How to Calculate a Subnet Mask (By Hand and Quickly)

Subnetting looks like arithmetic and is really just counting bits. Once you can see an address as 32 bits rather than four numbers, every subnet question becomes the same question: where does the network part stop?

Step 1: know your powers of two

Everything in subnetting comes back to this row:

If you know these, you can size any subnet in your head.

Step 2: convert a prefix to a mask

A /26 means 26 leading 1-bits:

11111111.11111111.11111111.11000000

Group in eights and convert each: 255, 255, 255, and 11000000 = 192. So /26 is 255.255.255.192.

The only octet needing thought is the one where the boundary falls. There are just eight possible values, worth memorising:

Step 3: find the block size

Block size = 256 − the interesting octet value. For /26, that is 256 − 192 = 64. Subnets therefore start at 0, 64, 128, 192.

This is the fastest trick in subnetting. To find which subnet an address is in, round its interesting octet *down* to the nearest multiple of the block size.

For 192.168.1.100/26: block size 64, and 100 rounds down to 64. So:

• Network: 192.168.1.64
• Broadcast: 192.168.1.127 (next network minus one)
• Usable: 192.168.1.65 – 192.168.1.126
• Hosts: 64 − 2 = 62

No binary conversion required once you have the block size.

Step 4: count hosts

hosts = 2^(32 − prefix) − 2

The −2 removes the network and broadcast addresses. Two exceptions:

• /31 gives 2 usable addresses, not 0 — RFC 3021 allows both on

point-to-point links.

• /32 is a single host, used for loopbacks and specific route entries.

Worked example

Split 10.20.0.0/16 into subnets for 500 hosts each.

1. 500 hosts needs 512 addresses (next power of two).
2. 512 = 2⁹, so 9 host bits, so prefix = 32 − 9 = /23.
3. Mask for /23: 255.255.254.0.
4. Block size in the third octet: 256 − 254 = 2.
5. Subnets: 10.20.0.0/23, 10.20.2.0/23, 10.20.4.0/23, …

Each gives 510 usable hosts. Check with the subnet calculator.

Common mistakes

• Forgetting the mask is contiguous. 255.255.0.255 is not a valid subnet

mask; the 1-bits must be consecutive.

• Assuming .1 is always the gateway. Convention, not a rule.
• Sizing for today. Renumbering a live network is painful and private address

space is free — leave room.

• Mixing up mask and wildcard. A wildcard mask is the inverse, used in ACLs

and OSPF.

Planning tips

Allocate on power-of-two boundaries and leave gaps between blocks so a subnet can grow without renumbering its neighbours. Document what each block is for at the time you allocate it, not later.