IPv4 Subnet Cheat Sheet: Every CIDR, Mask and Host Count

This subnet cheat sheet lists every IPv4 prefix from /32 to /0 with its subnet mask, wildcard mask, total addresses and usable hosts. The rows people look up most: a /24 has 256 addresses and 254 usable hosts with mask 255.255.255.0, a /26 has 62 usable hosts, a /27 has 30 and a /28 has 14.

The full table is right below. For a specific network, use the subnet calculator: it gives the network, broadcast, usable host range, mask, wildcard and binary view, and splits a block into smaller subnets.

Subnet cheat sheet: every IPv4 CIDR from /32 to /0

Each row below is one prefix length in CIDR notation. The number after the slash counts the network bits, so a /24 fixes the first 24 of 32 bits and leaves 8 for hosts: 2^8 = 256 addresses. One step down in prefix doubles the block, one step up halves it. CIDR itself is defined in RFC 4632 (2006).

CIDR	Subnet mask	Wildcard mask	Total addresses	Usable hosts	Number of /24s
/32	255.255.255.255	0.0.0.0	1	1	1/256
/31	255.255.255.254	0.0.0.1	2	2 *	1/128
/30	255.255.255.252	0.0.0.3	4	2	1/64
/29	255.255.255.248	0.0.0.7	8	6	1/32
/28	255.255.255.240	0.0.0.15	16	14	1/16
/27	255.255.255.224	0.0.0.31	32	30	1/8
/26	255.255.255.192	0.0.0.63	64	62	1/4
/25	255.255.255.128	0.0.0.127	128	126	1/2
/24	255.255.255.0	0.0.0.255	256	254	1
/23	255.255.254.0	0.0.1.255	512	510	2
/22	255.255.252.0	0.0.3.255	1,024	1,022	4
/21	255.255.248.0	0.0.7.255	2,048	2,046	8
/20	255.255.240.0	0.0.15.255	4,096	4,094	16
/19	255.255.224.0	0.0.31.255	8,192	8,190	32
/18	255.255.192.0	0.0.63.255	16,384	16,382	64
/17	255.255.128.0	0.0.127.255	32,768	32,766	128
/16	255.255.0.0	0.0.255.255	65,536	65,534	256
/15	255.254.0.0	0.1.255.255	131,072	131,070	512
/14	255.252.0.0	0.3.255.255	262,144	262,142	1,024
/13	255.248.0.0	0.7.255.255	524,288	524,286	2,048
/12	255.240.0.0	0.15.255.255	1,048,576	1,048,574	4,096
/11	255.224.0.0	0.31.255.255	2,097,152	2,097,150	8,192
/10	255.192.0.0	0.63.255.255	4,194,304	4,194,302	16,384
/9	255.128.0.0	0.127.255.255	8,388,608	8,388,606	32,768
/8	255.0.0.0	0.255.255.255	16,777,216	16,777,214	65,536
/7	254.0.0.0	1.255.255.255	33,554,432	33,554,430	131,072
/6	252.0.0.0	3.255.255.255	67,108,864	67,108,862	262,144
/5	248.0.0.0	7.255.255.255	134,217,728	134,217,726	524,288
/4	240.0.0.0	15.255.255.255	268,435,456	268,435,454	1,048,576
/3	224.0.0.0	31.255.255.255	536,870,912	536,870,910	2,097,152
/2	192.0.0.0	63.255.255.255	1,073,741,824	1,073,741,822	4,194,304
/1	128.0.0.0	127.255.255.255	2,147,483,648	2,147,483,646	8,388,608
/0	0.0.0.0	255.255.255.255	4,294,967,296	4,294,967,294	16,777,216

Usable hosts is total addresses minus two: the first address names the network and the last is the broadcast address, so neither goes on a device. The * on /31 marks the exception. RFC 3021 (2000) lets a point-to-point link use both addresses, because a link with exactly two ends needs no broadcast. A /32 is a single host route.

