/17 Subnet: Mask 255.255.128.0

How many /17 networks fit

A /17 holds 128 × /24 or 2 × /18.

Worked example: 10.20.199.4/17

A /16 VPC (10.20.0.0/16) was split into two halves: one for private subnets and one for everything else. Which half is 10.20.199.4 in?

1. The mask is 255.255.128.0. The third octet (128) is the "interesting" one — the first that is not 255.
2. Block size = 256 − 128 = 128. Networks start at multiples of 128 in the third octet: 0, 128
3. The third octet of 10.20.199.4 is 199. 199 ÷ 128 = 1 remainder 71, so the block starts at 1 × 128 = 128.
4. Network = 10.20.128.0 (octets after the third become 0). Broadcast = 128 + 128 − 1 = 255, giving 10.20.255.255 (octets after it become 255).
5. Usable hosts: 10.20.128.1 to 10.20.255.254, which is 2¹⁵ − 2 = 32,766 addresses.

Address  00001010.00010100.1|1000111.00000100
Mask     11111111.11111111.1|0000000.00000000
Network  00001010.00010100.1|0000000.00000000

Where /17 is used in real networks

• Halving a VPC

  Many teams reserve the lower /17 of a VPC for private workloads and keep the upper /17 for public, database or future subnets. Each half can then be referenced as one CIDR in route tables and security groups.

• Old ISP and campus allocations

  Universities and ISPs often received or split space into /17s, so you will see them in published IP ranges and allow lists.

Common /17 mistakes

• Writing 10.20.64.0/17. The third octet of a /17 must be 0 or 128, so it snaps back to 10.20.0.0/17.
• Using all 32,000 addresses for one subnet in AWS. Subnets live in a single Availability Zone, so one giant subnet ties every workload to one AZ. Split by AZ instead.

/17 FAQ

Related tools