How we calculate: subnet calculator

This page describes exactly what the calculator's code (subnet.js) computes, so that anyone can check a result by hand. Its limits are listed in What the calculator does not cover, and a table of all IPv4 prefixes is in Prefix cheat sheet.

Every symbol has one meaning on the whole page. All of them are in the "Symbols" panel (on a phone: the button at the bottom of the screen), and hovering over or tapping a symbol in a formula shows what it means. An address is treated as one whole number: IPv4 has 32 bits, IPv6 128. AND, OR and NOT work on each bit separately.

1. Address, prefix and mask

IPv4 is written as four numbers 0–255 separated by dots; each is 8 bits. Numbers with a leading zero (e.g. 010) are refused, because some systems read them as octal (010 = 8). IPv6 is eight groups of 1–4 hex digits separated by colons; once in an address "::" replaces one or more groups of zeros, and the last 32 bits may be written like IPv4 (::ffff:192.0.2.1). Upper or lower case does not matter.

The prefix tells how many first bits of the address are the network number. The mask is the same bits written like an address:

Example: /26 is 26 ones and 6 zeros, which is 255.255.255.192; the wildcard is 0.0.0.63. A mask typed like an address (e.g. 255.255.252.0) is turned into a prefix by counting its ones; if the ones do not come one after another from the left (e.g. 255.0.255.0), it is not a subnet mask and the calculator reports an error.

2. Network address, broadcast and hosts (IPv4)

Example: 192.168.1.130/26. 130 = 10000010, the mask ends in 11000000, so AND gives 10000000 = 128: network 192.168.1.128, broadcast 192.168.1.191 (128 + 63), R = 2⁶ = 64, H = 62. The first address (the network address itself) and the last (the broadcast) are not given to devices. Exceptions: a /31 network is a point-to-point link of two devices where both addresses are theirs (RFC 3021), and a /32 is a single address (e.g. in routes and firewall rules). The typed address may be any address in the network: the calculator then shows which network it belongs to.

Fun fact: in the AWS and Azure clouds every IPv4 subnet loses three more addresses (router, DNS, reserved), 5 in total, so a /24 there has 251 addresses for machines. The calculator does not subtract them (both companies' documentation is in the sources).

The example packet (the "Packet header" panel)

The "Example" column is a ping (ICMP echo with 56 bytes of data) from the typed address (when a network address is typed: from the next one) to the documentation address 203.0.113.10 or 2001:db8::10, with the values Linux sets: TTL and hop limit 64, in IPv4 the DF flag, identification 0x3a1f (any). The IPv4 header checksum follows RFC 1071: the header is split into 16-bit words (with the checksum field set to 0), they are added up, carries above 16 bits are added back into the result, and finally every bit is inverted. Example: for 192.168.1.130 → 203.0.113.10 it is 0x0255.

3. Kind of address and class

The kind is the narrowest range in the table that holds the whole network. When the network only partly covers ranges from the table (e.g. 10.0.0.0/7 is the private 10.0.0.0/8 and the public 11.0.0.0/8), we say "several kinds of addresses". When it touches none: IPv4 is public, and IPv6 outside 2000::/3 is reserved. The table follows the IANA special-purpose address registries (RFC 6890), plus two blocks from the multicast registry (224.0.0.0/24, 239.0.0.0/8), without single addresses inside the IETF blocks and without deprecated blocks. The same list is in the calculator's "Special addresses" panel, with a description of every block:

The class (IPv4 only) follows from the first number of the typed address: A 0–127 (default /8), B 128–191 (/16), C 192–223 (/24), D 224–239 (multicast), E 240–255 (reserved). This is the division used before 1993, replaced by CIDR (RFC 4632); the calculator shows it only for information and always takes the mask from the prefix.

