Subnet Mask Cheat Sheet: CIDR /8 to /32

CIDR to subnet mask chart

How to read a subnet mask in 30 seconds

Every subnet mask is a run of 1 bits followed by a run of 0 bits, and the prefix length is the number of 1s. Each octet holds 8 bits, so /24 fills exactly three octets (255.255.255.0), while any prefix in between fills part of one octet.

For a mask that cuts through an octet, find the "interesting octet": the one that is neither 255 nor 0. The block size is 256 minus that octet's value. For /27 the mask is 255.255.255.224, the interesting octet is the last one, and 256 − 224 = 32, so subnets start at multiples of 32: .0, .32, .64, .96, .128, .160, .192, and .224. For /20 (255.255.240.0) the interesting octet is the third one and the block size is 16, so subnets in 10.1.0.0 begin at 10.1.0.0, 10.1.16.0, 10.1.32.0, and so on.

To find the subnet an address belongs to, round the interesting octet down to the nearest multiple of the block size. Take 172.16.45.9/20: the third octet is 45, the block size is 16, and the nearest multiple at or below 45 is 32. The network is 172.16.32.0, the next network starts at 172.16.48.0, and the broadcast address is therefore 172.16.47.255.

The binary view

A /26 mask written in binary is 11111111.11111111.11111111.11000000, which is 255.255.255.192. The wildcard mask is the exact inverse, 00000000.00000000.00000000.00111111, which is 0.0.0.63. The six remaining host bits give 2⁶ = 64 addresses and 62 usable hosts.

The addresses you can't use

In an ordinary IPv4 subnet the first address is the network address and the last is the broadcast address, so neither can be assigned to a host. That is where the formula comes from: usable hosts = 2^{(32 − prefix)} − 2. A /24 has 256 addresses and 254 usable; a /29 has 8 addresses and 6 usable.

Two prefixes break the rule. A /31 has two addresses, and under RFC 3021 both can be used on a point-to-point link because there is no need for a broadcast address. Some older equipment does not support this, so /30 is still common. A /32 is one address, used for loopback interfaces, host routes, and firewall rules that match exactly one machine.

Cloud networks reserve more. AWS and Azure each reserve five addresses in every subnet, so a /28 gives 11 usable addresses rather than 14, and Google Cloud reserves four in a subnet's primary range. Check your provider's current documentation before sizing a cloud subnet to an exact host count.

Which prefix length for which job

• /8 to /15: very large blocks. These are allocations or whole private ranges such as 10.0.0.0/8 that get divided further; they are never a single network segment.
• /16: a whole site, campus, or cloud VPC. See the /16 guide.
• /20 to /22: a large site's block, or a big virtualization or Wi-Fi network. A /22 gives 1,022 hosts.
• /23: 510 hosts. Common when a /24 runs out of room, for example on a busy wireless network.
• /24: the default LAN size, with 254 hosts. See the /24 guide.
• /25 and /26: 126 and 62 hosts. Departments, floors, or voice and camera VLANs.
• /27: 30 hosts. A small office or a management VLAN. See the /27 guide.
• /28: 14 hosts. A DMZ, a lab, or a small server group.
• /29: 6 hosts. A tiny segment, or an internet handoff from a provider with a few public addresses.
• /30 and /31: two hosts. Point-to-point links between routers.
• /32: one host. Loopbacks and host routes.

Common mistakes

• Treating the typed address as the network. 192.168.1.77/26 is a host inside the network 192.168.1.64/26, not a network address itself.
• Mixing up subnet masks and wildcard masks. Interfaces take a subnet mask (255.255.255.0); Cisco ACLs and OSPF network statements take a wildcard mask (0.0.0.255). The wildcard mask calculator converts between them.
• Sizing to the exact host count. Leave 20 to 30 percent for growth, and remember that a gateway and redundant routers also use addresses.
• Using a non-contiguous mask. A subnet mask must be all 1s then all 0s. 255.255.0.255 is not a valid subnet mask.
• Assuming .0 and .255 are never usable. They are only the network and broadcast addresses when they sit at the edge of the subnet. In 192.168.0.0/23 the address 192.168.0.255 is a perfectly valid host, and 192.168.1.0 is too.

Related tools and guides

Frequently asked questions