The last column counts how many /24s fit in each block. A /22 is four /24s and a /16 is 256 of them, which helps when someone still asks for “four Class Cs”. Those names come from classful addressing, where Class A meant a /8, Class B a /16 and Class C a /24. CIDR retired the classes in 1993 (RFC 1519), so today they survive only as nicknames for those three sizes.

How many hosts are in a /24, /25, /26, /27, /28, /22 and /16?

Usable hosts in any IPv4 subnet from /0 to /30 is 2^(32 − prefix) − 2. A /24 gives 2^8 − 2 = 254, a /28 gives 2^4 − 2 = 14. Here are the sizes people search for most, each with its mask:

• /24: 256 addresses, 254 usable hosts, mask 255.255.255.0. The usual home or small office LAN.
• /25: 128 addresses, 126 usable hosts, mask 255.255.255.128. Half a /24.
• /26: 64 addresses, 62 usable hosts, mask 255.255.255.192. A quarter of a /24.
• /27: 32 addresses, 30 usable hosts, mask 255.255.255.224. Eight fit in a /24.
• /28: 16 addresses, 14 usable hosts, mask 255.255.255.240. Sixteen fit in a /24.
• /29: 8 addresses, 6 usable hosts, mask 255.255.255.248. A common static IP block.
• /30: 4 addresses, 2 usable hosts, mask 255.255.255.252. The classic router-to-router link.
• /22: 1,024 addresses, 1,022 usable hosts, mask 255.255.252.0. Four /24s joined.
• /16: 65,536 addresses, 65,534 usable hosts, mask 255.255.0.0. 256 /24s.

Splitting a network is the same arithmetic run backwards. A /24 splits into two /25s, four /26s, eight /27s or sixteen /28s. Each bit you move from the host part to the network part doubles the number of subnets and halves each one.

Every subnet pays the two-address tax, though. Four /26s give 4 × 62 = 248 usable hosts, not 254, and sixteen /28s give 16 × 14 = 224. Carving small has a real cost in addresses, which matters when your allocation is tight.

To see exactly which addresses a block covers, the CIDR to IP range converter prints the first and last address. Going the other way, when you have a start and end address that doesn’t line up with one block, the IP range to CIDR converter returns the CIDR blocks that cover it.

How to read a subnet mask (and work out any row in your head)

A subnet mask is 32 bits: ones for the network part, zeros for the host part. The prefix length is just the count of ones. 255.255.255.0 is 24 ones followed by 8 zeros, so it’s a /24.

The ones in a mask are always contiguous, starting from the left. That’s why a mask octet can only ever take nine values: 0, 128, 192, 224, 240, 248, 252, 254 and 255. Learn the eight non-zero ones and most of the table follows.

The eight mask values to memorise

Each value adds the next bit from the left, worth half the bit before it: 128, then +64, +32, +16, +8, +4, +2 and +1.

Bits set in the octet	Binary	Octet value	Block size (256 − value)
1	10000000	128	128
2	11000000	192	64
3	11100000	224	32
4	11110000	240	16
5	11111000	248	8
6	11111100	252	4
7	11111110	254	2
8	11111111	255	1

To turn a prefix into a mask, count whole octets of 255 first, then use the leftover bits. A /19 is 16 bits (two octets of 255) plus 3 bits, and 3 bits is 224, so the mask is 255.255.224.0. A /27 is 24 bits plus 3, giving 255.255.255.224.

The magic number trick

Find the interesting octet, the one that’s neither 255 nor 0. Subtract it from 256 and you have the block size: subnets start at multiples of it in that octet. For a /27 the mask is 255.255.255.224, so 256 − 224 = 32, and subnets start at .0, .32, .64, .96, .128, .160, .192 and .224.

It works the same in higher octets. A /22 has mask 255.255.252.0, so the interesting octet is the third and 256 − 252 = 4. The address 10.20.37.14/22 sits in the block that starts at 10.20.36.0, since 36 is the largest multiple of 4 not above 37. That block runs to 10.20.39.255.

