/21 Subnet Mask: 255.255.248.0

A /21 subnet contains 2^(32 − 21) = 2^11 = 2,048 IP addresses. Two are reserved (network 10.21.0.0 and broadcast 10.21.7.255 in the example block), leaving 2,046 usable host addresses; in AWS or Azure, which reserve 5, you can assign 2,043.

Each step of one bit in the prefix halves or doubles the count: a /21 is half a /20 and two /22 subnets.

• Subnet mask: 255.255.248.0 (binary 11111111.11111111.11111000.00000000)
• Wildcard mask: 0.0.7.255
• Addresses / usable hosts: 2,048 / 2,046
• A /21 equals 8 contiguous /24 networks.

Typical use: Campus floors or regional VLANs with up to ~2,000 hosts. Example block: 10.21.0.0/21 runs from 10.21.0.0 to 10.21.7.255.

Classless Inter-Domain Routing (CIDR) writes a network as an address followed by a prefix length: /24 means the first 24 of the 32 bits identify the network and the remaining 8 bits identify hosts inside it. The prefix length replaces the old class A/B/C system, which only allowed /8, /16 and /24 boundaries.

The bit visualizer above shows this split directly: network bits in indigo, host bits in emerald. Moving the prefix one bit to the right halves the block; moving it one bit left doubles it. Every subnetting question reduces to that one rule.

The network address is the first address in the block (all host bits 0) and the broadcast address is the last (all host bits 1). Neither can be assigned to a host on a normal LAN, so a block of 2^(32-prefix) addresses gives 2^(32-prefix) - 2 usable hosts.

Two prefixes break that rule. A /31 has two addresses and, per RFC 3021, both are usable on point-to-point links. A /32 is a single host and is used for loopbacks, host routes, firewall rules and cloud security-group entries.

The wildcard mask is the bitwise inverse of the subnet mask (0.0.0.255 for a /24). Cisco ACLs and OSPF network statements use wildcard masks instead of subnet masks.

RFC 1918 reserves three private IP ranges that are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These private network IP ranges are what home routers, office LANs and cloud VPCs use internally, with NAT translating them to a public address at the edge.

Other local IP ranges you will meet in logs include 100.64.0.0/10 (carrier-grade NAT), 169.254.0.0/16 (link-local addresses a host assigns itself when DHCP fails) and 127.0.0.0/8 (loopback). The calculator labels each result with its scope so you can tell instantly whether an address in an alert is internal or internet-facing.

Splitting a block means borrowing host bits for the network portion. A /24 split into /26 subnets borrows 2 bits, producing 4 subnets of 64 addresses (62 usable hosts) each. Use Split on any row to halve it, or choose a target prefix to carve the whole block at once.

Merging (summarization or supernetting) is the reverse: two adjacent, equally sized and correctly aligned blocks combine into one block with a prefix one shorter. 10.0.0.0/25 and 10.0.0.128/25 merge into 10.0.0.0/24, but 10.0.0.128/25 and 10.0.1.0/25 cannot, because they do not share a /24 boundary.

• AWS reserves 5 addresses per subnet (network, VPC router, DNS, future use, broadcast), so a /28 gives 11 usable instances, not 14.
• Azure also reserves 5 addresses per subnet; GCP reserves 4.
• Plan VPCs with room to grow: a /16 VPC split into /20 subnets gives 16 subnets of 4,091 hosts.

To convert a subnet mask to CIDR, count the 1 bits: 255.255.255.224 is 27 ones, so it is a /27. The converter bar under the bit map does this for subnet masks and for Cisco-style wildcard masks (0.0.0.31 is also a /27), then loads the result into the calculator with one click.

Going the other way, the calculator is a CIDR to IP range converter: every block shows its first and last address. For an arbitrary range that does not fall on a block boundary, the IP range to CIDR field returns the smallest set of CIDR blocks that covers it exactly. 192.168.1.10 – 192.168.1.20 becomes 192.168.1.10/31, 192.168.1.12/30, 192.168.1.16/30 and 192.168.1.20/32, ready for a firewall allow-list or a cloud security group.

Before CIDR (1993), the first bits of an address fixed its network size. The classes no longer control routing, but they still appear in exams, legacy equipment and conversation, so the converter includes a reference table.

• Class A: 1.0.0.0 – 126.255.255.255, leading bit 0, default mask /8, private block 10.0.0.0/8.
• Class B: 128.0.0.0 – 191.255.255.255, leading bits 10, default mask /16, private block 172.16.0.0/12.
• Class C: 192.0.0.0 – 223.255.255.255, leading bits 110, default mask /24, private block 192.168.0.0/16.
• Class D (224.0.0.0/4) is multicast and class E (240.0.0.0/4) is reserved; 127.0.0.0/8 is loopback.