172.16.0.0/12

Answer

172.16.0.0/12 is one of the three RFC 1918 private ranges. It runs from 172.16.0.0 to 172.31.255.255: sixteen /16 networks, 1,048,576 addresses.

172.16.0.0/12 is 1,048,576 addresses: 172.16.0.0 to 172.31.255.255. 1,048,574 usable for hosts (the first is the network address, the last is broadcast).

172101011001600010000000000000000000000

12 network bits 20 host bits

Network: 172.16.0.0
First usable: 172.16.0.1
Last usable: 172.31.255.254
Broadcast: 172.31.255.255
Addresses: 1,048,576
Usable hosts: 1,048,574
Netmask: 255.240.0.0
Wildcard (ACL) mask: 0.15.255.255
Historic class: B
Range type: Private network · not routed on the internet

Special-purpose range

Private network 172.16.0.0/12 RFC 1918
The middle private IPv4 range: 172.16.0.0 to 172.31.255.255. Docker's default bridge networks are carved from it.

Split it into subnets

4 subnets.

Subnet	Usable range	Hosts	Broadcast
`172.16.0.0/14`	`172.16.0.1` – `172.19.255.254`	262,142	`172.19.255.255`
`172.20.0.0/14`	`172.20.0.1` – `172.23.255.254`	262,142	`172.23.255.255`
`172.24.0.0/14`	`172.24.0.1` – `172.27.255.254`	262,142	`172.27.255.255`
`172.28.0.0/14`	`172.28.0.1` – `172.31.255.254`	262,142	`172.31.255.255`

Is this IP in the range?

Range to CIDR blocks

What to know

The /12 boundary falls inside the second number: 172.16 through 172.31 are private, everything else starting with 172 is public. This is the private range people most often get wrong.

Docker draws its networks from here by default: docker0 is 172.17.0.0/16 and each new user-defined network takes the next free /16. AWS default VPCs use 172.31.0.0/16.

Gotchas

Docker networks can overlap with company VPN or office routes in 172.16.0.0/12, which breaks access to those networks from the host. Set default-address-pools in Docker's daemon.json to a range you do not use elsewhere.
A firewall rule written as 172.0.0.0/8 to "allow private traffic" also allows large amounts of public address space.

Related explainers

← CIDR calculator