Worked example: 192.168.10.77/27

Say a device has the address 192.168.10.77/27 and you need its network, broadcast and the range of usable hosts around it. Five steps, no binary needed:

1. A /27 is 24 + 3 bits, so the mask is 255.255.255.224 and the fourth octet is the interesting one.
2. Block size is 256 − 224 = 32, so subnets start at 0, 32, 64, 96 and so on.
3. 77 falls between 64 and 95, so the network address is 192.168.10.64.
4. The broadcast is one less than the next block’s start: 96 − 1 = 95, giving 192.168.10.95.
5. Usable hosts run from 192.168.10.65 to 192.168.10.94. That’s 30 addresses, which matches the /27 row.

A router gets the same answer with a bitwise AND of the address and the mask. Any bit that’s 0 in the mask becomes 0 in the result; setting those host bits to 1 instead gives the broadcast:

address    192.168.10.77    11000000.10101000.00001010.01001101
mask       255.255.255.224  11111111.11111111.11111111.11100000
network    192.168.10.64    11000000.10101000.00001010.01000000
broadcast  192.168.10.95    11000000.10101000.00001010.01011111

If you want to check the binary of another address, convert an IP to binary first. The subnet calculator shows the same binary view for a whole network, so you can see where the prefix boundary falls.

What is a wildcard mask?

A wildcard mask is the bitwise inverse of a subnet mask: subtract each octet of the mask from 255. A /26 mask of 255.255.255.192 becomes the wildcard 0.0.0.63. In a wildcard, a 0 bit means “this bit must match” and a 1 bit means “any value here”, the reverse of a subnet mask.

You’ll meet wildcard masks in Cisco access control lists and in OSPF network statements. Both take an address plus a wildcard rather than a prefix length, so the wildcard column in the cheat sheet above saves you the subtraction.

access-list 10 permit 192.168.1.0 0.0.0.63

router ospf 1
 network 10.0.0.0 0.0.0.255 area 0

The ACL line matches 192.168.1.0 through 192.168.1.63, which is one /26. The OSPF line covers interfaces addressed inside 10.0.0.0/24. A wildcard of 0.0.0.0 matches a single address, and 255.255.255.255 matches any address.

The usual slip is typing the subnet mask where the wildcard belongs. 255.255.255.0 is a perfectly valid wildcard value. It just means something very different from 0.0.0.255: it ignores the first three octets and demands an exact match on the last. So the line looks fine when you read it back, and the mistake only shows when the wrong traffic gets through or gets dropped.

Private and special IPv4 ranges

RFC 1918 (1996) sets aside three blocks for private IP addresses: 10.0.0.0/8 with 16,777,216 addresses, 172.16.0.0/12 with 1,048,576 and 192.168.0.0/16 with 65,536. They aren’t routed on the public internet, which is why so many home and office networks reuse them freely.

Several other ranges have fixed jobs too. This table covers the ones you’ll actually run into:

Block	Range	Addresses	Purpose	Defined in
10.0.0.0/8	10.0.0.0 – 10.255.255.255	16,777,216	Private networks	RFC 1918
172.16.0.0/12	172.16.0.0 – 172.31.255.255	1,048,576	Private networks	RFC 1918
192.168.0.0/16	192.168.0.0 – 192.168.255.255	65,536	Private networks	RFC 1918
100.64.0.0/10	100.64.0.0 – 100.127.255.255	4,194,304	Shared address space (carrier-grade NAT)	RFC 6598
127.0.0.0/8	127.0.0.0 – 127.255.255.255	16,777,216	Loopback	RFC 1122
169.254.0.0/16	169.254.0.0 – 169.254.255.255	65,536	Link-local	RFC 3927
192.0.2.0/24	192.0.2.0 – 192.0.2.255	256	Documentation (TEST-NET-1)	RFC 5737
198.51.100.0/24	198.51.100.0 – 198.51.100.255	256	Documentation (TEST-NET-2)	RFC 5737
203.0.113.0/24	203.0.113.0 – 203.0.113.255	256	Documentation (TEST-NET-3)	RFC 5737
224.0.0.0/4	224.0.0.0 – 239.255.255.255	268,435,456	Multicast	RFC 5771
240.0.0.0/4	240.0.0.0 – 255.255.255.255	268,435,456	Reserved (255.255.255.255 is the limited broadcast address)	RFC 1112

The 172.16.0.0/12 block trips people up most. It doesn’t stop at 172.16.255.255: a /12 spans sixteen values of the second octet, from 172.16 through 172.31. An address like 172.20.5.9 is private; 172.32.0.1 is not.

