Worked example, step by step

Take 192.168.10.130/26. Here is exactly how the calculator turns it into a network, a broadcast and a host count — the same six steps it runs on whatever you type above, with the real bits from this address:

Read the fourth octet and the answer is obvious: 130 is 10000010 in binary. A /26 keeps the first two bits of the fourth octet (10) and zeroes the rest, so the network lands on 10000000 = 128 — not on 0, not on 130. That “which /26 block am I in?” question is exactly what this tool answers for any address, any prefix.

Splitting a network, worked

Suppose a site has 172.16.0.0/16 (65,536 addresses) and needs four separate subnets. Four is 2², so borrow two bits from the host part: /16 + 2 = /18. Each /18 then holds 2¹⁴ = 16,384 addresses (16,382 usable). The divider above produces exactly this table:

CIDR cheat sheet

The prefixes you will meet in the wild, with what each one buys you:

Private and special ranges (IPv4)

Not every address is publicly routable. The calculator classifies every input against these ranges, so a paste of 10.20.30.40 tells you “private” before you plan anything:

Classful vs classless

Before CIDR, networks came in three fixed sizes. The calculator still shows the class because legacy docs and old exams refer to it — but in 2026 the class is trivia and the prefix is everything:

IPv6 in a minute

An IPv6 address is 128 bits, written as eight groups of four hex digits. The calculator accepts compressed form (2001:db8::1) and expands it for you. The prefixes worth knowing:

Two things that trip people up: /64 is the standard interface prefix (SLAAC builds the host part from the interface identifier, so networks smaller than /64 break autoconfiguration), and a ULA is “private” in the sense of site-scoped — it is still a fully routable address, just not one your ISP will advertise.

Common subnet pitfalls

• The “minus two” rule has exceptions. A /30 really does have 2 usable hosts, but a /31 has 2 usable (RFC 3021 point-to-point — no broadcast at all) and a /32 has 1. Old muscle memory says /31 is “invalid”; it is not.
• Masks must be contiguous. 255.255.255.0 is a /24, but 255.0.255.0 is not a mask at all — the 1-bits are not in one block. This tool rejects it instead of guessing.
• Leading zeros are ambiguous. 192.168.001.001 could be decimal or octal depending on the parser. This tool rejects leading zeros so every input means exactly one address.
• Mask vs wildcard. A subnet mask has 1s where the network is; the wildcard (inverse) mask has 1s where the host is. Firewall ACLs and routing configs use the wildcard — mixing them up is a classic misfire. Both are shown in the results.
• A /32 is a host, not a network. In a routing table 1.2.3.4/32 means “that one machine”; the network, broadcast and host addresses are all the same.
• IPv6 has no broadcast. There is no 255.255.255.255 equivalent — multicast (including the all-nodes ff02::1) replaces it. “Broadcast address” questions in IPv6 are a category error.
• Don't plan a /25 from a /26. Subnets split in powers of two: a /24 divides cleanly into two /25s, four /26s, eight /27s — never three. The divider above will tell you when your N forces the next power of two.
• Private does not mean safe. RFC 1918 addresses are not routable from the internet, but they are fully visible on your own network. Segment them; don't assume privacy.

More network tools

Reading a packet capture and seeing an HTTP status code you don't recognise? The HTTP Status Code Lookup explains every one with common causes and fixes, and the Unix Timestamp Converter decodes the epoch times that show up in logs and pcap headers.