IPv6 Subnetting: /48 vs /64, Examples, and Address Planning

Introduction

You've received your IPv6 /48 — 2001:db8:abcd::/48. It looks like one address block. In reality, it's 65,536 subnets, each big enough to host every device you'll ever connect to a single network segment. The question isn't "is it enough space." The question is: how do you organize it so that a network engineer three years from now — or you, at 3 AM during an outage — can look at an address and know exactly where it lives and what it does?

IPv6 subnetting is not about conservation. There's nothing to conserve. It's about predictability: designing a scheme where addresses carry structural meaning, subnets don't collide, and adding a new data center or VLAN doesn't require renumbering half your deployment.

This guide assumes you already understand what a /48 is and how you got one. If those concepts are new, start with What Is IPv6? and How to Get an IPv6 /48 — they lay the foundation this article builds on.

Subnet (IPv6) — a subdivision of an IPv6 prefix, typically a /64 for a single LAN segment. The /64 boundary is the point where the network portion of the address ends and the interface identifier begins. CIDR notation — the /N suffix on a prefix defines how many bits are fixed (the network portion); the remaining 128−N bits are available for subnetting and host addressing.

White-Face Xiaolu places small address blocks into a cabinet of orderly IPv6 subnet compartments.

IPv6 subnetting is not about squeezing addresses in; it is about giving each part of the network a predictable home.

Calculate Your IPv6 Subnets

Need the numbers before the theory? Use the free IPv6 Subnet Calculator to see how many /64 networks fit inside a prefix, inspect the first subnets, and compare common prefix sizes.

CIDR Prefix Lengths: The Minimum You Need to Know

Every IPv6 address has 128 bits. The prefix length — the number after the / — tells you how many of those bits are the network portion (fixed, shared by everything in that prefix) versus the host portion (variable, assigned within the network).

|←——— network portion (N bits) ———→|←——— host portion (128−N bits) ———→|
2001:0db8:abcd:0001:0000:0000:0000:0001/64

With a /48, the first 48 bits identify your organization's allocation. The next 16 bits — the subnet ID — are yours to assign. The final 64 bits are the interface identifier within each subnet.

Prefix Length	Fixed Bits	Available for Subnetting	What It's Used For
`/48`	First 48 (organization allocation)	16 bits → 65,536 possible /64 subnets	Your entire address block
`/56`	First 56	8 bits → 256 /64 subnets	Smaller ISP customer delegations
`/64`	First 64	0 bits remaining for further subnetting	One LAN segment or VLAN
`/127`	First 127	1 bit → 2 addresses	Point-to-point links (RFC 6164)
`/128`	All 128	None — single host	Loopback interfaces, anycast service IPs

The critical boundary is /64. SLAAC assumes a 64-bit interface identifier, so a longer prefix on an end-host LAN removes that standard autoconfiguration path and can create implementation-compatibility problems. Use /64 for each ordinary LAN or VLAN. For a point-to-point router link, /127 is a common choice and mitigates the ping-pong vulnerability described in RFC 6164.

Why a /64 for Every LAN Isn't Wasteful

This is the question every IPv4-trained engineer asks: "You're giving a single VLAN 18 quintillion addresses? That's insane."

The instinct comes from IPv4, where addresses are a scarce resource and subnet sizing is an optimization problem — how many hosts do you have, add 20% for growth, round up to the next power of two. Every wasted address feels like wasted money.

IPv6 inverts this logic. The design constraint isn't "how many addresses can I afford to allocate." The design constraint is "how can I make my addressing scheme predictable, scalable, and operationally simple." A /64 per VLAN costs nothing in address space — your /48 has 65,535 more /64s after the first one. What it gives you in return:

SLAAC works. Devices autoconfigure their own addresses. No DHCP server to manage, no IPAM database to update for every new VM.
No renumbering due to growth. You'll never outgrow a /64. Add 10,000 more devices? Still the same subnet. No expanding prefix boundaries, no re-IPing servers.
Consistency. Every VLAN is a /64. There's no "this one is a /64 because it has 5,000 devices but that one is a /120 because it only has 4." Uniformity eliminates a class of operational errors.
Better security. A /64 is too large for an attacker to scan. IPv4 /24s are scannable in minutes. An IPv6 /64 subnet is not.

