How many /9 networks fit
| Parent block | Relationship |
|---|---|
| /8 | 2 × /9 fit inside one /8 |
| /16 | One /9 covers 128 × /16 |
| /24 | One /9 covers 32,768 × /24 |
A /9 holds 128 × /16, so it is a comfortable home for a full cloud estate where each VPC gets a /16.
Worked example: 10.190.4.20/9
Your on-prem network uses the lower half of 10.0.0.0/8 and you need to know if a cloud VM at 10.190.4.20 sits in the upper half.
- The mask is 255.128.0.0. The second octet (128) is the "interesting" one — the first that is not 255.
- Block size = 256 − 128 = 128. Networks start at multiples of 128 in the second octet: 0, 128
- The second octet of 10.190.4.20 is 190. 190 ÷ 128 = 1 remainder 62, so the block starts at 1 × 128 = 128.
- Network = 10.128.0.0 (octets after the second become 0). Broadcast = 128 + 128 − 1 = 255, giving 10.255.255.255 (octets after it become 255).
- Usable hosts: 10.128.0.1 to 10.255.255.254, which is 223 − 2 = 8,388,606 addresses.
Same thing in binary (network bits | host bits):
Address 00001010.1|0111110.00000100.00010100 Mask 11111111.1|0000000.00000000.00000000 Network 00001010.1|0000000.00000000.00000000
Where /9 is used in real networks
-
Google Cloud auto-mode VPCs
Auto-mode VPC networks in Google Cloud create one /20 subnet per region, all taken from
10.128.0.0/9. If your on-prem network already uses 10.128.0.0 or above, an auto-mode VPC will clash with it as soon as you add a VPN or Interconnect. -
Splitting 10.0.0.0/8 in two
A common first cut:
10.0.0.0/9for on-prem sites and10.128.0.0/9for cloud. One summary route per side keeps the routing tables at the border tiny. -
Leaving room for mergers
Some teams keep one /9 entirely unused so a future acquisition or a partner network can be re-addressed into it without touching the rest.
Common /9 mistakes
- Writing
10.100.0.0/9. A /9 must start at a second octet of 0 or 128. The calculator will round 10.100.0.0/9 down to 10.0.0.0/9, which is not what you meant. - Creating a Google Cloud auto-mode VPC "just to test" and later peering it with production. Its 10.128.0.0/9 subnets often overlap with existing ranges, and you cannot shrink them; switch to custom mode instead.
- Forgetting that 10.128.0.0/9 ends at 10.255.255.255. Firewall rules written as 10.128.0.0–10.200.255.255 leave part of the block out.
/9 FAQ
How many hosts are in a /9?
8,388,606 usable. A /9 has 23 host bits: 2^23 = 8,388,608 addresses, minus network and broadcast.
What are the two /9 blocks inside 10.0.0.0/8?
10.0.0.0/9 (10.0.0.0 to 10.127.255.255) and 10.128.0.0/9 (10.128.0.0 to 10.255.255.255).
What is the wildcard mask for /9?
0.127.255.255. Subtract each octet of the mask 255.128.0.0 from 255.