This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.
What a subnet actually is
Subnetting is the habit of drawing a boundary inside an IP network so that one group of hosts shares a broadcast domain and a gateway. The boundary is a prefix length. 192.0.2.0/24 and 192.0.2.0 with mask 255.255.255.0 are the same statement. The /24 says the first 24 bits are the network. The last 8 bits are the part a host may change. If you remember only one check, remember this: two addresses are on the same subnet when they agree on the bits the prefix keeps.
People still say class A, class B, and class C. Those classes described early allocations, and they are a poor way to design a network now. A /24 is not a class C just because it used to line up with one. Classless addressing, written as CIDR, is the model your routers already use. If a form asks for a class, it is usually asking for a prefix length and a mask. Give it those.
Private address space is 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. You can subnet inside them freely on your own network. You do not advertise them to the public Internet as if they were yours. Documentation addresses are the ones this guide uses on purpose: 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24. They are safe to put in a lab write-up. 100.64.0.0/10 is carrier NAT space. Treat it as belonging to a provider, not as a free private LAN.
The gateway is just a host address that routers answer on. It can be the first usable address, the last, or any other usable address. Pick one rule per site and keep it. .1 is common because humans look there first. The network address and the broadcast address are not host addresses in a normal /24. Assigning 192.0.2.0 or 192.0.2.255 to a laptop is a mistake even if the spreadsheet had a blank cell.
A VLAN and a subnet are often paired, and they are not the same object. The VLAN is the layer-2 broadcast domain on the switches. The subnet is the layer-3 prefix on that VLAN. You can, badly, put two prefixes on one VLAN, or stretch one VLAN across a building. The clean design is one VLAN, one prefix, one gateway, documented together. When a host cannot reach its gateway, check the VLAN membership before you change the mask.
Prefix lengths from /16 to /31
A /16 keeps 16 bits for the network and leaves 16 bits for the host portion. The dotted mask is 255.255.0.0 and the Cisco-style wildcard is 0.0.255.255. The block size is 65536 addresses. In the usual gateway model you can use 65534 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /16 when you need a private site that still needs to be carved into many /24 or /25 VLANs. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /17 keeps 17 bits for the network and leaves 15 bits for the host portion. The dotted mask is 255.255.128.0 and the Cisco-style wildcard is 0.0.127.255. The block size is 32768 addresses. In the usual gateway model you can use 32766 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /17 when you need two large blocks inside a /16, when a building or a campus half should stay contiguous. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /18 keeps 18 bits for the network and leaves 14 bits for the host portion. The dotted mask is 255.255.192.0 and the Cisco-style wildcard is 0.0.63.255. The block size is 16384 addresses. In the usual gateway model you can use 16382 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /18 when you need a building-sized allocation inside 10.0.0.0/8 when you expect dozens of /24 user VLANs. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /19 keeps 19 bits for the network and leaves 13 bits for the host portion. The dotted mask is 255.255.224.0 and the Cisco-style wildcard is 0.0.31.255. The block size is 8192 addresses. In the usual gateway model you can use 8190 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /19 when you need a floor or a wing when /18 is too wide and /20 would force a renumber sooner than you want. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /20 keeps 20 bits for the network and leaves 12 bits for the host portion. The dotted mask is 255.255.240.0 and the Cisco-style wildcard is 0.0.15.255. The block size is 4096 addresses. In the usual gateway model you can use 4094 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /20 when you need a department or a small campus that needs about sixteen /24s and a clear boundary. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /21 keeps 21 bits for the network and leaves 11 bits for the host portion. The dotted mask is 255.255.248.0 and the Cisco-style wildcard is 0.0.7.255. The block size is 2048 addresses. In the usual gateway model you can use 2046 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /21 when you need a site that needs eight /24s, which is enough for users, printers, voice, and a lab. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /22 keeps 22 bits for the network and leaves 10 bits for the host portion. The dotted mask is 255.255.252.0 and the Cisco-style wildcard is 0.0.3.255. The block size is 1024 addresses. In the usual gateway model you can use 1022 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /22 when you need a branch that needs four /24s and should not be handed a whole /16. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /23 keeps 23 bits for the network and leaves 9 bits for the host portion. The dotted mask is 255.255.254.0 and the Cisco-style wildcard is 0.0.1.255. The block size is 512 addresses. In the usual gateway model you can use 510 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /23 when you need two /24s kept together, often a user VLAN and a device VLAN at a small site. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /24 keeps 24 bits for the network and leaves 8 bits for the host portion. The dotted mask is 255.255.255.0 and the Cisco-style wildcard is 0.0.0.255. The block size is 256 addresses. In the usual gateway model you can use 254 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /24 when you need one ordinary LAN of up to 254 hosts, which is still the length most people mean by a subnet. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /25 keeps 25 bits for the network and leaves 7 bits for the host portion. The dotted mask is 255.255.255.128 and the Cisco-style wildcard is 0.0.0.127. The block size is 128 addresses. In the usual gateway model you can use 126 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /25 when you need a LAN you want to split in half, with 126 usable addresses on each side. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /26 keeps 26 bits for the network and leaves 6 bits for the host portion. The dotted mask is 255.255.255.192 and the Cisco-style wildcard is 0.0.0.63. The block size is 64 addresses. In the usual gateway model you can use 62 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /26 when you need about 60 hosts, such as one closet of desks, a lab, or a wireless VLAN that you do not want at /24 size. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /27 keeps 27 bits for the network and leaves 5 bits for the host portion. The dotted mask is 255.255.255.224 and the Cisco-style wildcard is 0.0.0.31. The block size is 32 addresses. In the usual gateway model you can use 30 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /27 when you need about 30 hosts, which fits a small office, a voice VLAN, or a management VLAN. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /28 keeps 28 bits for the network and leaves 4 bits for the host portion. The dotted mask is 255.255.255.240 and the Cisco-style wildcard is 0.0.0.15. The block size is 16 addresses. In the usual gateway model you can use 14 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /28 when you need about 14 hosts, useful for a device network, a camera group, or a lab bench. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /29 keeps 29 bits for the network and leaves 3 bits for the host portion. The dotted mask is 255.255.255.248 and the Cisco-style wildcard is 0.0.0.7. The block size is 8 addresses. In the usual gateway model you can use 6 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /29 when you need six usable addresses, which is enough for a tiny appliance group and a gateway. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /30 keeps 30 bits for the network and leaves 2 bits for the host portion. The dotted mask is 255.255.255.252 and the Cisco-style wildcard is 0.0.0.3. The block size is 4 addresses. In the usual gateway model you can use 2 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /30 when you need two usable addresses, the classic point-to-point size when both ends need a normal host address. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
A /31 keeps 31 bits for the network and leaves 1 bits for the host portion. The dotted mask is 255.255.255.254 and the Cisco-style wildcard is 0.0.0.1. The block size is 2 addresses. In the usual gateway model you can use 2 of them for hosts, because the first address names the subnet and the last is the broadcast. You reach for /31 when you need a point-to-point link that uses both addresses as hosts, which modern routers accept and which saves half the space of a /30. Write the mask beside the prefix in every design note. A person who types the wildcard into a host mask field, or the mask into an OSPF network statement, will build a subnet that does not match the one in the spreadsheet. Check both forms before the change window.
| Prefix | Mask | Block | Usable hosts |
|---|---|---|---|
| /16 | 255.255.0.0 | 65536 | 65534 |
| /20 | 255.255.240.0 | 4096 | 4094 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 |
A /24 split into four /26 networks
Start with 192.0.2.0/24 and a request for four groups of about 50 hosts. A /26 has 64 addresses and 62 usable hosts, so four /26 networks fit exactly inside the /24. They are 192.0.2.0/26, 192.0.2.64/26, 192.0.2.128/26, and 192.0.2.192/26. The third octet does not change. The split is entirely inside the last octet, on bit boundaries of 64.