Point-to-point links are the exception — use /127 there (RFC 6164). For everything else that carries end hosts: /64.

How Big Is a /48, Practically?

65,536 /64 subnets is an abstract number. Here's what it means in deployment terms:

If you have...	You might use...	Remaining /64s
1 office, 1 data center, 5 VLANs each	10 /64s	65,526
3 data centers × 10 racks × 4 VLANs/rack	120 /64s	65,416
10 PoPs, 5 environments (prod/staging/dev/mgmt/test) per PoP, 3 VLANs per environment	150 /64s	65,386
50 data centers × 20 VLANs each	1,000 /64s	64,536
A full CDN edge deployment: 300 locations, 50 subnets each	15,000 /64s	50,536

A /48 comfortably handles anything short of operating a large ISP. Even an anycast deployment across hundreds of locations, with separate subnets for production, staging, management, and out-of-band access at each site, uses a fraction of the available space.

A Recommended /48 Addressing Plan

The goal of an addressing plan is to make addresses self-documenting. When you see 2001:db8:abcd:021a::1, you should know — from the structure, not from a database lookup — which region it's in, which environment it serves, and what kind of traffic it carries.

Here's a template using the 16-bit subnet ID (the portion between /48 and /64):

2001:db8:abcd:RRENSS::/64

RR   = Region (2 hex digits → 256 regions)
E    = Environment (1 hex digit → 16 environments)
N    = Network function (1 hex digit → 16 network types)
SS   = Subnet within function (2 hex digits → 256 subnets per function)

Region (RR)

Value	Region
`00`	Global / anycast / shared services
`01`	Europe — Amsterdam
`02`	Europe — London
`03`	Europe — Frankfurt
`10`	North America — New York
`11`	North America — Ashburn
`20`	Asia-Pacific — Singapore
`21`	Asia-Pacific — Tokyo
`f0`–`ff`	Reserved

Environment (E)

Value	Environment
`0`	Production
`1`	Staging
`2`	Development
`3`	Testing / CI
`4`	Management / out-of-band
`5`	Lab / sandbox
`6`–`f`	Reserved

Network Function (N)

Value	Function
`0`	Backbone / transit / peering links
`1`	Public-facing services (web, API, CDN)
`2`	Internal services (databases, message queues)
`3`	Storage (NAS, SAN, backup networks)
`4`	Monitoring, logging, telemetry
`5`	Customer / tenant networks
`6`–`f`	Reserved

Worked Example

2001:db8:abcd:0101::/64   — Amsterdam, Production, Public-facing services
2001:db8:abcd:0112::/64   — Amsterdam, Production, Internal services (DB)
2001:db8:abcd:0134::/64   — Amsterdam, Testing, Monitoring
2001:db8:abcd:1001::/64   — New York, Production, Public-facing services
2001:db8:abcd:2010::/64   — Singapore, Production, Backbone/peering

Each address tells a story: 2001:db8:abcd:1001::42 is a public-facing server in production, in New York. The information is encoded in the address, not in a spreadsheet that may or may not be up to date.

When This Plan Is Overkill

If you have one data center and five VLANs, you don't need a 16-bit structured addressing hierarchy. Pick five consecutive /64s (:0001 through :0005) and document what each is for. The point is consistency and documentation, not ritual adherence to a template built for a different scale. Start simple, but leave room: if you might expand to multiple locations within the lifetime of this deployment, reserve the high-order nibbles of the subnet ID for region, even if you only use 00 through 01 today.

How Much Prefix Do You Actually Need?

