--- title: Subnet Cheat Sheet: CIDR, Masks and Host Counts | Relic description: A subnet cheat sheet with the full /8 to /32 table, subnet masks, total and usable host counts, the private and reserved ranges, and worked CIDR examples. canonical: https://relic.space/blog/subnet-cheat-sheet source: https://relic.space/llms.txt --- [Developer cheat sheets](https://relic.space/blog/topics/dev-reference) # Subnet cheat sheet The prefix length after the slash tells you two things: how many addresses a block holds, and how many of them you can actually assign to hosts. This subnet cheat sheet has the full /8 to /32 table, the reserved ranges, and the arithmetic for finding a network and its broadcast address by hand. [JGJordan Gibbs](https://relic.space/authors/jordan-gibbs) July 10, 2026 5 min readUpdated September 12, 2026 ## What does the slash number in a subnet mean? The number after the slash is how many bits are fixed as the network. Subtract it from 32 to get the host bits, then a block holds 2 to that power addresses. Usable hosts are that total minus two, one for the network address and one for broadcast. A /24 gives 254. A subnet mask splits an IPv4 address into a network part and a host part. [CIDR notation](https://www.rfc-editor.org/rfc/rfc4632.html) writes the split as a slash and a number, so **192.168.1.0/24**means the first 24 bits identify the network and the remaining 8 bits are free for hosts. Everything else on this page follows from that one idea, so the table below is really just a lookup for “how many host bits are left, and what can I do with them.” ## How does CIDR notation work? An IPv4 address is 32 bits, written as four 8-bit octets. The prefix length **n** is how many of those 32 bits are fixed as the network. That leaves **32 minus n** host bits, so a block holds **2^(32 - n)** total addresses. In every ordinary subnet the first address is the network address and the last is the broadcast address, neither of which you assign to a machine, so usable hosts come to **2^(32 - n) minus 2**. The two exceptions live at the very bottom of the table and are covered under it. ## The /8 to /32 table Total addresses double every time the prefix shrinks by one bit. Usable hosts are the total minus the network and broadcast addresses, except for /31 and /32. | | Subnet mask | Total addresses | Usable hosts | | --- | --------------- | --------------- | ------------------ | | /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | | /9 | 255.128.0.0 | 8,388,608 | 8,388,606 | | /10 | 255.192.0.0 | 4,194,304 | 4,194,302 | | /11 | 255.224.0.0 | 2,097,152 | 2,097,150 | | /12 | 255.240.0.0 | 1,048,576 | 1,048,574 | | /13 | 255.248.0.0 | 524,288 | 524,286 | | /14 | 255.252.0.0 | 262,144 | 262,142 | | /15 | 255.254.0.0 | 131,072 | 131,070 | | /16 | 255.255.0.0 | 65,536 | 65,534 | | /17 | 255.255.128.0 | 32,768 | 32,766 | | /18 | 255.255.192.0 | 16,384 | 16,382 | | /19 | 255.255.224.0 | 8,192 | 8,190 | | /20 | 255.255.240.0 | 4,096 | 4,094 | | /21 | 255.255.248.0 | 2,048 | 2,046 | | /22 | 255.255.252.0 | 1,024 | 1,022 | | /23 | 255.255.254.0 | 512 | 510 | | /24 | 255.255.255.0 | 256 | 254 | | /25 | 255.255.255.128 | 128 | 126 | | /26 | 255.255.255.192 | 64 | 62 | | /27 | 255.255.255.224 | 32 | 30 | | /28 | 255.255.255.240 | 16 | 14 | | /29 | 255.255.255.248 | 8 | 6 | | /30 | 255.255.255.252 | 4 | 2 | | /31 | 255.255.255.254 | 2 | 2 (point-to-point) | | /32 | 255.255.255.255 | 1 | 1 (single host) | Two rows break the “minus 2” rule on purpose. A **/31** has only two addresses, and [RFC 3021](https://www.rfc-editor.org/rfc/rfc3021.html) lets both of them be used as host addresses on a point-to-point link, since a two-host link needs no separate broadcast address. A **/32** is a single address with no room for hosts at all, which is exactly why it is used for loopback entries, host routes, and one-address firewall rules. ## Which IPv4 ranges are reserved? Some blocks never appear on the public internet. The three private ranges from [RFC 1918](https://www.rfc-editor.org/rfc/rfc1918.html) are the ones you will reach for on any home or office network. | | Range | What it is | Routable on the internet? | | -------------- | ---------------------------- | ------------------------ | ------------------------- | | 10.0.0.0/8 | Private (RFC 1918) | 16,777,216 addresses | No | | 172.16.0.0/12 | Private (RFC 1918) | 1,048,576 addresses | No | | 192.168.0.0/16 | Private (RFC 1918) | 65,536 addresses | No | | 127.0.0.0/8 | Loopback | This machine (127.0.0.1) | No | | 169.254.0.0/16 | Link-local (APIPA) | Auto-assigned, no DHCP | No | | 100.64.0.0/10 | Carrier-grade NAT (RFC 6598) | ISP shared address space | No | The 172.16.0.0/12 block is the one people misremember most. It runs from 172.16.0.0 up to 172.31.255.255, not all the way to 172.255, because /12 fixes the first 12 bits and leaves only the second octet range 16 through 31\. The link-local 169.254.0.0/16 block is what a machine assigns itself when DHCP fails, which is why seeing a 169.254 address usually means “no DHCP answered.” IANA keeps the full list of blocks that are set aside for a special job in its [IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry), and it marks which of them are globally routable. ## Worked example: 192.168.1.130/26 A /26 