/21 Subnet Mask: 255.255.248.0

1. What a /21 network is

The /21 in a CIDR block is the prefix length: how many leading bits identify the network. Those 21 bits are identical for every address in the block, and the remaining 11 host bits are free to vary. Written out as a mask that is 21 ones followed by 11 zeros, which in dotted decimal is 255.255.248.0.

prefix     /21
mask       255.255.248.0
binary     11111111.11111111.11111000.00000000
wildcard   0.0.7.255

11 host bits give 2¹¹ = 2,048 addresses. Two of them are not assignable to an interface: the first is the network address and the last is the broadcast address. That leaves 2,046 usable hosts.

The wildcard mask is the bitwise inverse of the subnet mask — 0.0.7.255 here — and it is what Cisco access lists and OSPF network statements expect instead of a netmask. A zero bit in a wildcard means “this bit must match”, which is the opposite convention to a netmask, and mixing the two up is one of the most common configuration errors in the subject. In classful terms a /21 is between the class B and class C default masks.

2. The 192.168.8.0/21 block, address by address

A worked example is easier to check than a formula. 192.168.8.0/21 is a real /21 inside a private range, and every figure below follows from the mask alone:

network  11000000.10101000.00001000.00000000
mask     11111111.11111111.11111000.00000000

Line the two up and the rule is visible: wherever the mask has a 1, the network bit is fixed; wherever it has a 0, the address is free to count up. This is also why entering any address inside the block gives the same answer — the calculator masks the host bits away, so 192.168.8.1/21 and 192.168.8.0/21 describe the same network.

3. How many /21 networks fit inside a bigger block

Prefix arithmetic is powers of two all the way down: each extra bit of prefix halves the block. Going the other way, the number of /21 networks inside a shorter prefix is two to the power of the difference between the two prefix lengths, which is where these counts come from.

The usable-host column is the one worth noticing. Every split costs two addresses per subnet to the network and broadcast addresses, so a plan built from many small subnets always has fewer usable addresses than the block it came from — dividing one /24 into eight /27s leaves 240 usable addresses where the /24 had 254. That is the real price of a subnetting plan, and it is why router-to-router links in a modern design get /31s rather than /30s.

4. Splitting a /21

Borrowing host bits turns one block into several equal ones. Each bit borrowed doubles the number of subnets and halves their size:

The console at the top of this page does this for you: set the CIDR to a /21 and choose a longer prefix under Split into to get the resulting networks with their ranges. It caps how many rows it draws — splitting a /8 into /24s is 65,536 subnets — but the count it reports is always the true total.

5. Where a /21 is used

2,046 hosts, or eight /24s. Used when a /22 runs out but a /20 would waste a block.

A prefix length says nothing about whether the addresses are private. That is decided by the address itself: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are the RFC 1918 private ranges, 100.64.0.0/10 is carrier-grade NAT space from RFC 6598, 169.254.0.0/16 is link-local, and 127.0.0.0/8 is loopback. A /21 carved out of any of them is private; the same /21 out of a public allocation is globally routable. The console labels which range an address falls into, including the documentation blocks from RFC 5737 that turn up in tutorials.

IPv6 changes the habit rather than the arithmetic. The mask still marks the network bits, but subnets are conventionally /64 regardless of how many hosts are on them — SLAAC needs 64 host bits — and a site is normally delegated a /48 or /56. There is no broadcast address to subtract, so the “minus two” rule has no IPv6 equivalent. The console handles IPv6 blocks as well; switch the address family above.

6. CIDR to subnet mask, around /21

The neighbouring prefixes, for when the question is really “which one do I need?” — each row is a page of its own with the same worked detail:

The subnet calculator carries the full /8 to /32 chart, and works the question backwards too: give it a host count and it returns the shortest prefix that fits, which is the calculation a design actually starts from.