Your Infrastructure Profile	Recommended Prefix	Why
Single home or small office, ISP-provided connectivity	/56 or /48 delegated from ISP	ISP handles routing; you just need addresses for your devices
Startup with BGP, 1–2 providers, 1–3 locations	/48 (PA)	Standard end-user allocation; more than enough subnets
Growing platform, 3–10 locations, multi-provider	/48 (PA or PI)	Still fits — 10 regions × 5 environments × 5 VLANs = 250 /64s out of 65,536
Large hosting provider, 50+ locations, operating only its own infrastructure	/48 (PA or PI), subject to routing and business needs	A single /48 still handles 50 sites × 100 internal service networks × 5 VLANs each = 25,000 /64s
Provider assigning prefixes to customer organisations	LIR PA allocation model (often starting at /32)	PI assignments cannot be sub-assigned to other organisations

The threshold where a /48 may become insufficient is usually when you are assigning prefixes to other organisations, not when you are subnetting your own infrastructure. That is an LIR allocation and policy question, not a reason to use PI: PI assignments cannot be sub-assigned to other organisations. For an organisation's own network, a single /48 is often ample, but prefix size should follow the actual routing and growth plan.

Common IPv6 Subnetting Mistakes

Mistake 1: Treating /64 Like a Wasteful IPv4 /24

The thinking: "Why give my office VLAN 18 quintillion addresses when only 50 devices connect to it? I'll use a /120 to save space."

Why it's wrong: You're not charged per address. With a /120 on an end-host LAN, SLAAC stops working, and you give up the interoperability and operational simplicity of the normal /64 design. Use /64 for ordinary LANs and VLANs; use /127 when the link is truly point-to-point. Other specialised designs exist, but should be deliberate exceptions rather than address-conservation exercises.

Mistake 2: No Addressing Plan — Just Incrementing

The thinking: "First subnet is :0001, next is :0002, next is :0003..."

Why it's wrong: Workable for 5 VLANs. Unmanageable for 50 across three locations. You end up with production subnets scattered randomly among development subnets because the numbering reflects creation order, not structure. A flat numbering scheme also makes it impossible to summarize routes or apply consistent security policies by address range. Plan your numbering before you deploy, even if the plan starts simple.

Mistake 3: Forgetting DNS, Reverse DNS, and IPAM

The thinking: "I'll just remember which subnet is which."

Why it's wrong: IPv6 addresses are not memorable. If you don't set up reverse DNS zones and maintain an IP address management system (even a spreadsheet with clear conventions), you'll spend outage time decoding addresses instead of fixing the problem. The ip6.arpa delegation for reverse DNS needs to be set up alongside your forward zones. An addressing plan without corresponding DNS infrastructure is half a plan.

Mistake 4: Mixing Public Prefixes with ULA Without Documentation

The thinking: "I'll use ULA (fd00::) for internal stuff and my public /48 for external stuff. They'll never conflict."

Why it's wrong: A host with both a ULA and a Global Unicast address has two IPv6 addresses. Applications resolve both; the source address selection algorithm (RFC 6724) decides which one to use. If your DNS returns both, you may get ULA traffic that can't leave the local network, or public traffic that leaks internal services. Clearly separate what's ULA-only (truly internal, never in public DNS) from what's dual-stacked. Never put a ULA address in a public DNS record.

Mistake 5: Assuming a /48 Is "Too Big" and Asking for Less

The thinking: "I only need 5 subnets. A /48 is excessive. Can I get a /52?"

Why it's wrong: RIPE NCC policy standardizes on /48 for end-user allocations. Asking for less doesn't reduce your cost — the administrative overhead for the RIR is the same whether they allocate a /48 or a /52. More importantly, your estimate of "5 subnets" will grow — the minute you add a second location, or a staging environment, or a DMZ, your address plan multiplies. The /48 costs you nothing extra and eliminates the renumbering pain of outgrowing a smaller allocation.

Frequently Asked Questions

Can I use subnets smaller than /64?

On point-to-point links, yes — use /127 per RFC 6164. On an ordinary LAN with end hosts, using a prefix longer than /64 breaks SLAAC and departs from the interoperable default used by IPv6 host stacks. Stick to /64 for each ordinary LAN or VLAN unless you have a documented specialised design.

How do I calculate how many /64s are in my prefix?

