/16 Subnet Explained: 255.255.0.0

/16 at a glance

What /16 means

In a /16 the first two octets are fixed and the last two are free: 16 host bits give 2¹⁶ = 65,536 addresses. The network address always ends in .0.0 and the broadcast address in .255.255. For the network 10.20.0.0/16 that means a first usable address of 10.20.0.1, a last usable address of 10.20.255.254, and a broadcast address of 10.20.255.255.

Working one out by hand is simple: keep the first two octets of any address and zero the rest. The address 172.18.200.9/16 belongs to the network 172.18.0.0/16, and its broadcast address is 172.18.255.255.

The private ranges are made of /16s. 192.168.0.0/16 is a single /16. 172.16.0.0/12 contains sixteen of them (172.16.0.0/16 through 172.31.0.0/16), and 10.0.0.0/8 contains 256. See private IP ranges for the full picture.

A /16 should not be one flat network

Putting tens of thousands of devices in a single Layer 2 segment is a bad idea. Every host hears every broadcast, ARP tables grow large, and a single misbehaving device or loop can affect the entire network. In practice, VLANs are kept in the hundreds of hosts, and the /16 acts as an address allocation from which many small networks are taken. That is also the reason a /16 is worth planning: the structure you choose on day one is hard to change later.

Splitting a /16

A common approach is to hand out /24s for ordinary VLANs and use larger blocks, such as /20s, for whole functions that will grow. Here is one example plan for the site network 10.20.0.0/16, built on /20 blocks (4,096 addresses each) with the remaining half left unassigned:

Inside the users block, each VLAN can then be a /24 (10.20.0.0/24, 10.20.1.0/24, and so on up to 10.20.15.0/24). Because every function lives in its own contiguous block, firewall rules and access lists stay short: one line covers the whole of 10.20.32.0/20. The subnet calculator works out the ranges for any block you pick.

Route summarization

A /16 pays off most in routing. If every /24 in 10.20.0.0/16 belongs to one site, that site can advertise a single route, 10.20.0.0/16, instead of 256 separate /24 routes. Smaller routing tables converge faster and a flapping VLAN inside the site no longer causes updates elsewhere. Summarization only works when the addresses at a site are contiguous and aligned, which is exactly what a planned allocation gives you.

/16 in the cloud

On AWS, a /16 is the largest CIDR block you can assign to a VPC, and the default VPC in each region uses 172.31.0.0/16. A /16 VPC leaves room to create many subnets across several availability zones, but it also uses up a big slice of your private space. If you plan to peer VPCs or connect them to an office or another cloud, give each one a unique /16 (or smaller) from a documented plan. Overlapping VPC ranges cannot be peered.

Checking whether two addresses share a /16

Compare the first two octets. 10.20.5.9 and 10.20.200.1 are in the same /16 (10.20.0.0/16), while 10.21.0.1 is in a different one. A router or host does the same test with the mask: it ANDs both addresses with 255.255.0.0 and compares the results. Sharing a /16 does not mean sharing a network segment, though. In a well-planned design those two hosts sit in different /24 or /20 subnets, and the traffic between them goes through a router, which is where firewall rules and access lists get applied.

Common mistakes with /16 networks

• Running a /16 as one VLAN. The address space allows it, the network will not cope with it.
• Taking a /16 when a /20 would do. Private space is finite. Handing a /16 to every small project means you run out before you have 255 projects.
• Assuming "/16" means "Class B". It did once, but classes were retired. A /16 can come from anywhere, including 10.x and 192.168.x space.
• Overlap with a VPN or a peer. 10.0.0.0/16 and 10.0.0.0/8 both look unique until two teams pick the same one.
• Forgetting the broadcast address on paper. The last address, x.x.255.255, is never a host in a /16, although x.x.0.255 and x.x.1.0 are valid hosts.

Related tools and guides

Frequently asked questions