Subnet Mask Cheat Sheet: Every CIDR Prefix, Mask and Host Count

This subnet mask cheat sheet lists every CIDR prefix from /16 to /32 with its dotted-decimal mask, wildcard mask, total addresses and usable host count. The full table sits in the next section. The core formula behind every row: host bits = 32 - prefix, total addresses = 2^(32-prefix), and usable hosts = 2^(32-prefix) - 2. The minus 2 removes the network address and the broadcast address. Two prefixes break that rule, /31 and /32, and they get their own section below.

The subnet mask cheat sheet table (/16 to /32)

Read each line as: prefix, subnet mask, wildcard mask, total addresses, usable hosts. This is the CIDR cheat sheet most people are looking for, so it comes first. If you want the same answer for a specific address rather than a prefix in the abstract, the IP Subnet Calculator takes an IP and a prefix and returns the mask, network address, broadcast address, usable range and host count.

• /16 | mask 255.255.0.0 | wildcard 0.0.255.255 | 65,536 total | 65,534 usable
• /17 | mask 255.255.128.0 | wildcard 0.0.127.255 | 32,768 total | 32,766 usable
• /18 | mask 255.255.192.0 | wildcard 0.0.63.255 | 16,384 total | 16,382 usable
• /19 | mask 255.255.224.0 | wildcard 0.0.31.255 | 8,192 total | 8,190 usable
• /20 | mask 255.255.240.0 | wildcard 0.0.15.255 | 4,096 total | 4,094 usable
• /21 | mask 255.255.248.0 | wildcard 0.0.7.255 | 2,048 total | 2,046 usable
• /22 | mask 255.255.252.0 | wildcard 0.0.3.255 | 1,024 total | 1,022 usable
• /23 | mask 255.255.254.0 | wildcard 0.0.1.255 | 512 total | 510 usable
• /24 | mask 255.255.255.0 | wildcard 0.0.0.255 | 256 total | 254 usable
• /25 | mask 255.255.255.128 | wildcard 0.0.0.127 | 128 total | 126 usable
• /26 | mask 255.255.255.192 | wildcard 0.0.0.63 | 64 total | 62 usable
• /27 | mask 255.255.255.224 | wildcard 0.0.0.31 | 32 total | 30 usable
• /28 | mask 255.255.255.240 | wildcard 0.0.0.15 | 16 total | 14 usable
• /29 | mask 255.255.255.248 | wildcard 0.0.0.7 | 8 total | 6 usable
• /30 | mask 255.255.255.252 | wildcard 0.0.0.3 | 4 total | 2 usable
• /31 | mask 255.255.255.254 | wildcard 0.0.0.1 | 2 total | 2 usable (point-to-point exception)
• /32 | mask 255.255.255.255 | wildcard 0.0.0.0 | 1 total | 1 usable (single host route)

Notice the pattern down the usable column. Every step of one in the prefix halves the block. A /24 gives 254 usable, a /25 gives 126, a /26 gives 62. Each step also doubles the number of subnets you can carve out of the same parent block. That trade is the whole job of subnetting.

What is a subnet mask actually doing?

A subnet mask splits a 32-bit IPv4 address into a network part and a host part. The mask is 32 bits too. Every bit set to 1 marks a network bit. Every bit set to 0 marks a host bit. The 1 bits always come first and never mix with the 0 bits, which is why masks only take a fixed set of values like 255.255.255.192 and never something like 255.0.255.0.

The prefix is just a count of those leading 1 bits. A /26 means 26 one-bits, which in dotted decimal is 255.255.255.192, because 192 is 11000000 in binary. That leaves 6 host bits. If you want the longer walkthrough, see what a subnet mask is and the companion piece on CIDR notation, which explains why the slash form replaced the old class A, B and C system.

How do you calculate usable hosts?

Three steps. No table needed.

• Step 1. Host bits = 32 - prefix. For a /27 that is 32 - 27 = 5 host bits.
• Step 2. Total addresses = 2^(host bits). Here 2^5 = 32 addresses.
• Step 3. Usable hosts = total - 2. Here 32 - 2 = 30.

Check it against the table. The /27 row says 32 total and 30 usable. It matches, because the table is nothing more than this formula run seventeen times.

The only part people stumble on is the powers of two. Memorise them up to 16 and the rest of the arithmetic is trivial: 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536. Those are 2^0 through 2^16. Each one is the total-address count for a prefix, counting backwards from /32.

