Subnet Mask Cheat Sheet: /0 to /32

Subnetting looks like arithmetic you're supposed to have memorised, and most of the time you don't need to. What you need is a table: paste a prefix, read the mask and the host count, move on. This is that table, all 33 rows from /0 to /32, plus the short explanation of what each column means so the numbers aren't just magic.

A subnet mask and a CIDR prefix are two ways of writing the same thing: how many bits at the front of a 32-bit IPv4 address are fixed as the network, leaving the rest for hosts. 255.255.255.0 and /24 are identical statements — twenty-four network bits, eight host bits. If the slash notation itself is new to you, our CIDR notation explainer walks through where the number comes from; this page is the reference you keep open next to it.

The cheat sheet#

Every IPv4 prefix, its dotted-decimal subnet mask, the wildcard (inverse) mask, the total number of addresses in the block, and the count of those that are actually assignable to hosts:

* /31 and /32 are special cases — see the note below.

How to read a row#

Take /26. The mask is 255.255.255.192, which in binary is twenty-six 1s followed by six 0s. Those twenty-six fixed bits mean every address in the block shares the same leading value; the six free bits can be anything, so the block holds 2⁶ = 64 addresses. Of those 64, two are spoken for by convention — the first is the network address (all host bits 0) and the last is the broadcast address (all host bits 1) — leaving 62 usable host addresses. That subtract-two is where the "usable hosts" column comes from on every ordinary prefix.

The pattern is worth internalising because it's completely regular. Each step up the mask (from /24 to /25, say) borrows one more bit for the network and halves the block. Each step down doubles it. There's nothing to memorise beyond powers of two.

The four numbers, and where each one bites#

A cheat sheet is only useful if you know which column you actually need:

• Subnet mask — the form your operating system, router, and most firewall configs expect. When a network setup screen asks for a mask, this is the value you type.
• Wildcard mask — the inverse, used by Cisco access control lists and OSPF. Where a firewall rule wants 0.0.0.255 instead of 255.255.255.0, you're being asked for the wildcard.
• Total addresses — the full size of the block, including network and broadcast. This is the number that matters for routing-table and allocation math, where every address counts.
• Usable hosts — how many devices you can actually assign. This is the one that surprises people: a /29 sounds roomy until you realise it fits six hosts, not eight.

Wildcard masks: the mirror image#

The wildcard mask trips up people who only ever see subnet masks. It's just the bitwise complement — subtract each octet of the subnet mask from 255. So 255.255.255.0 becomes 0.0.0.255, and 255.255.240.0 becomes 0.0.15.255. Where a 1 in the subnet mask means "this bit must match," a 1 in the wildcard means "this bit can be anything." Same block, opposite notation. If you ever have only one and need the other, the arithmetic is that single subtraction per octet.

The prefixes you'll actually meet#

Most of the table is reference you'll rarely touch. A handful of prefixes carry almost all the real-world traffic:

• /24 — the classic "class C" LAN, 254 hosts. The default mental model for a small office or home segment.
• /30 and /31 — point-to-point links between two routers, where you only ever need two addresses.
• /32 — a single host. You'll see it on loopback interfaces, host routes, and firewall rules that target one exact address.
• /16 and /8 — the big private blocks. The RFC 1918 ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are why these show up constantly; our private IP ranges post covers why those exact sizes were chosen.

The one formula behind the whole table#

If you'd rather compute than look up, two expressions reproduce every row. For a prefix /n, the block holds 2^(32 − n) total addresses, and (for /30 and larger blocks) 2^(32 − n) − 2 usable hosts. A /22? That's 2^(32−22) = 2^10 = 1,024 addresses and 1,022 hosts. The mask is just the point where the run of leading 1-bits stops: /22 fills the first two octets and the top six bits of the third, giving 255.255.252.0.

That's genuinely all of it. Powers of two for the counts, and "where do the ones run out" for the mask. Everything in the table above is those two rules applied 33 times.

Sizing a subnet from a host count#

The table is most useful read backwards: you know how many devices a segment needs, and you want the smallest prefix that fits them. The trick is to remember the subtract-two — you need room for your hosts plus the network and broadcast addresses — then round up to the next power of two.

Say a branch office needs addresses for 50 devices. Add two for network and broadcast: 52. The next power of two at or above 52 is 64, which is a /26 (mask 255.255.255.192, 62 usable). A /27 would only give you 30 usable hosts — not enough — so /26 is the tightest fit. Need 300 hosts? That's 302 with the overhead, and the next power of two is 512, a /23 with 510 usable. Working from the "usable hosts" column, you just scan down for the first value that's greater than or equal to your requirement and read off the prefix on that row.

Sizing tightly matters when you're carving a larger allocation into smaller subnets — a technique called variable-length subnet masking (VLSM), where different segments get different prefix lengths based on how many hosts each actually needs. Handing a two-router link a whole /24 when a /30 or /31 would do wastes 250-odd addresses that another subnet could have used.

/31 and /32: the special small ones#

The subtract-two rule breaks at the bottom of the table, which is why those two rows carry an asterisk. A /32 is a single address — there are no host bits to split into network and broadcast, so it represents exactly one host, not "one minus two." A /31 would normally give zero usable hosts under the old rule, which made it useless. RFC 3021 fixed that: on a point-to-point link a /31 is allowed to use both of its two addresses as host addresses, with no separate network or broadcast. That's why so many router-to-router links use /31 today — it saves two addresses on every single link compared to a /30, which adds up fast across a large network.

What about IPv6?#

IPv6 uses the same slash notation but with 128 bits instead of 32, so the numbers stop fitting in a small table almost immediately — a single /64, the standard size for one IPv6 subnet, already holds about 18 quintillion addresses. There's no dotted-decimal mask form and no network/broadcast subtraction to worry about; you write 2001:db8::/32 and read the prefix length directly. The concept transfers perfectly even though the cheat-sheet format doesn't.

For either version, when you need the network address, broadcast, host range, and count for a specific block rather than the generic size, paste the prefix into our CIDR calculator — it does the bit math for you, IPv4 and IPv6, and shows the exact first and last address in the range.