Subnet masks and CIDR, explained by what you actually need

Most subnetting explanations start from binary and work forward. That is the right way to learn it and the wrong way to use it. In practice you have a number of devices and a question: what prefix do I need?

Working backwards from the device count

A /24 gives you 254 usable addresses, not 256. Two are taken: the network address at the bottom and the broadcast address at the top. Every ordinary IPv4 subnet loses those two, which is why 500 devices does not fit in two /24s the way the arithmetic suggests — it fits in a /23, with 510 usable.

• /26 — 62 usable. A small office floor.
• /25 — 126 usable.
• /24 — 254 usable. The default reach-for.
• /23 — 510 usable.
• /22 — 1,022 usable.

Leave headroom. A subnet sized exactly to today's device count is a subnet you will be renumbering in eighteen months, and renumbering is the expensive kind of work.

The /31 that most calculators get wrong

Subtracting two addresses is the rule for ordinary subnets, and applying it blindly to a /31 gives zero usable addresses — which would make /31 useless. RFC 3021 says otherwise: on a point-to-point link a /31 carries two usable addresses, because there is nothing to broadcast to when there are exactly two ends.

Similarly a /32 carries one. It is a single host route, which is a completely ordinary thing to write. A calculator that reports zero for both is telling you something that contradicts the routers you are configuring.

IPv6 and the precision problem

IPv6 prefixes hold numbers far beyond what a floating-point value can represent exactly. A /64 has 18,446,744,073,709,551,616 addresses, and once a tool rounds that through a double you are looking at an approximation dressed up as a count.

Doing the arithmetic in BigInt keeps it exact. IPv6 also reserves no broadcast address, so unlike IPv4, every address in the prefix is usable.

Check for overlap before you commit

The failure that costs a weekend is two blocks in an address plan that quietly overlap — a summarised route in one place, a subnet allocated somewhere else, and traffic going to the wrong side of the network under load. Comparing two CIDR blocks by eye is exactly the sort of task humans are bad at and machines are perfect at.

An overlap check takes two seconds. Finding an overlap in production takes a day and an outage report.

Feed in both blocks and you get a plain answer: whether one contains the other, where the shared range starts and ends, and how many addresses are involved.

Keep the address plan internal

Your internal addressing is reconnaissance for anyone who wants it. Subnet arithmetic is pure computation — there is no reason for it to leave your machine, and in our calculator it does not.