How to calculate a subnet mask

Step 1: Work out how many hosts you need

Start with the largest number of devices that will ever sit on this subnet at once, then add a little headroom for growth. Every subnet loses two addresses to the network and broadcast address, except /31 and /32, so budget for that automatically. You do not subtract it yourself; the steps below already account for it.

Say a new office floor needs room for 40 devices: laptops, phones, printers, and access points. That host count is what drives every step that follows.

Doing it in your head: the magic numbers

Everything in subnetting is powers of two, and there are only eight numbers to hold. Once they are in your head you can answer most subnetting questions without a calculator, which is the difference between checking a design and guessing at one.

The trick that makes the last octet easy is the block size: 256 minus the mask value. A mask of 192 gives a block size of 64, so the /26 networks in a /24 start at 0, 64, 128 and 192. A mask of 240 gives a block size of 16, so /28 networks start at 0, 16, 32, 48 and so on. Find the block size, count in multiples of it, and you have every subnet boundary without writing out a single bit.

Block size is 256 minus the mask octet. The /31 row is the exception to every rule in this table: it has two addresses and both are usable, because a point-to-point link has no need of a broadcast address.

Three worked examples, easy to hard

Example one, the straightforward case. You need a subnet for 50 devices. Round 50 up to the next power of two and you get 64, but two of those go to the network and broadcast addresses, so 64 gives you 62 usable, which fits. 64 addresses means 6 host bits, so the prefix is 32 minus 6, a /26, mask 255.255.255.192. Had you needed 63 devices the answer would still be /26; at 63 usable you would have to step up to a /25.

Example two, the off-by-one case. You need exactly 62 devices plus a gateway, so 63 addresses in use. A /26 gives 62 usable, which is one short once the gateway is counted, and this is the mistake that shows up in production rather than in the exam: the gateway is a host too. Step up to a /25 with 126 usable. The rule to carry away is to size for hosts plus infrastructure, not hosts alone.

Example three, unequal splitting. You have 198.51.100.0/24 and four segments needing 100, 50, 25 and 10 hosts. Allocate largest first so nothing gets stranded. 100 hosts needs a /25 (126 usable), taking 198.51.100.0/25. 50 hosts needs a /26 (62 usable), and the next free boundary is 198.51.100.128/26. 25 hosts needs a /27 (30 usable), at 198.51.100.192/27. 10 hosts needs a /28 (14 usable), at 198.51.100.224/28. That leaves 198.51.100.240/28 spare. Allocating smallest first would have scattered the small blocks across the boundaries a /25 needed, and the /25 would not have fitted.

Each block starts on a multiple of its own size, which is the rule that keeps them from overlapping. 198.51.100.0/24 is documentation space under RFC 5737, so this plan can be built in a lab as written.

Step 2: Find the smallest power of two that covers it

Usable host counts follow the pattern 2, 6, 14, 30, 62, 126, 254 and upward, each one two short of a power of two (2^h - 2 for h host bits). Find the first number in that list that is at least as large as your host count.

For 40 hosts, 30 is too small and 62 is the first one that fits. 62 usable hosts needs 6 host bits, because 2^6 - 2 = 62.

Step 3: Convert the host bits to a prefix

An IPv4 address has 32 bits total, so the prefix length is 32 minus the host bits. With 6 host bits, the prefix is 32 - 6 = /26.

Prefix length and host bits always trade off: more host bits means a shorter, less specific prefix and a bigger network; fewer host bits means a longer prefix and a smaller one.

Step 4: Turn the prefix into a mask

A /26 means the first 26 bits are 1s and the remaining 6 are 0s: 11111111.11111111.11111111.11000000 in binary. Group those bits into four octets and convert each to decimal to get 255.255.255.192.

You rarely need to do this bit by bit once you know the eight values a masked octet can take: 0, 128, 192, 224, 240, 248, 252, 254, or 255. The subnet mask calculator converts any prefix, or the host count itself, to a mask instantly.

Worked example: 40 hosts

Put it together: 40 hosts needs the next host-count boundary up, which is 62 (6 host bits). 32 - 6 = /26, and a /26 mask is 255.255.255.192. Assigned to 192.0.2.0, that gives the network 192.0.2.0/26, usable hosts 192.0.2.1 through 192.0.2.62, and broadcast 192.0.2.63, room for 62 devices with 22 addresses of headroom over the 40 you started with.

See this exact math worked out for other host counts on the subnet by host count page, or go the other direction, from a prefix to its host count, on the CIDR cheat sheet.

Sources

Everything technical on this page is checkable against the documents below. Where a document and common practice disagree, the guide says so rather than picking one quietly.

• RFC 950: Internet Standard Subnetting Procedure
• RFC 1878: Variable Length Subnet Table for IPv4
• RFC 5737: IPv4 address blocks reserved for documentation, used for every example here

Spotted something wrong? Tell us and it gets corrected. How the data is maintained is described on the about page.