leaves 6 host bits, so each subnet holds 64 addresses. That 64 is the **block size**, and it is the number that makes this easy to do in your head. Subnets in the fourth octet start at multiples of 64: 0, 64, 128, and 192. * The address ends in 130, which falls between 128 and 191, so it lives in the block that starts at 128. * **Network address:** 192.168.1.128 (the first address in that block). * **Broadcast address:** 192.168.1.191 (the last address, one below the next block at 192). * **Usable range:** 192.168.1.129 through 192.168.1.190, which is 62 hosts. The block-size shortcut works for any prefix. Subtract the prefix from 32 to get the host bits, raise 2 to that power for the block size, then the network address is the largest multiple of that block size at or below your address. Broadcast is one below the next block. That is the whole method. If you would rather see the bits directly, convert an octet to binary with our [number base converter](https://relic.space/tools/number-base-converter). Writing 130 as 10000010, then keeping the top two bits and zeroing the bottom six (a /26 leaves 6 host bits), makes the 128 network boundary obvious. ### Reading a mask back into a prefix Going the other way is just counting the 1 bits in the mask. 255.255.255.192 is 11111111.11111111.11111111.11000000, which is 8 + 8 + 8 + 2 = 26 one-bits, so it is a /26\. Each mask octet is one of a fixed set of values: 0, 128, 192, 224, 240, 248, 252, 254, 255\. Any other value is not a valid contiguous mask. ## How does subnetting work in IPv6? IPv6 addresses are 128 bits, so the numbers get astronomically large and nobody counts hosts anymore. The convention that matters in practice: a single subnet is a **/64**. The first 64 bits are the network prefix and the last 64 are the interface identifier, which is large enough that stateless address autoconfiguration and privacy addresses both fit comfortably. Providers typically hand out a /48 or /56 to a site, and you carve /64 subnets out of that. You will rarely subnet smaller than /64 on a normal LAN, because much of IPv6 autoconfiguration assumes a full 64-bit host portion. ## Keep this next to your other lookups Subnetting is one of those skills that fades between the times you need it, so a table beats memorization. When the syntax you are hunting for is a pattern rather than a mask, our [regex cheat sheet](https://relic.space/blog/regex-cheat-sheet) covers the same ground for text, and the [port numbers list](https://relic.space/blog/port-numbers-list) is the companion for the layer above addressing. All three live in the same set of [developer cheat sheets](https://relic.space/blog/topics/dev-reference). ## Sources * [RFC 4632: Classless Inter-domain Routing (CIDR), The Internet Address Assignment and Aggregation Plan](https://www.rfc-editor.org/rfc/rfc4632.html), RFC Editor (2006) * [RFC 1918: Address Allocation for Private Internets](https://www.rfc-editor.org/rfc/rfc1918.html), RFC Editor (1996) * [RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links](https://www.rfc-editor.org/rfc/rfc3021.html), RFC Editor (2000) * [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry), IANA JG Written by [Jordan Gibbs](https://relic.space/authors/jordan-gibbs)Founder, Relic Jordan Gibbs is the founder of Relic, an end-to-end encrypted, permanent, searchable memory for everything you copy. He writes widely about AI, agents, and practical tooling on Medium, where he is read by tens of thousands, and builds privacy-first software. Here he covers how everyday tools like the clipboard actually work, and how to use them without handing your data to someone else. [Medium](https://medium.com/@jordan%5Fgibbs)[GitHub](https://github.com/jordan-gibbs)[LinkedIn](https://www.linkedin.com/in/jordan--gibbs/) Part of [Developer cheat sheets](https://relic.space/blog/topics/dev-reference) * [Regex cheat sheet· pillar](https://relic.space/blog/regex-cheat-sheet) * [How to copy and paste in Vim](https://relic.space/blog/how-to-copy-and-paste-in-vim) * [How to copy to the clipboard from the command line](https://relic.space/blog/copy-to-clipboard-from-the-command-line) * [What AI crawlers fetch from a small open-source site: 31 days of logs](https://relic.space/blog/ai-crawlers-on-a-small-site) * [JSONPath examples](https://relic.space/blog/jsonpath-examples) * [jq cheat sheet](https://relic.space/blog/jq-cheat-sheet) * [wget vs curl: what is the difference?](https://relic.space/blog/wget-vs-curl) * [Port numbers list](https://relic.space/blog/port-numbers-list) * [Ed25519 vs RSA](https://relic.space/blog/ed25519-vs-rsa) * [TOML vs YAML](https://relic.space/blog/toml-vs-yaml) Keep reading [Pillar·10 minRegex cheat sheetThe regex pieces you actually reach for, character classes through lookarounds, with the flavor differences that bite you and a handful of patterns worth saving.Read ](https://relic.space/blog/regex-cheat-sheet)[9 minHow to copy and paste in Vimy copies and p pastes, but only inside Vim. How registers work, how to reach the system clipboard when your build says -clipboard, and how to copy out over SSH and in tmux.Read ](https://relic.space/blog/how-to-copy-and-paste-in-vim)[8 minHow to copy to the clipboard from the command linePipe any command into the clipboard on Mac, