What is subnetting?
Subnetting divides one IP network into smaller networks. The subnet mask (or CIDR prefix like /26) decides how many leading bits identify the network and how many are left for hosts. Each subnet gets its own network address, broadcast address and usable host range, which keeps broadcast traffic contained, lets you apply firewall and routing rules per segment, and makes address space easy to hand out to VLANs, VPCs or teams.
How to calculate a subnet by hand
Take 192.168.10.77/26. A /26 mask is 255.255.255.192, so the last octet is split into blocks of 256 − 192 = 64: .0, .64, .128 and .192. The address .77 falls in the block starting at .64, so the network address is 192.168.10.64 and the broadcast address is the last address of that block, 192.168.10.127. Usable hosts run from .65 to .126 — 64 addresses minus the network and broadcast, so 62 hosts. The calculator above shows the same result with the binary breakdown, which is the fastest way to check your working.
CIDR quick reference
/30 = 255.255.255.252, 4 addresses, 2 usable. /29 = 255.255.255.248, 8 addresses, 6 usable. /28 = 255.255.255.240, 16 addresses, 14 usable. /27 = 255.255.255.224, 32 addresses, 30 usable. /26 = 255.255.255.192, 64 addresses, 62 usable. /25 = 255.255.255.128, 128 addresses, 126 usable. /24 = 255.255.255.0, 256 addresses, 254 usable. /20 = 255.255.240.0, 4,096 addresses. /16 = 255.255.0.0, 65,536 addresses. Each step down in prefix length doubles the size of the network.
What do /31 and /32 mean?
A /32 is a single address — used for host routes, loopback addresses and security-group or firewall rules that should match exactly one IP. A /31 has two addresses and no network or broadcast address (RFC 3021), so both are usable; it is the efficient choice for point-to-point router links instead of a /30, which wastes two of its four addresses. This calculator reports 2 usable hosts for /31 and 1 for /32 rather than the usual minus-two.
Cloud subnets: AWS, Azure and GCP reserve addresses
Cloud providers keep some addresses in every subnet for themselves, so the usable count is lower than the math above. AWS reserves 5 (the network address, .1 for the VPC router, .2 for DNS, .3 for future use, and the last address), so a /24 gives 251 usable IPs; AWS subnets must be between /16 and /28. Azure also reserves 5 (network, .1 gateway, .2 and .3 for DNS, and broadcast), leaving 251 in a /24, with /29 as the smallest subnet. Google Cloud reserves 4 (network, .1 gateway, the second-to-last address and broadcast), leaving 252, with /29 as the smallest primary range.
Splitting a network into different-sized subnets (VLSM)
Variable-length subnet masking lets one block serve segments of different sizes. Allocate the largest subnet first so each block starts on a boundary of its own size. For example, 10.0.0.0/24 can hold a /25 for 126 hosts (10.0.0.0–10.0.0.127), a /26 for 62 hosts (10.0.0.128–10.0.0.191) and two /27s for 30 hosts each (10.0.0.192/27 and 10.0.0.224/27) with nothing left over. Planning smallest-first usually leaves gaps that a larger subnet can no longer fit into.
What is a wildcard mask?
A wildcard mask is the subnet mask with every bit inverted: 255.255.255.192 becomes 0.0.0.63. Each octet is 255 minus the mask octet. Cisco IOS access lists and OSPF network statements use wildcard masks instead of subnet masks, so access-list 10 permit 192.168.10.64 0.0.0.63 matches the whole 192.168.10.64/26 subnet. The calculator shows the wildcard for whatever prefix you enter.
Private ranges, same-subnet checks and IPv6
The private IPv4 ranges from RFC 1918 are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16; 100.64.0.0/10 is reserved for carrier-grade NAT. Two hosts are on the same subnet when their IP addresses ANDed with the mask give the same network address — if they differ, traffic between them must go through a router. This tool covers IPv4. IPv6 networks are normally subnetted at /64 per LAN, so the planning question becomes how many /64s a /48 or /56 allocation gives you (65,536 or 256). From a Linux terminal, ipcalc and sipcalc print the same values, and sipcalc also handles IPv6.