For 192.0.2.0/26 the network is 192.0.2.0, the first usable host is 192.0.2.1, the last usable host is 192.0.2.62, and the broadcast is 192.0.2.63. Put the gateway on 192.0.2.1 if that is the site rule. A DHCP pool can run from 192.0.2.10 through 192.0.2.62 and leave .2 through .9 for printers and switches that you want on fixed addresses.
For 192.0.2.64/26 the network is 192.0.2.64, the usable range is 192.0.2.65 through 192.0.2.126, and the broadcast is 192.0.2.127. The next block starts at 192.0.2.128, not at 192.0.2.127. 192.0.2.127 is still the broadcast of the second block. Overlapping the third block onto .127 is the classic off-by-one.
For 192.0.2.128/26 the usable range is 192.0.2.129 through 192.0.2.190 and the broadcast is 192.0.2.191. For 192.0.2.192/26 the usable range is 192.0.2.193 through 192.0.2.254 and the broadcast is 192.0.2.255, which is also the broadcast of the original /24. Nothing in this split is free. If a fifth group appears, you need a different parent or you need to resize.
Check the split by adding the block sizes. 64 + 64 + 64 + 64 is 256, which is the whole /24. If your blocks sum to more than the parent, they overlap or they leave the parent. If they sum to less, you have spare space, which is fine when you meant to reserve it and a bug when you did not.
VLSM for 50 hosts, 20 hosts, and a link
Variable length subnetting means the blocks do not have to be the same size. Suppose 198.51.100.0/24 must hold a group of 50 hosts, a group of 20 hosts, and a point-to-point link, and you want the rest left over for later. Allocate the largest block first so the small blocks can tuck into what remains.
Fifty hosts need a /26, because a /27 has only 30 usable addresses. Give them 198.51.100.0/26. Network 198.51.100.0, usable 198.51.100.1 through 198.51.100.62, broadcast 198.51.100.63. Twenty hosts need a /27, which has 30 usable addresses. The next free boundary is 198.51.100.64. Give them 198.51.100.64/27. Usable addresses are 198.51.100.65 through 198.51.100.94, and the broadcast is 198.51.100.95.
A point-to-point link that should look like a normal pair of hosts can be 198.51.100.96/30. The two usable addresses are 198.51.100.97 and 198.51.100.98. The network is 198.51.100.96 and the broadcast is 198.51.100.99. If both routers support /31, 198.51.100.96/31 uses .96 and .97 and does not spend a broadcast address. Do not mix /30 and /31 on the two ends of the same link.
What remains starts at 198.51.100.100 if you used the /30, or at 198.51.100.98 if you used the /31, and runs through 198.51.100.255. That remainder is not one clean prefix. 198.51.100.128/25 is a clean leftover of 128 addresses, and 198.51.100.96/27 would have been the clean block you broke by placing the link there. Write the remainder as a list of free prefixes, not as a vague note that says the rest of the /24 is free. The free statement is how the next engineer overlaps you.
Order of allocation matters. If you had given the /30 first at 198.51.100.0/30, the /26 would no longer fit on a /26 boundary at .0 and you would have stranded space. Largest first, aligned to its own size, is the rule that keeps VLSM from turning into a puzzle. The subnet calculator on this site will check a boundary. It will not invent the organisational reason for the sizes. That part stays with you.
Masks, wildcards, and overlap
A mask marks the network bits with ones. A wildcard marks the host bits with ones. For /24 the mask is 255.255.255.0 and the wildcard is 0.0.0.255. For /26 the mask is 255.255.255.192 and the wildcard is 0.0.0.63. OSPF network statements on Cisco IOS use the wildcard. Host configuration and most firewall objects use the mask or the prefix. Read the label on the field before you paste.
Two prefixes overlap when one contains the other or when they cover the same addresses. 192.0.2.0/24 and 192.0.2.128/25 overlap because the /25 is inside the /24. 192.0.2.0/25 and 192.0.2.128/25 do not overlap. They are neighbours. A router can hold both. A host cannot have both as its own subnet at the same time in any sensible design.
Test overlap with a pen before a change window. Write each prefix as a start and an end. 192.0.2.0/26 runs from .0 through .63. 192.0.2.64/26 runs from .64 through .127. The end of one plus one equals the start of the next. If the end of one is greater than or equal to the start of the next, you have an overlap or a shared address. Equal starts are an overlap. A broadcast that lands inside the next block is an overlap.
