子网计算器与 VLSM 设计器
快速规划 IPv4 网络。在浏览器中直接获取网络地址、广播地址、掩码、主机范围以及完整的可变长子网规划。
计算子网或设计 VLSM 规划
192.168.1.0/24
32-Bit Binary Bitmask Breakdown
Every IPv4 address consists of 32 binary bits divided into 4 octets. The bitwise AND operation (IP AND Mask = Network) isolates the network ID from the host space:
Subnet Decomposition (Split /24 into 2x /25 Subnets)
Need to segment this network for guest isolation or separate VLANs? Borrowing 1 host bit divides 192.168.1.0/24 into two equal /25 subnets:
| Subnet CIDR | Usable Host Range | Broadcast Address | Usable Hosts | Action |
|---|---|---|---|---|
| 192.168.1.0/25 | 192.168.1.1 - 192.168.1.126 | 192.168.1.127 | 126 | |
| 192.168.1.128/25 | 192.168.1.129 - 192.168.1.254 | 192.168.1.255 | 126 |
Device CLI Configuration Generator
! Cisco IOS / Catalyst / Nexus Configuration ! VLAN Interface & DHCP Pool Definition interface Vlan100 description Purple-Managed Guest WiFi ip address 192.168.1.1 255.255.255.0 no shutdown exit ip dhcp excluded-address 192.168.1.1 ip dhcp pool GUEST_WIFI_POOL network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 1.1.1.1 8.8.8.8 lease 0 1 0 exit
为什么子网划分依然至关重要
子网划分将一个 IP 范围分割为更小、隔离的网络，以便您隔离访客、员工和 IoT 流量，控制广播域，并高效利用地址空间。此计算器既支持单子网计算，也支持用于多网段设计的可变长子网掩码 (VLSM)。
该工具为您提供
- 针对任何 CIDR 前缀的网络和广播地址、子网掩码、反掩码以及可用主机范围。
- 根据所需主机数量（从大到小排序）自动适配每个子网的 VLSM 分配方案，且无重叠。
- 即时、私密的结果。所有计算均在本地运行，不会向服务器发送任何数据。
IPv4 CIDR Prefix, Subnet Mask, and Host Capacity Reference Table
Quick reference guide mapping CIDR prefix lengths (/1 to /32) to dotted-decimal subnet masks, wildcard masks, usable IP addresses, and common network engineering applications.
| CIDR | Subnet Mask | Wildcard Mask | Usable Hosts | Common Enterprise Use Case |
|---|---|---|---|---|
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | Host route, loopback interface, single endpoint |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | Point-to-point router links (RFC 3021 standard) |
| /30 | 255.255.255.252 | 0.0.0.3 | 2 | Legacy point-to-point links (dedicated network/broadcast) |
| /29 | 255.255.255.248 | 0.0.0.7 | 6 | Small router links, firewall DMZ with static IPs |
| /28 | 255.255.255.240 | 0.0.0.15 | 14 | Server rack management subnet, lab environment |
| /27 | 255.255.255.224 | 0.0.0.31 | 30 | Small branch office, security camera / IoT VLAN |
| /26 | 255.255.255.192 | 0.0.0.63 | 62 | Departmental subnet (e.g. accounting, executives) |
| /25 | 255.255.255.128 | 0.0.0.127 | 126 | Medium department, secondary branch VLAN |
| /24 | 255.255.255.0 | 0.0.0.255 | 254 | Standard Class C LAN, default office subnet |
| /23 | 255.255.254.0 | 0.0.1.255 | 510 | Hotel guest WiFi, boutique venue, medium office |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,022 | Corporate campus VLAN, medium venue guest WiFi |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,046 | University student accommodation, large venue WiFi |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,094 | Stadium, convention centre, airport guest WiFi scope |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,190 | Metropolitan network, major transit hub infrastructure |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,382 | Large enterprise site aggregation, regional network |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,766 | Multi-campus enterprise block allocation |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,534 | Standard Class B supernet, private cloud VPC |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,574 | RFC 1918 172.16.0.0/12 private range block |
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,214 | RFC 1918 10.0.0.0/8 private major network block |
High-density WiFi subnetting and DHCP scope best practices
Designing IP subnets for wireless venues differs fundamentally from wired switching architectures. Wireless devices share physical RF airtime. When a device sends an Address Resolution Protocol (ARP) broadcast or multicast packet, the wireless access point must retransmit that frame at low base data rates across all associated radios.
1. Limit broadcast domain sizes
Never deploy large flat /16 networks (65,534 hosts) on guest SSIDs without client isolation. A /22 (1,022 hosts) or /23 (510 hosts) subnet provides sufficient lease room while preventing excessive multicast airtime consumption.
