Subnet Calculator Guide

What it does

A subnet divides an IP address space into a network prefix and host addresses. The mask creates a connected route. A device performs a route lookup to decide whether the next hop is the destination on the local link or a router.

Enter an IP address and either a prefix such as /24 or an IPv4 dotted mask such as 255.255.255.0. The calculator combines them to find the containing network. For example, 192.168.1.37 with /24 belongs to 192.168.1.0/24.

A valid dotted mask has contiguous 1 bits followed by contiguous 0 bits. 255.255.255.0 is valid; 255.0.255.0 is not. Prefix notation avoids that ambiguity and also works with IPv6.

What this tool tells you

The result shows the network CIDR, network address, mask, prefix length, total address count, and host boundaries. It helps diagnose questions such as:

• Are two devices configured in the same subnet?
• Is the default gateway inside the device’s local subnet?
• Does a DHCP scope fit inside the intended network?
• Will a route or firewall CIDR include this address?
• Did a copied mask place the host in a different network than expected?

Two IPv4 devices can share the same switch and still fail to communicate directly if their masks make different decisions about what is local. One may send directly with ARP while the other sends its reply to a gateway. Comparing each device’s calculated CIDR exposes that asymmetric configuration.

The first and last host fields follow conventional address math. In an ordinary IPv4 subnet, the network address identifies the subnet and the final address is broadcast, so neither is assigned to a host. /31 links and /32 host routes are special cases. IPv6 has no broadcast and uses Neighbor Discovery instead of ARP.

How it fits with other technologies

Subnetting is where IP addressing meets local delivery and routing:

• CIDR is the address-and-prefix form of the same network. Use the CIDR Calculator when you already have a block such as 10.20.0.0/16 and need its boundaries.
• ARP maps an on-link IPv4 next hop to a link-layer address. IPv6 uses Neighbor Discovery. The next hop may be the destination itself or a gateway selected for remote traffic.
• A default gateway handles destinations without a more specific route. Its interface address is normally on-link, although point-to-point links and explicit on-link routes allow exceptions.
• DHCP supplies an address, mask, gateway, and DNS servers. A wrong DHCP option can look like a host-specific network failure.
• VLANs create separate layer-2 broadcast domains. Matching IP masks do not bridge devices placed in different VLANs; a router must connect them.
• Route tables contain connected, static, learned, and default routes. Longest-prefix matching selects the route first; neighbor resolution then finds the selected on-link next hop.
• Firewalls, security groups, and ACLs may allow a calculated subnet while still blocking a port or return path.
• DNS supplies an address but does not decide whether that address is local or routable. Test the address directly when separating a DNS problem from a subnet problem.

Private IPv4 blocks such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are reusable. That makes overlap common when connecting offices, VPNs, containers, and cloud networks.

Troubleshooting unexpected results

1. Verify the actual interface values. Check the address and mask on the affected device rather than relying on documentation. Use ip addr and ip route on Linux, ipconfig /all on Windows, or the network settings on the device.
2. Compare both endpoints. Calculate the subnet from each device’s own address and mask. They must agree about whether the other address is local.
3. Check the gateway. The gateway should fall inside the local subnet and respond on the correct VLAN. A typo in either the gateway or mask can leave local access working while internet access fails.
4. Inspect DHCP. Confirm the lease came from the intended scope and that no rogue or stale DHCP server supplied different options. Renewing a lease helps only after the server configuration is fixed.
5. Look for duplicate addresses. Intermittent reachability, changing MAC addresses, or duplicate-address warnings may mean two devices share one IP.
6. Check VLAN membership. Access-port and tagged VLAN mismatches can separate hosts even when their IP calculations match.
7. Check routes and return routes. For remote subnets, inspect the selected next hop in both directions. VPN and cloud connections often fail because their private ranges overlap.
8. Review firewall scope. An allow rule for 192.168.1.0/24 will not include a host that a /23 design placed in 192.168.0.0/23 if the rule was meant to cover both halves.
9. Account for platform reservations. Cloud providers reserve some addresses in each subnet. The mathematical range is not always the assignable range.
10. Use IPv6 prefix notation. Dotted masks apply only to IPv4. Ordinary IPv6 LANs are normally /64, and IPv6 troubleshooting should include Router Advertisements and Neighbor Discovery.

Start close to the host: interface address, mask, local neighbor resolution, gateway, route, firewall, then application. This order prevents an application error from hiding a basic addressing mismatch.

What this tool cannot prove

The calculator cannot inspect the device, detect a duplicate address, see VLAN membership, test ARP or Neighbor Discovery, read route tables, or confirm reachability. It also does not know which addresses a cloud or network platform reserves.

Its output is the network the supplied address and mask describe. Compare it with live interface, DHCP, switch, router, VPN, and firewall configuration. If the math is right but traffic still fails, test the path one layer at a time rather than changing the mask until connectivity appears.