How to subnet during a change
Do the arithmetic in the ticket, not in the console. The ticket should show the parent prefix, each child prefix, the gateway, the DHCP range, the VLAN id, and the device that owns the gateway. If any of those are blank, the change is not ready. A calculator speeds the arithmetic. It does not replace the ticket.
Build the new subnet beside the old one when you can. Move a test host first. Confirm it gets an address, resolves a name, and reaches one internal service and one external address. Then move the rest. If you must renumber in place, lower the DHCP lease before the day so clients renew quickly, and keep the old gateway answering until the last client has moved.
After the move, look for the old prefix in static hosts, firewall objects, VPN policies, monitoring, and print servers. Those are the places that do not use DHCP and will not notice your change. A subnetting project fails more often in a forgotten static printer than in the mask math.
The tools linked from this page calculate prefixes, convert masks, build a VLSM plan, and check that an address is valid. They run in the browser. They do not log into a router and they do not reserve space in your IP address management system. Paste a result into the ticket, then have a second person read the ticket against the device.
- Write the parent prefix and prove you own it or that it is private space you are allowed to use.
- List the host counts, then round each one up to a prefix that has enough usable addresses.
- Allocate largest first, on a boundary that matches the block size.
- Record network, first host, last host, broadcast, gateway, and VLAN for every block.
- Check that the blocks sum into the parent and that no two blocks overlap.
- Enter the gateway and DHCP scope on the device only after the ticket matches the calculator.
- Move one test host and confirm address, gateway, name resolution, and a real application.
- Search for the old prefix in static configurations before you call the change finished.
Mistakes that survive a calculator
Using the broadcast address as a host, or the network address as a gateway, because a range was copied as inclusive on both ends.
Mixing a wildcard and a mask. 0.0.0.255 is not the mask of a /24.
Allocating a /27 for 50 hosts. A /27 holds 30 usable addresses. Fifty hosts need a /26.
Starting the next block on the broadcast of the previous one. After 192.0.2.0/26 the next network is 192.0.2.64, not 192.0.2.63.
Handing a cloud VPC a /16 because the field accepted it, then discovering the provider reserves several addresses in every subnet and that peering will not accept an overlap with the office.
Documenting 192.168.1.0/24 at two sites that later need a VPN. Overlapping private space is a subnetting problem even when each site worked alone.
Treating /31 as universally safe. Use it on a routed link whose both ends you control and whose software you have checked. Do not put a /31 on a user VLAN.
Leaving the remainder described as free space instead of as a list of exact prefixes.
Tools for this guide
These tools run in the browser on this site. They do not log into your machines.
Related pillar guides
Guides in this cluster
These supporting pages belong to this pillar.
- Explainer: CIDR Notation Explained
- Cheat Sheet: Subnet Mask Cheat Sheet
- How-To: How to Subnet a Network in 5 Steps
- Explainer: VLSM Explained with Examples
- Explainer: Subnetting Practice Questions
- How-To: How to Calculate Usable Hosts in a Subnet
- Explainer: Network vs Broadcast Address Explained
- Explainer: Wildcard Masks Explained
- Explainer: Route Summarization (Supernetting) Explained
- Explainer: Private vs Public IP Ranges
- Explainer: IP Address Classes Explained
- How-To: How to Convert IP Addresses to Binary, Decimal and Hex
- How-To: How to Design an IP Addressing Plan
- Troubleshooting: How to Find and Fix Overlapping Subnets
- Comparison: /30 vs /31 for Point-to-Point Links
- Explainer: What Is CGNAT (100.64.0.0/10)?
- Checklist: IP Address Management (IPAM) Best Practices
- How-To: Reverse DNS Delegation for Subnets (RFC 2317)
- Explainer: Multicast Addressing Explained
- How-To: DHCP Split Scopes and Pool Planning
- Career: Subnetting Interview Questions
Companion: Cloud: VPC Design Best Practices.