/12 Subnet: Mask 255.240.0.0

A /12 splits the second octet into blocks of 16. It is famous for one block: 172.16.0.0/12, the middle RFC 1918 private range that runs from 172.16.0.0 to 172.31.255.255.

/12 at a glance

Subnet mask
255.240.0.0
Wildcard mask
0.15.255.255
Usable hosts
1,048,574
Total addresses
1,048,576 (220)
Block size (second octet)
16
Network / host bits
12 / 20
Mask in hex
0xFFF00000

Mask in binary: 11111111.11110000.00000000.00000000

Network bits Host bits

Try it: which /12 is an address in?

Network address
172.16.0.0/12
First usable host
172.16.0.1
Last usable host
172.31.255.254
Broadcast address
172.31.255.255
Next /12 starts at
172.32.0.0
Open this in the full subnet calculator (binary view, exports, cloud reserved IPs) →

How many /12 networks fit

How /12 relates to /8, /16 and /24 blocks
Parent block Relationship
/8 16 × /12 fit inside one /8
/16 One /12 covers 16 × /16
/24 One /12 covers 4,096 × /24

A /12 holds 16 × /16. That is why Docker can hand out 172.17.0.0/16, 172.18.0.0/16 and so on up to 172.31.0.0/16 from the same private range.

Worked example: 172.29.88.150/12

A container reports the address 172.29.88.150. Is it inside the private 172.16.0.0/12 range, and what are the block's edges?

  1. The mask is 255.240.0.0. The second octet (240) is the "interesting" one — the first that is not 255.
  2. Block size = 256 − 240 = 16. Networks start at multiples of 16 in the second octet: 0, 16, 32, …
  3. The second octet of 172.29.88.150 is 29. 29 ÷ 16 = 1 remainder 13, so the block starts at 1 × 16 = 16.
  4. Network = 172.16.0.0 (octets after the second become 0). Broadcast = 16 + 16 − 1 = 31, giving 172.31.255.255 (octets after it become 255).
  5. Usable hosts: 172.16.0.1 to 172.31.255.254, which is 220 − 2 = 1,048,574 addresses.

Same thing in binary (network bits | host bits):

Address  10101100.0001|1101.01011000.10010110
Mask     11111111.1111|0000.00000000.00000000
Network  10101100.0001|0000.00000000.00000000

Where /12 is used in real networks

  • RFC 1918 private range 172.16.0.0/12

    The private range is a /12, not a /16. It covers sixteen /16s: 172.16.x.x up to 172.31.x.x. See the 172.16.0.0/12 page for who uses which part.

  • Docker networks

    Docker's default bridge is 172.17.0.0/16 and new user-defined networks take the next free /16 from the same /12 (172.18, 172.19 …). Hosts on a corporate 172.x network can lose routes when Docker grabs an overlapping block.

  • AWS default VPC

    Every AWS account's default VPC is 172.31.0.0/16, the last /16 inside this /12.

Common /12 mistakes

  • Writing the private range as 172.16.0.0/16. That covers only 172.16.x.x, leaving 172.17 to 172.31 out of your firewall rules or NAT policy.
  • Treating all of 172.0.0.0/8 as private. Addresses like 172.217.x.x belong to Google and are public. Only 172.16 to 172.31 are private.
  • Writing 172.20.0.0/12. The second octet must be a multiple of 16, so the block snaps back to 172.16.0.0/12.

/12 FAQ

What is the range of 172.16.0.0/12?

172.16.0.0 to 172.31.255.255. The second octet runs from 16 to 31, which is 16 values, matching the block size 256 − 240 = 16.

How many hosts are in a /12?

1,048,574 usable: 2^20 = 1,048,576 addresses minus network and broadcast.

Is 172.32.0.1 a private IP?

No. 172.32.0.1 is just outside 172.16.0.0/12 and is public address space.

What is the wildcard for 172.16.0.0/12?

0.15.255.255. A Cisco ACL entry would be: permit ip 172.16.0.0 0.15.255.255 any.

Related tools

Subnet Calculator Full /12 breakdown with binary and exports Wildcard Mask Calculator ACL and OSPF wildcard for /12 and every other prefix CIDR Calculator Split 172.16.0.0/12 into smaller blocks VLSM Calculator Mix /12 with other sizes in one plan Subnet Mask Calculator Convert mask ↔ prefix ↔ host count Subnetting Practice Drill questions like this one, with visual answers

Well-known /12 networks: 172.16.0.0/12