothing to sign up for, and it works the same on a phone as on a laptop.

The reference table. Wildcard masks are included because ACLs on Cisco gear and some cloud firewall rules want the inverse mask rather than the subnet mask.

* /31 and /32 are special cases — see the next section. The intermediate prefixes (/9–/11, /13–/15, /17–/19) follow the same halving pattern; the calculator covers every value from /1 to /32.

In a /24 there are 256 addresses but only 254 usable ones, because two are reserved:

• The network address — all host bits set to 0. It names the subnet itself (192.168.1.0). You can't assign it to a device.
• The broadcast address — all host bits set to 1. Traffic sent here goes to every host on the subnet (192.168.1.255). Also unassignable.

Hence usable = total − 2 for every ordinary subnet. But there are two prefixes where that formula breaks down:

• /31 — point-to-point links. A /31 has only 2 addresses, so subtracting 2 leaves zero, which would make it useless. RFC 3021 (published in 2000) specifically allows both addresses in a /31 to be used as hosts on a point-to-point link, where there's no need for broadcast. Modern routers support this and it halves the address waste versus the old /30 convention. If you see a /31 on a router-to-router link, it isn't a mistake.
• /32 — a single host. One address, no network/broadcast concept at all. You'll see /32 constantly in firewall rules, route tables and allow-lists — it's how you say "this exact IP and nothing else".

Rule of thumb: the −2 applies from /1 through /30. Below that, you're in special-case territory.

The other half of subnetting is dividing a block you already own. Say you've been given 192.168.1.0/24 and you need four separate networks — one each for staff, guests, VoIP phones and servers.

You need 4 subnets, and 2² = 4, so you borrow 2 bits from the host portion: /24 + 2 = /26. Block size is 256 − 192 = 64, so the boundaries land every 64 addresses:

Four subnets, 62 usable hosts each. Size from the requirement backwards: pick the smallest prefix that still fits your largest segment, then round down. Need 100 devices on one VLAN? A /26 (62 hosts) is too small — go to /25 (126 hosts). Need 12 devices? /28 gives you 14 and wastes almost nothing.

Real networks aren't usually split evenly, and that's fine — VLSM (Variable Length Subnet Masking) just means using different prefix lengths inside the same parent block. A /24 can hold one /25, one /26 and two /27s quite happily, as long as none of them overlap.

These blocks (defined in RFC 1918) are reserved for internal use and are never routed on the public internet — which is why almost every home and office network uses one:

Two more you'll bump into: 169.254.0.0/16 is link-local (an address in this range means DHCP failed — that's the classic "self-assigned IP" problem), and 100.64.0.0/10 is carrier-grade NAT space, which is why some ISP connections can't accept inbound port forwards.

Note that 172.16.0.0/12 stops at 172.31.255.255, not 172.255.255.255. That one catches people out constantly — 172.32.0.0 is public address space.

• Memorise the nine mask octets, not the whole chart. 0, 128, 192, 224, 240, 248, 252, 254, 255. Everything else derives from them.
• Block size is the only formula you need under pressure. 256 minus the interesting octet. Networks start at multiples of it.
• Count backwards from the next network. The broadcast address is always one below the start of the next block — far quicker than working it out from binary.
• Size up, not tight. A subnet that's exactly big enough today is a renumbering project in eighteen months. Going one prefix wider is nearly free.
• Avoid 192.168.0.0/24 and 192.168.1.0/24 for anything that will ever be VPN'd. They're the two most common home defaults, so they collide constantly.
• Write CIDR, not dotted masks, in documentation. /26 is unambiguous; 255.255.255.192 invites transcription errors.
• Sanity-check every subnet plan with a calculator before it goes into config. Ten seconds in the subnet calculator beats an outage caused by an off-by-one broadcast address.