The 100.64.0.0/10 block is the shared address space of RFC 6598 (2012), which ISPs use behind carrier-grade NAT (CGNAT). The three documentation ranges in RFC 5737 exist so that examples in manuals and articles never point at someone’s real host. Use them in your own docs instead of made-up public addresses.

For the smaller special-purpose blocks not shown here, see the IANA IPv4 Special-Purpose Address Registry, now maintained under RFC 6890. Multicast addresses have their own IANA registry (RFC 5771).

IPv6 prefix sizes cheat sheet

In IPv6 the standard LAN subnet is a /64, which holds 2^64 = 18,446,744,073,709,551,616 addresses, and stateless address autoconfiguration (SLAAC) needs exactly a /64. Because the numbers are so large, nobody counts hosts in IPv6. You count /64s instead. The address architecture is set out in RFC 4291.

Prefix	Contains	Typical use
/128	1 address	A single address
/64	18,446,744,073,709,551,616 addresses	The standard LAN subnet (SLAAC needs a /64)
/56	256 /64s	Common home allocation
/48	65,536 /64s (256 /56s)	Common site or business allocation
/32	65,536 /48s (4,294,967,296 /64s)	Typical minimum allocation to an ISP (LIR) from a regional internet registry

Two IPv4 habits don’t carry over. IPv6 has no broadcast address, so there’s no “minus two” rule for usable hosts. And you rarely use a prefix longer than /64 on a LAN, because SLAAC stops working there.

Mental arithmetic is easier in IPv6 if you think in hex digits. Each digit is 4 bits, so going from a /48 to a /56 adds two digits: 16 × 16 = 256 subnets. Going from /48 to /64 adds a full four-digit group, which is 65,536. Plans that stick to these 4-bit boundaries are much easier to read, and the RIPE community’s best-practice document for IPv6 address planning, RIPE-690, explains the /48, /56 and /64 end-user assignment sizes in detail.

Long IPv6 addresses are hard to compare by eye when zeros are compressed. The IPv6 expander and compressor writes an address out in full, so you can see which group a prefix boundary falls in.

Which subnet size should you use?

Size a subnet for the hosts you expect in a few years, not the ones you have today. As a starting point, use a /31 or /30 for a router-to-router link and a /29 for a small static block. A /24 (254 hosts) suits a typical LAN, and a /22 (1,022 hosts) a large VLAN. In practice the /24 is the default because nobody has to think about it; the cost shows up later, when a VLAN outgrows it and every device needs renumbering.

• Point-to-point links: /31, or /30. A /31 uses both of its 2 addresses under RFC 3021, half the space of a /30. If a device on the link doesn’t support /31, a /30 gives you 2 usable addresses out of 4.
• Static block from an ISP: /29. That’s 8 addresses and 6 usable. One of the six is usually the ISP’s gateway, which leaves 5 for your own devices.
• Management networks and labs: /27 or /28. 30 or 14 usable hosts is plenty for switches, out-of-band interfaces or a test bench.
• Typical LAN: /24. 254 usable hosts, easy to read because the boundary falls on a whole octet.
• Larger VLANs: /23 or /22. 510 or 1,022 usable hosts. Every device in the subnet shares one broadcast domain, so go bigger only when you actually need the addresses.

Leave room to grow by keeping the neighbouring block free. If you start a segment at 10.0.0.0/25, hold 10.0.0.128/25 in reserve. When the segment fills, you change the mask to /24 and nothing has to be renumbered. A /25 placed at 10.0.0.128 can only grow into 10.0.0.0/24 if the lower half is empty, so alignment matters.

For a real plan, start with the block you’ve been given and split it in the subnet calculator. It lists each smaller subnet with its network, broadcast and host range, so you can assign VLANs straight from the output and keep this cheat sheet for quick checks.

Frequently Asked Questions