Subnet Planner
Carve a big IPv4 range into subnets on a visual map. Split, merge, resize, and add blocks, see used vs free space, and learn the CIDR math behind each one. Nothing is saved: refresh to start over.
2 reserved per subnet
Address map
UsedFreeGroup
10.0.0.010.0.128.010.0.255.255
Click a block to select it. Drag a selected block's edges to resize it. Double-click a group to zoom in.
Subnets
Every block in address order. Double-click a group to zoom the map. Shortcuts: V S M A X for tools, + / − to grow or shrink, / to split, Delete to free up.
| Block | Labels | Addresses | Usable | Used / free | Actions |
|---|---|---|---|---|---|
10.0.0.0/16my-vpc10.0.0.0 – 10.0.255.255 | 65,536 | 65,534 | 0% used |
10.0.0.0/16Range
Top-level range (a pool of addresses)
Change this block
Grow doubles the block (/16 → /15). Shrink halves it. Merge joins it with its buddy.
Used vs free space
Used 0Free 65,5360 subnets · 0%1 free block, largest /16
Label
Top-level ranges are pools. Their subnets count as used.
Addresses
- Network
- 10.0.0.0
- Netmask
- 255.255.0.0 (/16)
- Wildcard
- 0.0.255.255
- First usable
- 10.0.0.1
- Last usable
- 10.0.255.254
- Broadcast
- 10.0.255.255
- Addresses
- 65,536
- Usable hosts
- 65,534
- Reserved
- 2
Reserved addresses
- 10.0.0.0Network address
- 10.0.255.255Broadcast address
In binary
Network0000101000000000000000000000000010.0.0.0
Mask11111111111111110000000000000000255.255.0.0
Broadcast0000101000000000111111111111111110.0.255.255
network bits (16) host bits (16) prefix boundary
How the math works
- 1Split the 32 bits
/16 → 16 network bits + 16 host bitsThe prefix says how many leading bits are the same for every address in the subnet. - 2Block size
2^16 = 65,536 addressesEach host bit doubles the number of addresses. - 3Subnet mask
16 ones then 16 zeros = 255.255.0.0 - 4Interesting octet: #3
256 − 0 = 256The network bits end inside octet 3, so subnets count up by 256 there. - 5Network address
0 → largest multiple of 256 that is ≤ 0 = 0 ⇒ 10.0.0.0Every octet after it becomes 0. - 6Last (broadcast) address
0 + 256 − 1 = 255 ⇒ 10.0.255.255Every octet after it becomes 255. - 7Usable hosts
2^16 − 2 = 65,534The network and broadcast addresses can't be given to hosts. - 8Wildcard mask
255.255.255.255 − 255.255.0.0 = 0.0.255.255The mask inverted. ACLs and OSPF use it.
Learn
Samples
Layouts for learning how CIDR math works. They aren't production recommendations. Open one, then split, merge, and resize it in the planner above.
Halving a /16
Each extra prefix bit cuts a block in half. Follow /16 → /17 → /18.
10.0.0.0/16
- /16 = 65,536 addresses, /17 = 32,768, /18 = 16,384
- The two halves of a block are buddies. Only buddies can merge back together.
- Try it: pick the Split tool and click the free 10.0.128.0/17
VPC: 3 AZs × public / private / data
One /18 per Availability Zone, split the same way in each.
10.0.0.0/16
- Private subnets get the biggest block because most workloads run there
- Using the same layout in every AZ keeps route tables predictable
- 10.0.192.0/18 stays free for a fourth AZ
- Switch to AWS mode to see 5 reserved IPs per subnet
VLSM: one /24 for four teams
Size each subnet to its host count, allocating largest first so blocks stay aligned.
192.168.10.0/24
- web needs 100 hosts: 100 + 2 reserved = 102, next power of two is 128, so /25
- app 50 → /26 (64), db 20 → /27 (32), mgmt 10 → /28 (16)
- What's left over: one free /28
- Try it yourself: add a /24 and use Allocate by host count
Overlapping VPCs
VPC peering, VPNs, and Transit Gateway need ranges that don't overlap. This set has a conflict.
10.0.0.0/1610.1.0.0/1610.0.128.0/20
- legacy-vpc 10.0.128.0/20 sits inside prod-vpc 10.0.0.0/16, right on top of app-a
- CIDR blocks never partially overlap: one always contains the other
- dev-vpc 10.1.0.0/16 is safe because it starts right after prod ends
Tiny subnets: /30 and /31 links
Router-to-router links need only two addresses. See what reserved addresses cost at small sizes.
172.16.0.0/24
- /30 = 4 addresses, 2 usable (network and broadcast are reserved)
- /31 = 2 addresses, both usable on point-to-point links (RFC 3021)
- AWS mode flags these because AWS subnets must be /28 or larger