Each additional bit of prefix length halves the number of subnets. Starting from /48: 2^(64−48) = 65,536. A /44 would be 2^(64−44) = 1,048,576. A /52 would be 2^(64−52) = 4,096. The pattern: number of /64s = 2^(64 − prefix_length).

Should I number subnets sequentially or use a structured scheme?

Use a structured scheme. Sequential numbering (:0001, :0002) works until you add a second location or decide to separate production from staging. At that point, your numbering reflects creation order, not topology, and you can't summarize routes or apply security policy by address range without exceptions. Even a simple structure — reserve the first nibble for region, the second for environment — pays off within months.

Should I assign static addresses to servers or rely on SLAAC?

For servers and infrastructure: static addresses (either manually configured or via DHCPv6 with reservations). For end-user devices: SLAAC or DHCPv6. A web server whose address changes with every interface reset is a DNS and firewall management headache. Stable infrastructure addresses, documented in your configuration management system, eliminate a class of connectivity issues.

How do I do reverse DNS for IPv6?

Create ip6.arpa zones for your prefix. The reverse DNS name for an IPv6 address is the address written in reverse-nibble format, with each hex digit separated by dots, under ip6.arpa. For example, 2001:db8:abcd:1::42 becomes 2.4.0.0...1.0.0.0.d.c.b.a.8.b.d.0.1.0.0.2.ip6.arpa. Most infrastructure-as-code DNS tools can generate these zones for a given prefix automatically.

What's the difference between subnetting and addressing plan?

Subnetting is the technical act of dividing a prefix into smaller prefixes. An addressing plan is the organizational scheme that makes subnetting predictable and self-documenting: region codes, environment tags, function identifiers. You can subnet without a plan (incremental numbering). You shouldn't.

Conclusion

IPv6 subnetting inverts the IPv4 mindset. With IPv4, you conserve addresses — every subnet is sized to fit current needs plus a margin, and getting it wrong means renumbering. With IPv6, you conserve clarity — every LAN gets a /64, the structure encodes meaning, and the abundance of space means you plan for the organization you'll become, not the one you are today.

A good IPv6 addressing plan is boring by design. It doesn't require renumbering when you add a data center. It doesn't produce collisions when you connect a new partner network. It doesn't require an IPAM database lookup to tell production from development. The investment is in deciding the scheme up front. The return is years of not having to think about addresses.

A /48 contains 65,536 /64s. That's enough for every VLAN in every location you're likely to operate. The question isn't whether the space fits. The question is whether your addressing plan makes the space legible to the people who will inherit it.

Key Takeaways

A /48 contains 65,536 /64 subnets — enough for any organization short of an ISP.
Use /64 for every LAN (required by SLAAC) and /127 for point-to-point links (RFC 6164).
Structured addressing is more valuable than conserving address space — encode region, environment, and function in your subnet IDs.
Start simple: if you have one location and 5 VLANs, plan for expansion but don't over-engineer the template.
Common mistakes: using non-/64 prefixes on ordinary LANs, numbering sequentially without a scheme, neglecting reverse DNS, and mixing ULA with public addresses in DNS.
The time to design your addressing plan is before you deploy your first subnet — renumbering is expensive in any protocol.

In One Sentence

IPv6 subnetting trades address conservation for clarity — give every LAN a /64, encode structure in your subnet IDs, and design your plan for the network you'll have in three years, not the one you have today.

Continue Reading

What Is IPv6? A Beginner's Guide — the foundational concepts: why IPv6 exists, how addresses work, what a /48 prefix means.
How to Get an IPv6 /48: PA vs PI Address Space Explained — the paths to obtaining your own prefix, and how to choose between PA and PI space.
What Happens After You Get an ASN? A Complete BGP Setup Guide — the operational sequence: ROAs, route objects, BGP configuration, and verification.
What Is RPKI? How Modern Networks Prevent BGP Hijacking — how to protect the routes that announce your subnets to the Internet.
BGP Basics: How the Internet Learns Where to Send Traffic — the protocol that distributes your IPv6 routes globally.
What Is Anycast? How One IP Address Reaches the Nearest Server — how to deploy services across your subnets so users always reach the nearest instance.