What you can use it for
Splitting a small office network
Putting staff, guests, cameras and printers on separate subnets makes firewall rules simpler and keeps one group’s broadcast traffic away from the others. Say you have 192.168.10.0/24 and need room for 100 staff devices, 50 guests, 20 cameras and 10 printers or switches:
| Purpose | Required hosts | Allocated subnet | Usable range | Broadcast |
|---|---|---|---|---|
| Staff | 100 | 192.168.10.0/25 | 192.168.10.1 – 192.168.10.126 | 192.168.10.127 |
| Guest Wi-Fi | 50 | 192.168.10.128/26 | 192.168.10.129 – 192.168.10.190 | 192.168.10.191 |
| Cameras | 20 | 192.168.10.192/27 | 192.168.10.193 – 192.168.10.222 | 192.168.10.223 |
| Printers and management | 10 | 192.168.10.224/28 | 192.168.10.225 – 192.168.10.238 | 192.168.10.239 |
That still leaves 192.168.10.240/28 spare for later. In practice you’d then give each subnet its own VLAN, gateway and firewall policy.
Checking a device’s address
If you know a device’s IP and prefix, the calculator shows the whole subnet around it. That tells you whether another address is local and whether a static IP you’re about to set is in range. For the default 192.168.10.37/24 (mask 255.255.255.0), you get:
- Network address: 192.168.10.0
- Usable range: 192.168.10.1 to 192.168.10.254
- Broadcast address: 192.168.10.255
- Usable hosts: 254
Anything inside that range is normally reached directly, and anything outside goes via the router. VLANs, routing tables and firewalls can still change what actually gets through.
Planning several VLANs from one block
Here’s what the VLSM planner gives you for its default input, 10.20.0.0/22 shared between five networks:
| Network | Required hosts | Allocated subnet | Capacity | Unused host capacity |
|---|---|---|---|---|
| Office | 200 | 10.20.0.0/24 | 254 | 54 |
| Wi-Fi | 100 | 10.20.1.0/25 | 126 | 26 |
| Voice | 50 | 10.20.1.128/26 | 62 | 12 |
| Cameras | 24 | 10.20.1.192/27 | 30 | 6 |
| Management | 10 | 10.20.1.224/28 | 14 | 4 |
The five subnets use 496 of the 1,024 addresses without overlapping, leaving 528 free for future networks. Before rolling it out, write down each subnet’s gateway, DHCP exclusions and any addresses reserved for infrastructure.
How IPv4 subnetting works
An IPv4 address is 32 bits long. The prefix says how many of those bits identify the network: a /24 locks the first 24 and leaves 8 for devices. A subnet mask such as 255.255.255.0 marks exactly the same boundary, just written in dotted decimal.
Network, broadcast and usable addresses
Set every host bit to 0 and you get the network address. Set them all to 1 and you get the broadcast address. Everything in between is for devices. Two exceptions: a /31 uses both of its addresses for the two ends of a point-to-point link, and a /32 is a single address.
What VLSM does
Variable Length Subnet Masking gives each network a prefix sized to fit it, rather than one size for all. Placing the biggest blocks first keeps the plan tight and leaves the leftover space in one usable chunk.
Wildcard masks for ACLs and OSPF
Router access lists and OSPF network statements don’t take a subnet mask. They want a wildcard, which flips the logic: a 0 bit says “this part of the address has to match” and a 1 bit says “anything goes here”.
To get one, take each octet of the subnet mask away from 255. Say you want an access list to cover 10.4.8.0/21. Its mask is 255.255.248.0, so the wildcard is 0.0.7.255, and the rule will catch everything from 10.4.8.0 to 10.4.15.255.
The calculator shows the wildcard with every result. You can also start from a wildcard you’ve found in a router config and it will tell you which subnet it covers.
IPv4 CIDR, subnet mask and wildcard chart
Here are the prefixes you’ll meet most in private networks, VLANs and router links. Usable hosts leave out the network and broadcast addresses, apart from /31 and /32, which work differently.
| Prefix | Subnet mask | Wildcard | Total addresses | Usable hosts |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 on a point-to-point link |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 host route |
CIDR and route summaries
CIDR writes a network as an address plus a prefix length, such as 10.20.0.0/22. Routers match traffic against these prefixes, so a run of neighbouring networks can often be advertised as one shorter route instead of many. Paste your list into Route summary mode and it finds the smallest prefix that covers them all.
Watch for gaps. If your networks aren’t back to back, or don’t start on the right boundary, the summary will also cover addresses you never listed. The calculator tells you how many, so you can decide whether it’s safe to advertise.