How to Calculate a Subnet Mask (By Hand and Quickly)

Subnetting looks like arithmetic and is really just counting bits. Once you can see an address as 32 bits rather than four numbers, every subnet question becomes the same question: where does the network part stop?

Step 1: know your powers of two

Everything in subnetting comes back to this row:

If you know these, you can size any subnet in your head.

Step 2: convert a prefix to a mask

A /26 means 26 leading 1-bits:

11111111.11111111.11111111.11000000

Group in eights and convert each: 255, 255, 255, and 11000000 = 192. So /26 is 255.255.255.192.

The only octet needing thought is the one where the boundary falls. There are just eight possible values, worth memorising:

Step 3: find the block size

Block size = 256 − the interesting octet value. For /26, that is 256 − 192 = 64. Subnets therefore start at 0, 64, 128, 192.

This is the fastest trick in subnetting. To find which subnet an address is in, round its interesting octet *down* to the nearest multiple of the block size.

For 192.168.1.100/26: block size 64, and 100 rounds down to 64. So:

• Network: 192.168.1.64
• Broadcast: 192.168.1.127 (next network minus one)
• Usable: 192.168.1.65 – 192.168.1.126
• Hosts: 64 − 2 = 62

No binary conversion required once you have the block size.

Step 4: count hosts

hosts = 2^(32 − prefix) − 2

The −2 removes the network and broadcast addresses. Two exceptions:

• /31 gives 2 usable addresses, not 0 — RFC 3021 allows both on

point-to-point links.

• /32 is a single host, used for loopbacks and specific route entries.

Worked example

Split 10.20.0.0/16 into subnets for 500 hosts each.

1. 500 hosts needs 512 addresses (next power of two).
2. 512 = 2⁹, so 9 host bits, so prefix = 32 − 9 = /23.
3. Mask for /23: 255.255.254.0.
4. Block size in the third octet: 256 − 254 = 2.
5. Subnets: 10.20.0.0/23, 10.20.2.0/23, 10.20.4.0/23, …

Each gives 510 usable hosts, and a /16 divides into 2^(23−16) = 128 of them. Check with the subnet calculator.

Second worked example: which subnet is this address in?

Given 172.16.37.200/21, the prefix lands in the third octet (bits 17–24), so that is the interesting one.

1. /21 leaves 5 bits in the third octet, so its mask value is 248 — mask

255.255.248.0.

1. Block size = 256 − 248 = 8.
2. Round 37 down to the nearest multiple of 8 → 32.
3. Network: 172.16.32.0. Next network is 172.16.40.0, so broadcast is

172.16.39.255.

1. Usable: 172.16.32.1 – 172.16.39.254, which is 2¹¹ − 2 = 2,046 hosts.

Note that the host range spans eight third-octet values. Whenever the prefix is shorter than /24 the subnet covers multiple octet values, and that is where most by-hand errors happen.

Counting subnets as well as hosts

Two questions, two formulas:

• Hosts per subnet: 2^(32 − prefix) − 2
• Subnets created: 2^(new prefix − old prefix)

Splitting a /24 into /26s gives 2^(26−24) = 4 subnets of 62 hosts. Splitting the same /24 into /28s gives 16 subnets of 14 hosts. The product of subnets and addresses per subnet is always the size of the parent block.

VLSM: mixing sizes in one block

Fixed-size subnetting wastes space when your segments differ in size. Variable length subnet masking assigns each segment only what it needs. Allocate largest first, from the bottom of the block.

Dividing 192.168.10.0/24 for segments of 100, 50, 25, 10 and 2 hosts:

That consumes 244 of 256 addresses and leaves 192.168.10.244 – .255 free — enough for three more /30 links. Allocating smallest first instead strands blocks that are correctly sized but misaligned, since every subnet must start on a multiple of its own size.

Point-to-point links

A router-to-router link needs exactly two addresses, so a /30 (2 usable of 4) is the traditional choice. A /31 is better where supported: 2 usable of 2, halving the waste across a network with hundreds of links.

Common mistakes

• Forgetting the mask is contiguous. 255.255.0.255 is not a valid subnet

mask; the 1-bits must be consecutive.

• Assuming .1 is always the gateway. Convention, not a rule.
• Sizing for today. Renumbering a live network is painful and private address

space is free — leave room.

• Mixing up mask and wildcard. A wildcard mask is the inverse, used in ACLs

and OSPF.

• Misaligned networks. 192.168.1.100/26 is a host address, not a network

address — the network is 192.168.1.64. Writing a network that is not a multiple of its block size is the most common configuration error.

Planning tips

Allocate on power-of-two boundaries and leave gaps between blocks so a subnet can grow without renumbering its neighbours. Document what each block is for at the time you allocate it, not later.

A scheme that holds up: give each site a /16 out of 10.0.0.0/8, each role within a site a /20, and each VLAN a /24. You will never run out — the 10.0.0.0/8 block holds 16,777,216 addresses — and a prefix encodes its own meaning, which makes firewall rules and route summaries short.

Finally, remember the mask is contiguous on purpose: that is what lets a router match a destination with one bitwise AND rather than a lookup, and it is why aggregation works at all.