Worked example. Someone asks how many machines fit in a /22. Host bits = 32 - 22 = 10. Total = 2^10 = 1,024. Usable = 1,022. Done in about four seconds. Our step-by-step guide on how to calculate usable hosts drills the same method with more examples, and the IP Subnet Calculator is there when you want a second opinion before you commit a design.

Why subtract 2?

Because two addresses in a normal subnet are reserved and cannot be assigned to an interface.

The network address is the one where every host bit is 0. It names the subnet itself. It is what appears in a routing table. In 192.168.1.0/24 the address 192.168.1.0 is the network address, not a usable host.

The broadcast address is the one where every host bit is 1. Traffic sent to it is meant for every host on that subnet. In 192.168.1.0/24 that is 192.168.1.255.

Those two are always the first and last address of the block. Everything between them is assignable. That is the whole reason for the minus 2, and it is why the usable numbers are always even and always two below a power of two. If you understand the reason, you will never wonder whether a /26 gives 62 or 64. It gives 62, and the two missing addresses have names: the /26 breakdown walks through exactly which ones.

The same logic explains the two most common sizes in the wild. A /24 subnet is the default LAN size on most home and small office networks, giving 254 usable addresses. A /30 subnet gives exactly 2 usable addresses, which is why it became the classic choice for a router-to-router link: one address per end, with the network and broadcast addresses burned in the process.

What is a /31 used for?

A /31 is a two-address block where both addresses are usable, on point-to-point links. This is the exception that most cheat sheets get wrong. Apply the minus-2 rule to a /31 and you get zero usable hosts, which would make the prefix useless. It is not.

RFC 3021 defines this behaviour. The reasoning is plain. A point-to-point link has exactly two ends. There is nothing to discover and nothing to broadcast to: anything one end sends can only reach the other end. So the network address and the broadcast address serve no purpose there, and both addresses can be assigned to interfaces.

The practical effect is that a /31 does the job of a /30 while consuming half the space. A /30 burns 4 addresses to connect 2 interfaces. A /31 burns 2. Across hundreds of links in a service provider or data centre fabric, that adds up.

Two cautions. First, this applies to point-to-point links, not to multi-access segments like a normal Ethernet LAN with several hosts. Second, both ends have to agree on the configuration for the link to come up. Beyond that, do not read anything vendor-specific into it here; check your platform's documentation for how to configure it.

What is a /32 used for?

A /32 is a single address. All 32 bits are network bits, so there are zero host bits and exactly one address in the block. Do not subtract 2. There is nothing to subtract.

A /32 is a host route. It points at one specific address and nothing else. The common uses are loopback interfaces, where a device gets one stable address that does not depend on any physical link, and precise routing or filtering entries where you want to match a single host rather than a range.

Treat /31 and /32 as their own category. Every other prefix in the table follows minus 2. These two do not.

What is the wildcard mask column for?

A wildcard mask is the bitwise inverse of the subnet mask. Where the mask has a 1, the wildcard has a 0, and the reverse. Subtract each octet of the mask from 255 and you have it.

So 255.255.255.192 inverts to 0.0.0.63. And 255.255.0.0 inverts to 0.0.255.255. The pattern in the table makes the relationship obvious once you look for it: each pair of numbers on a row adds up to 255 octet by octet.

Wildcard masks appear in access control lists and in some routing protocol configuration, where the syntax expects the inverse form instead of the mask. A 0 bit in a wildcard means the bit must match. A 1 bit means the bit is ignored. That is the only real difference in meaning, and it trips people up mostly because the numbers look unfamiliar rather than because the concept is hard.

How to use this cheat sheet when sizing a network

Work backwards from host count, not from a prefix you like the look of. Count the devices that need an address on the segment, add the router interface, then add realistic headroom for growth. Then pick the smallest prefix in the table whose usable column covers that number.

Need 40 addresses? A /27 gives 30, which is not enough. A /26 gives 62, which fits. Need 300? A /24 gives 254, not enough, so go to /23 for 510. There is always some waste, because block sizes only come in powers of two. The aim is to keep the waste small rather than zero.

One more habit worth building. Confirm the boundaries before you assign anything, because a mask that is right in theory can still be applied to the wrong network address. Feed the address and prefix into the IP Subnet Calculator and read back the network, broadcast and usable range.

Bottom line

The table above is the reference. The formula behind it is short: host bits = 32 - prefix, total = 2^(32-prefix), usable = total - 2, with /31 and /32 exempt from the minus 2. Learn the powers of two, understand why the network and broadcast addresses are reserved, and you can rebuild any row of this cheat sheet from memory. Keep the page bookmarked for speed, and use the IP Subnet Calculator to verify the exact network, broadcast and usable range before the design leaves your notes.