Subnet Cheat Sheet: CIDR, Subnet Mask and Usable Hosts

The complete CIDR subnet table (/8 to /32)

Read it left to right: pick the prefix you are working with and the row tells you the mask to type into a device, the wildcard to use in an ACL, and how many addresses and hosts you get. The usable hosts column already subtracts the network and broadcast addresses for every prefix from /8 to /30; the special /31 and /32 cases are explained in the notes underneath.

Need to apply one of these prefixes to a real address range? Drop it into our IP Subnet Calculator to get the exact network address, broadcast address and host range, or use the CIDR Block Calculator to expand a block into its full list of addresses.

How to read the cheat sheet

Each row in the table is just a different way of describing the same boundary between the network portion of an address and the host portion. The CIDR prefix is the shorthand; everything else follows from it.

The prefix is a count of network bits

An IPv4 address is 32 bits long. The number after the slash - the prefix - tells you how many of those bits, counting from the left, belong to the network. A /24 means the first 24 bits identify the network and the remaining 8 bits identify the host within it. The bigger the prefix, the more bits are locked to the network and the fewer are left for hosts, so a larger number after the slash always means a smaller subnet.

The subnet mask is the prefix written in dotted decimal

The subnet mask expresses the same split as a four-octet number. It is simply the prefix count of 1 bits, padded out to 32 bits with 0s, then converted octet by octet to decimal. A /24 is twenty-four 1s followed by eight 0s - 11111111.11111111.11111111.00000000 - which reads as 255.255.255.0. Because each octet can only be one of nine values (0, 128, 192, 224, 240, 248, 252, 254, 255), the masks form the tidy pattern you see running down the table.

The wildcard mask is the inverse

The wildcard mask is the bit-for-bit opposite of the subnet mask: every 1 becomes a 0 and every 0 becomes a 1. The /24 mask 255.255.255.0 inverts to the wildcard 0.0.0.255. You will mostly meet wildcard masks in Cisco access-control lists and OSPF network statements, where a 0 bit means "this bit must match" and a 1 bit means "this bit can be anything".

Total addresses and usable hosts

The total number of addresses in a block is 2 raised to the power of the host bits (the bits not in the prefix). A /26 has 6 host bits, so it holds 26 = 64 addresses. From that total you subtract 2 to get usable hosts, because the first address is the network identifier and the last is the broadcast address - neither can be assigned to a device. So a /26 gives 64 - 2 = 62 usable hosts. The two exceptions, /31 and /32, are covered next.

Worked examples: /24, /29 and /30

These three prefixes account for a large share of everyday subnetting, so it is worth seeing exactly how each one breaks down. The figures match the rows in the table above.

/24 - the classic LAN subnet

A /24 uses the mask 255.255.255.0 and the wildcard 0.0.0.255. With 8 host bits it holds 28 = 256 total addresses and 254 usable hosts. Take 192.168.1.0/24: the network address is 192.168.1.0, the broadcast is 192.168.1.255, and the usable range runs from 192.168.1.1 to 192.168.1.254. This is the default size most people picture when they think of a home or office LAN.

/29 - a small block of static IPs

A /29 uses the mask 255.255.255.248 and the wildcard 0.0.0.7. With 3 host bits it holds 23 = 8 total addresses and 6 usable hosts. ISPs hand out /29 blocks all the time when a business needs a handful of static public addresses. Take 203.0.113.8/29: the network address is 203.0.113.8, the broadcast is 203.0.113.15, and the 6 usable addresses run from 203.0.113.9 to 203.0.113.14 - one of which the router typically claims as the gateway.

/30 - a point-to-point link

A /30 uses the mask 255.255.255.252 and the wildcard 0.0.0.3. With 2 host bits it holds 22 = 4 total addresses and exactly 2 usable hosts. That makes it the traditional choice for a link between two routers, where you only ever need one address on each end. Take 10.0.0.0/30: the network address is 10.0.0.0, the broadcast is 10.0.0.3, and the two usable addresses are 10.0.0.1 and 10.0.0.2. Where equipment supports it, a /31 is now often used instead to avoid wasting the other two addresses.

Quick mental shortcuts

Once you have used the table a few times, a handful of patterns let you answer most questions without looking anything up:

• Each step of +1 in the prefix halves the block. A /25 is half a /24, a /26 is half a /25, and so on. Conversely, each -1 doubles it.
• The last interesting octet cycles through the mask values. 128, 192, 224, 240, 248, 252, 254, 255 correspond to /25 through /32 in the fourth octet.
• The block size is 256 minus the mask octet. A /26 mask ends in 192, and 256 - 192 = 64, which is the block size - so subnets fall on .0, .64, .128 and .192.
• Usable hosts double minus the constant 2. /29 gives 6, /28 gives 14, /27 gives 30, /26 gives 62 - each is roughly double the previous, less the 2 reserved addresses.
• /24 is your anchor. Remember it has 254 usable hosts and the mask 255.255.255.0, and you can reason up or down to any nearby prefix from there.

Related tools & reading

• IP Subnet Calculator — enter an address and prefix to get the network, broadcast, mask and usable host range instantly.
• CIDR Block Calculator — expand a CIDR block into its full range, count addresses, and check whether an IP falls inside it.
• What Is a Subnet Mask? — the plain-language guide to how a mask splits an address into network and host bits, with worked examples.
• Understanding IP Addresses — how IPv4 and IPv6 addressing, public vs private ranges and CIDR fit together.
• Back to the Learning Center