/16 subnet: 255.255.0.0, 65,536 addresses

A /16 has the netmask 255.255.0.0 and holds 65,536 addresses, 65,534 of them usable hosts. The first two octets are fixed, so 10.0.0.0/16 runs from 10.0.0.0 to 10.0.255.255. It’s the old class B size, and 192.168.0.0/16 is the smallest of the three RFC 1918 private ranges.

The numbers

Network        10.0.0.0/16
Broadcast      10.0.255.255
Netmask        255.255.0.0
Wildcard       0.0.255.255
First host     10.0.0.1
Last host      10.0.255.254

How it fits

A /8 holds 256 /16s, and the private range 172.16.0.0/12 holds 16, from 172.16.0.0/16 to 172.31.0.0/16. A /16 splits into 4 /18s, 16 /20s, 64 /22s or 256 /24s; the tool below lists the /24s, 10.0.0.0/24 to 10.0.255.0/24.

Where you’ll see it

• AWS VPCs. /16 is the largest CIDR a VPC can have, and every region’s default VPC is 172.31.0.0/16.
• Docker. The default bridge network, docker0, is 172.17.0.0/16 with the host at 172.17.0.1. User-defined networks take the next /16s, 172.18.0.0/16 onward.
• Kubernetes. Flannel’s default pod network is 10.244.0.0/16 and Calico’s manifests default to 192.168.0.0/16. k3s uses 10.42.0.0/16 for pods and 10.43.0.0/16 for services, and EKS picks 10.100.0.0/16 or 172.20.0.0/16 for services.
• Link-local. 169.254.0.0/16 (RFC 3927) is where a host gives itself an address when DHCP fails, and where cloud instance metadata lives, at 169.254.169.254.

Gotchas

• Overlaps. A /16 is big enough to collide with something. Calico’s 192.168.0.0/16 covers every home LAN in 192.168.x.0/24, and on a Docker host, 172.17.0.0/16 beats a broader VPN route such as 172.16.0.0/12, so the host can’t reach remote addresses inside 172.17.0.0/16. Move Docker with bip and default-address-pools in /etc/docker/daemon.json, and pick the CNI’s pool before the cluster is built.
• Peering. Two VPCs that are both 10.0.0.0/16 can’t peer. Neither can 10.0.0.0/16 and 10.0.128.0/17: the second is the upper half of the first.
• Don’t hand it all out. Cutting a VPC into 256 /24s on day one leaves no room for a bigger subnet later. Allocate /20s per tier or zone and split those, and leave gaps.

In your stack

# Terraform: three /20s, one per availability zone, and the third /24
cidrsubnets("10.0.0.0/16", 4, 4, 4)    # ["10.0.0.0/20", "10.0.16.0/20", "10.0.32.0/20"]
cidrsubnet("10.0.0.0/16", 8, 2)        # "10.0.2.0/24"

import ipaddress
vpc = ipaddress.ip_network("10.0.0.0/16")
vpc.overlaps(ipaddress.ip_network("10.0.128.0/17"))   # True: these two can't peer

aws ec2 create-vpc --cidr-block 10.0.0.0/16
iptables -A INPUT -s 10.0.0.0/16 -j ACCEPT