/11 Subnet: Mask 255.224.0.0

How many /11 networks fit

One /11 is 32 × /16. Eight /11s make a /8, so it suits a plan with eight regions or business units.

Worked example: 172.20.15.3/11

Someone wrote a firewall rule for 172.16.0.0/11, thinking it was the private 172.16 range. Let's see what it really covers by working out the /11 that 172.20.15.3 belongs to.

1. The mask is 255.224.0.0. The second octet (224) is the "interesting" one — the first that is not 255.
2. Block size = 256 − 224 = 32. Networks start at multiples of 32 in the second octet: 0, 32, 64, …
3. The second octet of 172.20.15.3 is 20. 20 ÷ 32 = 0 remainder 20, so the block starts at 0 × 32 = 0.
4. Network = 172.0.0.0 (octets after the second become 0). Broadcast = 0 + 32 − 1 = 31, giving 172.31.255.255 (octets after it become 255).
5. Usable hosts: 172.0.0.1 to 172.31.255.254, which is 2²¹ − 2 = 2,097,150 addresses.

Address  10101100.000|10100.00001111.00000011
Mask     11111111.111|00000.00000000.00000000
Network  10101100.000|00000.00000000.00000000

Where /11 is used in real networks

• Eight regions out of 10.0.0.0/8

  10.0.0.0/11, 10.32.0.0/11, 10.64.0.0/11 … 10.224.0.0/11 give eight equal blocks of 32 /16s each, one per region or business unit.

• Reading other people's plans

  Large ISPs and cloud providers publish ranges like this in their IP lists. Knowing the boundaries (multiples of 32) lets you sanity-check an allow list quickly.

Common /11 mistakes

• Writing 172.16.0.0/11 for the private range. The real RFC 1918 block is 172.16.0.0/12. A /11 has to start at a multiple of 32, so 172.16.0.0/11 becomes 172.0.0.0/11 — which includes public addresses 172.0.0.0 to 172.15.255.255.
• Assuming a /11 is "a bit bigger than a /12". It is exactly twice the size; every bit you remove from the prefix doubles the block.
• Hand-converting 255.224.0.0 to a wildcard and getting 0.32.255.255. The correct wildcard is 0.31.255.255 (255 − 224 = 31).

/11 FAQ

Related tools