/16 Subnet: Mask 255.255.0.0

A /16 fixes the first two octets and leaves the last two free: 65,536 addresses. It is the standard "one network per site or per VPC" size, and the largest CIDR block AWS allows for a VPC.

/16 at a glance

Subnet mask
255.255.0.0
Wildcard mask
0.0.255.255
Usable hosts
65,534
Total addresses
65,536 (216)
Block size (second octet)
1
Network / host bits
16 / 16
Mask in hex
0xFFFF0000

Mask in binary: 11111111.11111111.00000000.00000000

Network bits Host bits

Try it: which /16 is an address in?

Network address
172.17.0.0/16
First usable host
172.17.0.1
Last usable host
172.17.255.254
Broadcast address
172.17.255.255
Next /16 starts at
172.18.0.0
Open this in the full subnet calculator (binary view, exports, cloud reserved IPs) →

How many /16 networks fit

How /16 relates to /8, /16 and /24 blocks
Parent block Relationship
/8 256 × /16 fit inside one /8
/16 Same size: a /16 is exactly one /16
/24 One /16 covers 256 × /24

A /16 holds 256 × /24. That is the usual next step down: one /16 per site or VPC, one /24 (or smaller) per VLAN or subnet inside it.

Worked example: 172.17.3.8/16

A container on a Docker host has the IP 172.17.3.8. Which /16 is it in, and which addresses does that block cover?

  1. /16 is 2 full octets of network bits (mask 255.255.0.0), so the boundary falls exactly between octets. No block-size maths is needed.
  2. Keep the first 2 octets of 172.17.3.8 and set the rest to 0: network = 172.17.0.0.
  3. Set the rest to 255 instead: broadcast = 172.17.255.255.
  4. Usable hosts run from 172.17.0.1 to 172.17.255.254: 216 − 2 = 65,534.

Same thing in binary (network bits | host bits):

Address  10101100.00010001|00000011.00001000
Mask     11111111.11111111|00000000.00000000
Network  10101100.00010001|00000000.00000000

Where /16 is used in real networks

  • AWS VPCs

    AWS VPCs can be anywhere from /16 to /28, so 10.x.0.0/16 is the default choice. The console wizard suggests 10.0.0.0/16 — which is exactly why so many VPCs overlap when teams later try to peer them.

  • Docker's default bridge

    172.17.0.0/16 is docker0, the default bridge on every Docker host. See the 172.17.0.0/16 page for the routing clash it causes on some corporate networks.

  • Kubernetes pod networks

    Flannel's default pod CIDR is 10.244.0.0/16 and Calico's is 192.168.0.0/16. Each node gets a smaller slice (often a /24) out of it. Check yours with the pod CIDR calculator.

Common /16 mistakes

  • Giving every VPC 10.0.0.0/16 because it is the default. The day two of them need to talk (peering, Transit Gateway, VPN), the overlap blocks it and re-addressing a VPC is painful. Give each VPC its own /16 from a central plan.
  • Making a /16 one flat VLAN. 65,000 devices in one broadcast domain will drown in ARP and broadcast traffic. Cut it into /24s or similar.
  • Allowing 0.0.255.255 as a wildcard on a non-/16 boundary (e.g. 10.1.5.0 0.0.255.255). The router silently treats it as 10.1.0.0/16, matching more than you intended.

/16 FAQ

How many hosts are in a /16?

65,534 usable. 16 host bits give 2^16 = 65,536 addresses, minus network and broadcast.

How many /24 subnets are in a /16?

256. Going from /16 to /24 borrows 8 bits: 2^8 = 256.

Is a /16 the same as a Class B network?

It uses the old Class B mask (255.255.0.0), but classes no longer exist. Any /16-aligned block is a /16, e.g. 10.20.0.0/16 is a /16 even though 10.x was "Class A".

What is the biggest VPC I can create in AWS?

A /16 (65,536 addresses). You can add secondary CIDR blocks if you need more space later.

Related tools

Subnet Calculator Full /16 breakdown with binary and exports Wildcard Mask Calculator ACL and OSPF wildcard for /16 and every other prefix CIDR Calculator Split 172.17.0.0/16 into smaller blocks VLSM Calculator Mix /16 with other sizes in one plan Subnet Mask Calculator Convert mask ↔ prefix ↔ host count Subnetting Practice Drill questions like this one, with visual answers

Well-known /16 networks: 169.254.0.0/16, 172.17.0.0/16, 192.168.0.0/16