10.0.0.5/8 or 10.0.0.5 255.0.0.0, or type a bare address and use the slider. A 32-bit integer or hex value like $c0a80182 works too, and so does IPv6, like 2001:db8:abcd::/48.| Name | Needs | Gets | Network | Usable range | Broadcast |
|---|
An IPv4 address looks like four numbers with dots in between, and that's how everybody writes it, but your computer doesn't see it that way. To the computer it's one 32-bit number. Each of the four parts is a byte, which is why none of them ever goes above 255, and the dots are only there so people can tell where one byte stops and the next one starts.
Take 192.168.1.130 and write each byte out in binary:
192 168 1 130 11000000 10101000 00000001 10000010
Squash those together, read them as one number, and you get 3,232,235,906, or $c0a80182 if you'd rather see hex. Type either one into the calculator up top and it'll figure out what you meant.
The left part of the address says which network the machine is on, and the right part says which machine it is on that network. A street address works the same way. The post office three states away doesn't care about your house number. It gets the letter to your town and your street, and the carrier on your route takes care of the house number.
Routers work like that. A router out on the internet has no idea your laptop exists. It knows about networks, and it sends each packet toward whichever network the address falls in. Nobody looks at the host part until the packet shows up on the right network.
The address doesn't tell you where the split is, though. For that you need the mask.
A subnet mask is another 32-bit number, written with the same dots. It's always a run of 1s followed by a run of 0s. The 1s line up with the network part of the address, and the 0s line up with the host part.
address 11000000.10101000.00000001.10000010 192.168.1.130 mask 11111111.11111111.11111111.11000000 255.255.255.192
To get the network address, AND the address with the mask, one bit at a time. Anywhere the mask has a 1, the address bit comes through unchanged. Anywhere the mask has a 0, you get a 0.
address 11000000.10101000.00000001.10000010 mask 11111111.11111111.11111111.11000000 ----------------------------------- network 11000000.10101000.00000001.10000000 192.168.1.128
If you've written any 6502, you've done this a hundred times. and #$c0 keeps the top two bits of the accumulator and throws away the other six. A subnet mask does the same thing across all 32 bits, and in this example the last byte of the mask is $c0, so for that byte it's literally the same instruction.
Back in the early days, masks were allowed to have holes in them, like 255.255.0.255. Imagine trying to debug a network set up like that. CIDR (more on that below) got rid of them, and today a mask with a 0 stuck in the middle of the 1s is just wrong. The calculator will tell you so if you try one.
Since a mask is always 1s and then 0s, you can describe it by counting the 1s. 255.255.255.192 has 26 of them, so this network is 192.168.1.128/26. That's CIDR notation (Classless Inter-Domain Routing, if you're curious), and the number after the slash is called the prefix length.
The prefix is a lot easier to work with than the dotted mask. A /24 means the first three bytes are network and the last byte is host. A /16 is two and two. A /26 is three bytes plus two more bits, so the line falls inside the last byte. Load 192.168.1.0/26 and you'll see the red line land in the middle of a byte in the bit view.
Before 1993, nobody wrote the split down at all. It was baked into the first few bits of the address. If the first byte was 0 to 127, it was a Class A with 8 network bits. 128 to 191 was a Class B with 16, and 192 to 223 was a Class C with 24. Whatever class your address was in, that's the size you got.
That wasted an enormous amount of space. A Class C gave you 254 hosts and a Class B gave you 65,534, with nothing in between. So a company with 300 machines was too big for a C, got a B, and left about 65,000 addresses sitting there doing nothing. Multiply that by every mid-sized company on the early internet and you can see why the B's were running out.
CIDR (RFC 1519) got rid of classes in 1993 and let the mask land on any bit. You'll still hear people say "a Class C" when they mean a /24, and everybody knows what they mean. The calculator shows the old class for fun, but it doesn't change any of the math.
If the prefix is p, there are 32 − p host bits, and every host bit doubles the number of addresses. So a network has 232−p addresses. A /26 has 6 host bits, and 26 is 64.
You can't use all 64, though, because two of them are reserved. The one with every host bit set to 0 is the network address. It's the name of the network itself, so no machine gets it. The one with every host bit set to 1 is the broadcast address, and if you send a packet there, every machine on the network gets a copy.
network 11000000.10101000.00000001.10000000 192.168.1.128 broadcast 11000000.10101000.00000001.10111111 192.168.1.191
That leaves 64 − 2 = 62 addresses for machines, .129 through .190.
There's a bitwise shortcut for the broadcast, too. Flip every bit of the mask and you get the wildcard, which is 0.0.0.63 here, with only the host bits set. OR that with the network address and out pops the broadcast. Cisco access lists use wildcard masks instead of regular ones, so if you've ever wondered why an ACL said 0.0.0.255, now you know.
The two smallest sizes don't follow the minus-two rule. A /32 is one address, and you use it to point at exactly one machine. A /31 has two addresses and no room for a network or broadcast address, so for years people used a /30 for a link between two routers and wasted half of it. RFC 3021 finally made it OK to use both addresses of a /31 on a link like that.
You don't need binary for most of this, and once you get the hang of it you won't need the calculator very often either. Find the byte where the mask stops being 255. Subtract that byte from 256 and you've got the block size. Subnets start at every multiple of the block size.
For a /26, the mask ends in 192, and 256 − 192 = 64, so the subnets in that last byte start at 0, 64, 128, and 192. Our address ends in 130, which falls between 128 and 192. The network is .128, and the broadcast is one less than the start of the next block, .191. Easy, right?
