A subnet mask splits an IPv4 address into a network part and a host part. CIDR notation writes the split as a slash and a number, so 192.168.1.0/24means the first 24 bits identify the network and the remaining 8 bits are free for hosts. Everything else on this page follows from that one idea, so the table below is really just a lookup for “how many host bits are left, and what can I do with them.”
CIDR notation in one paragraph
An IPv4 address is 32 bits, written as four 8-bit octets. The prefix length n is how many of those 32 bits are fixed as the network. That leaves 32 minus n host bits, so a block holds 2^(32 - n) total addresses. In every ordinary subnet the first address is the network address and the last is the broadcast address, neither of which you assign to a machine, so usable hosts come to 2^(32 - n) minus 2. The two exceptions live at the very bottom of the table and are covered under it.
The /8 to /32 table
Total addresses double every time the prefix shrinks by one bit. Usable hosts are the total minus the network and broadcast addresses, except for /31 and /32.
| Subnet mask | Total addresses | Usable hosts | |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 512 | 510 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 (point-to-point) |
| /32 | 255.255.255.255 | 1 | 1 (single host) |
Two rows break the “minus 2” rule on purpose. A /31 has only two addresses, and RFC 3021 lets both of them be used as host addresses on a point-to-point link, since a two-host link needs no separate broadcast address. A /32 is a single address with no room for hosts at all, which is exactly why it is used for loopback entries, host routes, and one-address firewall rules.
Reserved and special ranges
Some blocks never appear on the public internet. The three private ranges from RFC 1918 are the ones you will reach for on any home or office network.
| Range | What it is | Routable on the internet? | |
|---|---|---|---|
| 10.0.0.0/8 | Private (RFC 1918) | 16,777,216 addresses | No |
| 172.16.0.0/12 | Private (RFC 1918) | 1,048,576 addresses | No |
| 192.168.0.0/16 | Private (RFC 1918) | 65,536 addresses | No |
| 127.0.0.0/8 | Loopback | This machine (127.0.0.1) | No |
| 169.254.0.0/16 | Link-local (APIPA) | Auto-assigned, no DHCP | No |
| 100.64.0.0/10 | Carrier-grade NAT (RFC 6598) | ISP shared address space | No |
The 172.16.0.0/12 block is the one people misremember most. It runs from 172.16.0.0 up to 172.31.255.255, not all the way to 172.255, because /12 fixes the first 12 bits and leaves only the second octet range 16 through 31. The link-local 169.254.0.0/16 block is what a machine assigns itself when DHCP fails, which is why seeing a 169.254 address usually means “no DHCP answered.”
Worked example: 192.168.1.130/26
A /26 leaves 6 host bits, so each subnet holds 64 addresses. That 64 is the block size, and it is the number that makes this easy to do in your head. Subnets in the fourth octet start at multiples of 64: 0, 64, 128, and 192.
- The address ends in 130, which falls between 128 and 191, so it lives in the block that starts at 128.
- Network address: 192.168.1.128 (the first address in that block).
- Broadcast address: 192.168.1.191 (the last address, one below the next block at 192).
- Usable range: 192.168.1.129 through 192.168.1.190, which is 62 hosts.
If you would rather see the bits directly, convert an octet to binary with our number base converter. Writing 130 as 10000010 and masking off the top two bits (the /26 host bits are the bottom 6) makes the 128 network boundary obvious.
Reading a mask back into a prefix
Going the other way is just counting the 1 bits in the mask. 255.255.255.192 is 11111111.11111111.11111111.11000000, which is 8 + 8 + 8 + 2 = 26 one-bits, so it is a /26. Each mask octet is one of a fixed set of values: 0, 128, 192, 224, 240, 248, 252, 254, 255. Any other value is not a valid contiguous mask.
A short note on IPv6
IPv6 addresses are 128 bits, so the numbers get astronomically large and nobody counts hosts anymore. The convention that matters in practice: a single subnet is a /64. The first 64 bits are the network prefix and the last 64 are the interface identifier, which is large enough that stateless address autoconfiguration and privacy addresses both fit comfortably. Providers typically hand out a /48 or /56 to a site, and you carve /64 subnets out of that. You will rarely subnet smaller than /64 on a normal LAN, because much of IPv6 autoconfiguration assumes a full 64-bit host portion.
Keep this next to your other lookups
Subnetting is one of those skills that fades between the times you need it, so a table beats memorization. When the syntax you are hunting for is a pattern rather than a mask, our regex cheat sheet covers the same ground for text, and the port numbers list is the companion for the layer above addressing. All three live in the same set of developer cheat sheets.