4. IPv6

IPv6 has no broadcast (multicast does that job), so every address of the network counts as available. Numbers above 10¹² are shown as a power of two with an approximation (e.g. 2⁶⁴ ≈ 1.84 × 10¹⁹). Addresses are written in the form recommended by RFC 5952: lower case, no leading zeros in groups, the longest run of at least two zero groups replaced by "::" (the first one if two runs are equally long), a single zero group stays 0; addresses in ::ffff:0:0/96 end in IPv4 notation.

Step by step shows the address as 32 hex digits; each digit is 4 bits, so the prefix covers d whole digits and s bits of the next one:

Example: 2001:db8:abcd:12ff::1/57: d = 14, s = 1. The 15th digit is f = 1111; the first bit stays (1000 = 8), so the network is 2001:db8:abcd:1280::/57 and the last address 2001:db8:abcd:12ff:ffff:ffff:ffff:ffff.

The "IPv6" tab: a prefix into /64 networks

Every local network in IPv6 is a /64, so a prefix from an ISP or a cloud (p ≤ 64) is split into /64 networks numbered i, from 0:

The number i is also shown in hexadecimal, with as many digits as the last network needs (⌈(64 − p) / 4⌉). Example: 2001:db8:ab00::/56 is 256 networks, from 2001:db8:ab00::/64 (00) to 2001:db8:ab00:ff::/64 (ff). The table lists at most the first 256. A prefix longer than /64 holds no whole /64.

5. Splitting a network (IPv4)

By number of hosts (VLSM)

For a subnet that needs h hosts we take the smallest block that holds them plus the network address and the broadcast:

Example: 50 hosts: 50 + 2 = 52, the next power of two up is 64 = 2⁶, so a /26 (62 hosts). The smallest subnet is a /30 (2 hosts); the calculator only uses a /31 when splitting into equal parts, because it is fit only for a link between two devices.

Subnets are placed one after another from the start of the network. A block of size 2^{L − q} must start at an address divisible by that size (otherwise it would not be a /q network), so the next subnet starts at the first such address not lower than X, the first free address:

"Largest first" order (the default): subnets are sorted from the largest block (equal ones keep the order of the list). Then each block starts exactly where the previous one ended (a larger block is a multiple of a smaller one), so there are no gaps and everything fits whenever the blocks add up to at most the size of the network. "As listed": the order of the list; gaps may be left between subnets. Free space (gaps and the end of the network) is listed as CIDR blocks, worked out as in section 6.

When the network is too small (a subnet does not fit before the end of the network), the calculator lists the subnets without room and looks for the smallest bigger network: it lowers the prefix by 1 (a network twice as big that holds the typed one: N = A AND M for the new prefix) and lays the subnets out again in the same order until they fit. It shows the split of that network. Example: 10.0.0.0/22, "As listed", 200, 500 and 50 hosts: a /24 at 10.0.0.0, the /23 only at 10.0.2.0 (10.0.1.0 is not divisible by 512), no room for the /26, so 10.0.0.0/21 is needed. With "Largest first" the same fits in the /22.

The "Cheaper" hint. A big subnet can waste almost half of its block: 5100 hosts need a /19 (8190 hosts). So for every subnet we try splitting it in two: a block half the size of its block (which it fills completely, for 5100: a /20, 4094 hosts) and the smallest block for the rest (1006 hosts: a /22). We suggest the split that makes the network needed smallest (e.g. 200 + 5100 + 50 hosts: /18 without the split, /19 with it); when no split helps, there is no hint.

Into equal parts

Splitting adds k bits to the prefix, so there are always 2^k parts: with n = 3 you get 4 subnets, the last one spare. Hosts in each are counted as in section 2 (/31 and /32 too). When q > 32 there is no split; the list is limited to 4096 subnets.

6. List → CIDR

Reading the list

We look for entries in the pasted text. Everything else (commas, semicolons, quotes, brackets, words of a log) only separates them. An entry is an IPv4 or IPv6 address, optionally followed by:

• /prefix or /mask: the whole network. A device address with a prefix (e.g. 10.0.0.5/24) means its whole network (10.0.0.0/24);
• a space and a mask starting with 255 (10.0.0.0 255.255.255.0). When the second address is not a mask, these are two entries;
• "-" and the last address of a range. A range written backwards is the same set of addresses;
• "-" and the last number (IPv4 only): 192.168.1.1-254 is 192.168.1.1–192.168.1.254;
• a colon and a port (IPv4 only, 10.0.0.1:443): the port is ignored.