It works on any byte. A /20 has a mask of 255.255.240.0, and 256 − 240 = 16, so the third byte counts up by 16s. For 172.16.37.9/20, the 37 lands in the block that starts at 32. That makes the network 172.16.32.0 and the broadcast 172.16.47.255, the last address before the block at 48.
Say you've got 10.0.0.0/24 and you want four separate networks, maybe one for each floor of the building. You borrow bits from the host part. Two bits give you four combinations (00, 01, 10, and 11), so the prefix goes from /24 to /26.
10.0.0.00000000 = 10.0.0.0/26 10.0.0.01000000 = 10.0.0.64/26 10.0.0.10000000 = 10.0.0.128/26 10.0.0.11000000 = 10.0.0.192/26
Every bit you borrow doubles the number of subnets and cuts each one in half. The split panel up top does this for whatever you've typed in.
In the real world, networks aren't all the same size. The sales floor might need 100 addresses while the link between two routers needs 2, and handing everybody the same /25 would burn through your address space in no time. Variable-length subnet masking, VLSM for short, means giving each subnet the size it needs and no bigger.
The one rule you can't break is that a subnet has to start on a multiple of its own size. A /26 is 64 addresses, so it can start at .0, .64, .128, or .192, and nowhere else. If you tried to start one at .32, the mask would chop it in half, and ANDing its addresses with the mask would give you a network address that isn't where the subnet starts.
The easiest way to stay out of trouble is to hand out the biggest blocks first. Here's 192.168.10.0/24 carved up for four groups:
/25, so Sales gets 192.168.10.0/25./26, at .128/26./27, at .192/27./30, at .224/30.That leaves .228 through .255 for later.
Now try it the other way around. Put the router link at .0/30 first, and Sales can't start at .4, because 4 isn't a multiple of 128. The next spot is .128, so Sales takes the entire top half. Office needs 64 more addresses starting on a multiple of 64 above that, and there aren't any left. You'd have to go back and shoehorn things into the gaps below by hand. Going biggest first avoids all of that, and it's what the planner does.
Splitting works backwards, too. Say a router has four networks behind it, 10.1.4.0/24 through 10.1.7.0/24. It doesn't need to tell its neighbors about all four. Look at the third byte of each one in binary:
4 00000100 5 00000101 6 00000110 7 00000111
The first six bits of that byte are the same in all four, and so are the 16 bits in front of it. That's 22 bits in common, so all four fit inside 10.1.4.0/22, and the router can send one route instead of four. That's route summarization (some people call it supernetting), and it's a big reason the internet's routing tables haven't exploded.
It only comes out clean when the networks fill an entire aligned block. Summarize only .4, .5, and .6, and the smallest single block is still the /22, which also grabs 10.1.7.0/24. If some other router owns .7, congratulations, you've just stolen its traffic. The summarize panel gives you both answers. You get the smallest single block along with how many extra addresses it grabs, and you get the exact list, which here is 10.1.4.0/23 plus 10.1.6.0/24.
Firewalls and cloud security groups want CIDR blocks, but people think in ranges. Somebody asks you to allow 10.0.0.5 through 10.0.0.60, and that won't fit in one block, because a block has to be a power of two in size and start on a multiple of that size. So you cover it with a staircase of blocks. Start at the low end, take the biggest aligned block that fits, and keep going until you reach the end.
10.0.0.5/32 1 address 10.0.0.6/31 2 10.0.0.8/29 8 10.0.0.16/28 16 10.0.0.32/28 16 10.0.0.48/29 8 10.0.0.56/30 4 10.0.0.60/32 1
So one range turns into eight firewall rules. The blocks get bigger as the start address hits rounder numbers, then shrink again as they close in on the end. The range panel does this for any start and end, and it handles IPv6 too.
Some ranges are set aside for special jobs. The private ranges from RFC 1918 are for use inside homes and offices, and routers on the internet won't carry them. Your home network is almost certainly using one right now. Your router swaps it for a single public address on the way out. That's called NAT (network address translation), and it's a big part of why we haven't completely run out of IPv4 addresses.
| Range | What it's for |
|---|
172.16.0.0/12 trips people up. It runs from 172.16.0.0 all the way to 172.31.255.255, not just 172.16.x.x. Type an address into the calculator and the Type box will tell you which of these it's in.
IPv6 uses the same idea with a much bigger number. An address is 128 bits, written as eight groups of four hex digits with colons between them. That's a lot of typing, so there are two shortcuts. You can drop the leading zeros in any group, so 0db8 becomes db8. You can also replace one run of all-zero groups with ::. Only one run, though, or there'd be no way to tell how many zeros each :: was hiding.
2001:0db8:0000:0000:0000:0000:0000:0001 2001:db8::1
Prefixes work exactly the same way. The first p bits are the network and the rest are the host. What changes is how you think about size, because nobody counts hosts in IPv6. A normal LAN is a /64, which leaves 64 host bits. That's about 18 quintillion addresses on one network, and it isn't as wasteful as it sounds. Machines can build their own address out of those 64 bits (that's SLAAC, stateless address autoconfiguration), and that only works on a /64.
So in IPv6 you count /64s instead of hosts. Lots of ISPs give a home a /56, which is 256 LANs. A business usually gets a /48, which is 65,536 of them. It helps to split on multiples of 4 bits. Each hex digit is exactly 4 bits, so the line falls between digits instead of in the middle of one. Load 2001:db8:abcd::/48 and split it into /52s or /64s to see what I mean.
IPv6 also has no broadcast address. Multicast handles that job now, so the minus two in the host count goes away. Type any IPv6 address into the calculator and it switches over. These are the special ranges you'll run into:
| Range | What it's for |
|---|