2. Tune DHCP lease durations
In transient environments like retail malls, cafes, and stadiums, set DHCP lease times to 30 to 60 minutes. Long 24-hour leases cause scope exhaustion as transient visitors retain IP leases long after leaving the venue.
3. Enable wireless client isolation
Enabling AP client isolation prevents peer-to-peer device traffic on public subnets, blocking internal network scanning and mitigating malicious ARP poisoning attacks.
For student accommodation, multi-dwelling units (MDUs), and build-to-rent (BTR) communities, traditional VLAN-per-user architectures exhaust switch VLAN tables (limited to 4,094 VLANs). Learn how Purple uses Identity Pre-Shared Keys (iPSK) and RADIUS-backed dynamic isolation to give every resident a private personal area network on a single shared SSID.
Download the high-density WiFi architecture & DHCP sizing guide
Get our reference architecture guide for multi-vendor campus networks. Includes DHCP scope sizing templates for Cisco Meraki, HPE Aruba, Ruckus, and Juniper Mist, plus VLAN security checklists.
Related network engineering tools and technical guides
Multi-Tenant iPSK Subnet Designer →
Design resident subnets and DHCP pools for student housing and BTR developments.
Access Point Calculator →
Calculate required AP density and client capacity across indoor and outdoor venue areas.
Captive Portal Guide →
Comprehensive architectural guide to guest onboarding, walled gardens, and RADIUS integration.
Enterprise WiFi Security Guide →
Deep dive into 802.1X, WPA3-Enterprise, certificate-based staff authentication, and network isolation.
关于 IP 子网划分和 CIDR 的常见问题
子网掩码和 CIDR 表示法之间有什么区别？
子网掩码是一个 32 位的点分十进制数（例如 255.255.255.0），用于将 IP 地址的网络部分与主机部分隔离开来。无类别域间路由（CIDR）表示法则将相同的掩码表示为一个斜杠，后跟连续的前导二进制 1 的个数（例如 /24）。CIDR 消除了严格的 A、B、C 类网络边界，从而允许灵活的网络前缀长度。
如何计算 IPv4 子网中的可用主机地址？
可用 IPv4 主机地址的计算公式为 2^(32 - 前缀长度) - 2。根据 RFC 标准，有两个地址被保留：第一个地址（所有主机位均为 0）是网络 ID，最后一个地址（所有主机位均为 1）是定向广播地址。例如，一个 /24 子网有 32 - 24 = 8 个主机位，从而产生 2^8 - 2 = 254 个可用主机。根据 RFC 3021 的点对点 /31 子网和单主机 /32 回环地址是特例，分别允许 2 个和 1 个可用地址。
对于访客 WiFi 和高密度场所，推荐使用什么大小的子网？
对于体育场、酒店和零售商场等高密度访客 WiFi 环境，建议使用 /22 子网（1,022 个可用租约）或 /20 子网（4,094 个可用租约），并配合较短的 DHCP 租期（例如 30 到 60 分钟）。这可以防止 DHCP 地址池耗尽，同时客户端隔离可以防止无线网络中的 ARP 广播风暴。
什么是可变长子网掩码（VLSM），为什么要使用它？
VLSM 允许网络工程师根据每个网段（如 POS 终端、企业工作站、访客 WiFi 和路由器链路）的具体主机需求，将一个 IP 地址块划分为不同大小的子网。与固定长度子网划分相比，这避免了地址空间的浪费。
为什么高密度 WiFi 网络应避免使用大型扁平的 /16 子网？
扁平的 /16 子网会创建庞大的广播域，容纳多达 65,534 个主机。在无线网络上，广播和组播帧（如 ARP 请求和 mDNS）会以较低的传统数据速率在所有接入点上传输，从而消耗空口时间并降低吞吐量。通过 AP 客户端隔离将其细分为较小的 /22 或 /23 VLAN，可以保持空口效率。
Purple 如何与企业子网和 VLAN 划分协同工作？
Purple 与您的企业网络基础设施（Cisco Meraki、HPE Aruba、Ruckus、Juniper Mist 和 Fortinet）集成，无需重新配置硬件即可提供云端强制门户、通过 RADIUS 实现的动态 VLAN 引导以及住户隔离的 iPSK 网络。
Planning a venue network?
Subnetting is the foundation. Purple layers guest onboarding, captive portals, and location analytics on top of the network you design here, across Cisco Meraki, HPE Aruba, Ruckus, and Juniper Mist.
Book a 20-min demoNetforge Network Multi-Tool
Run offline network health checks, path analysis, and latency diagnostic scans directly from your desktop.
Download Multi-Tool