Entries that look like an address but are wrong (300.1.1.1, prefix /33, leading zeros, a range from IPv4 to IPv6) are listed as skipped. Strings with colons but without "::" and with fewer than 7 colons (times like 10:00:01, MAC addresses) are skipped silently. Every entry is a range of addresses from S to E; IPv4 and IPv6 are handled separately. The ranges are sorted, and those that overlap or touch (the next starts at E + 1 at the latest) are joined.

Exact

Every joined range becomes the fewest CIDR blocks that together cover exactly the addresses from S to E. Starting from X = S, we take the largest block that starts at X (X divisible by its size) and does not go past E; then we move X past that block and repeat:

Example: 10.0.0.5–10.0.1.20 (272 addresses) gives 10 blocks: 10.0.0.5/32, 10.0.0.6/31, 10.0.0.8/29, 10.0.0.16/28, 10.0.0.32/27, 10.0.0.64/26, 10.0.0.128/25, 10.0.1.0/28, 10.0.1.16/30, 10.0.1.20/32. One block is not enough here, because a block always has 2^{L − q} addresses and starts at an address divisible by that size. There is only one such split, so the result is always the same. Neighbouring entries join into bigger blocks: 10.0.0.0/25, 10.0.0.128/25 and 10.0.1.0/24 give 10.0.0.0/23.

For comparison we also show one block holding the whole list: the longest prefix shared by the first and the last address (in the example 10.0.0.0/23, 512 addresses, 240 of them not on the list).

Simplify

We start from the whole address space (/0) and go down. A /q block is taken when it is wholly on the list, or when at least t of its addresses are on the list and without it at least two exact blocks would be needed. Otherwise both its halves /(q + 1) are checked the same way:

Example: 10.1.1.0/24 without .100 and .200. Exact: 14 blocks. At t = 75%: Z = 254 ≥ 0.75 × 256 = 192, so one block 10.1.1.0/24 and 2 addresses not on the list. The threshold can be set from 50 to 99%. A single address (or any entry that is itself a CIDR block) never grows into a bigger block, as that would gain nothing. Every block shows its Z, and the answer shows the total of addresses not on the list and those addresses themselves (at most 10 ranges).

7. IPv4 prefix cheat sheet

Hosts as in section 2 (/31: 2, /32: 1).

8. What the calculator does not cover

• Splitting IPv6 networks: splitting works for IPv4 only; IPv6 works in the "Address" and "List → CIDR" tabs, and the "IPv6" tab splits a prefix into /64 networks (section 4).
• Addresses already used in your network: the router, the DHCP server or printers need addresses from the host pool too; the calculator counts how many addresses are available at all.
• The IPv6 subnet-router anycast address (the first address of a subnet, RFC 4291): we count it as an ordinary address.
• Ranges in the middle numbers (192.168.1-3.1-254, as in nmap), host names and short IPv6 ranges: only the entries described in section 6 are read from a list.
• Saving a plan: nothing is stored; when you close the tab, what you typed is gone.

9. Sources

• RFC 4632: Classless Inter-domain Routing (CIDR)
• RFC 3021: 31-bit prefixes on point-to-point links
• RFC 1918: private addresses
• RFC 6598: shared address space (CGNAT)
• RFC 4291: IPv6 addressing architecture
• RFC 5952: recommended text form of IPv6 addresses
• RFC 9637: the 3fff::/20 documentation prefix
• IANA: IPv4 special-purpose address registry and IPv6
• AWS: subnet CIDR blocks in a VPC
• Azure: virtual network FAQ
• RIPE-690: IPv6 prefixes for end users (/48 for businesses, /56 for homes)

← Back to the calculator