Writing

Subnet mask table

Published 15 September 2026 · Updated 22 September 2026

Every CIDR prefix from /0 to /32, with its subnet mask, wildcard mask, total addresses and usable hosts. The values below are generated rather than typed, and the /31 and /32 rows are correct, which is not true of most CIDR charts you will find. If you want this subnet mask cheat sheet on paper, the same table comes as a one-page PDF at the end of this page.

* /31 is the exception explained below.

How to read a row

The prefix length is how many bits belong to the network: it is the number after the slash in CIDR notation. A /24 means the first 24 bits identify the network and the remaining 8 identify the host, which is why it holds 2⁸ = 256 addresses.

The subnet mask is those same bits painted out in dotted decimal: 24 ones followed by 8 zeros is 255.255.255.0. The wildcard mask is that inverted: 0.0.0.255, and it is what Cisco access lists and OSPF network statements expect. Getting those two the wrong way round is the single most common ACL mistake there is.

Usable hosts is two fewer than the address count, because the first address in a block is the network identifier and the last is the broadcast address. Neither can be assigned to a machine.

The two rows most tables get wrong

Apply "subtract two" blindly and you get nonsense at the bottom of the table: /31 comes out as zero usable hosts and /32 as minus one. Plenty of published tables print exactly that.

/32 is a single address, and it is useful. It is how you write a host route, a loopback interface, or a single-address match in a firewall rule. One address, one host, no network or broadcast address to reserve.

/31 gives you two usable addresses, not zero. RFC 3021 defines this for point-to-point links: with only two addresses there is nothing to broadcast to that is not simply "the other end", so both are assignable. It halves the address waste on router-to-router links, where a /30 spends four addresses to connect two interfaces. Every current router platform supports it.

Doing it in your head

You rarely need the whole table. Two facts cover most of it:

• Each bit you add halves the block. /24 is 256 addresses, /25 is 128, /26 is 64, /27 is 32, /28 is 16, /29 is 8, /30 is 4. Usable hosts is always that minus two.
• The interesting octet is the one the prefix lands in. For /25 to /32 it is the fourth, for /17 to /24 the third, and so on. The mask value in that octet runs 128, 192, 224, 240, 248, 252, 254, 255 as you add bits.

The block size in that octet is 256 minus the mask value. A /26 has a mask of 192, so the blocks are 64 apart: .0, .64, .128, .192. That trick tells you which subnet an address falls in faster than any calculator.

The ones worth memorising

• /30: 2 hosts. Point-to-point links, before RFC 3021.
• /29: 6 hosts. A small rack of appliances, or a handful of static addresses from an ISP.
• /24: 254 hosts. The default assumption almost everywhere, and a whole third octet.
• /16: 65,534 hosts. 10.x deployments and lazy lab addressing.
• /8: the whole of 10.0.0.0/8.

A note on IPv6

IPv6 uses the same prefix notation and none of the arithmetic above. There is no broadcast address, so nothing is subtracted; a /64 is the standard subnet size and holds 2⁶⁴ addresses, which is more than the entire IPv4 internet squared. Allocations are typically /48 to a site and /64 to each network, and the host count stops being a number anyone counts.

Using more than one size

Nothing says every subnet in a network must be the same size. Giving a point-to-point link a /30 while the office gets a /26 is variable length subnet masking, and it is how you stop wasting 60 addresses on a two-address link: see VLSM explained.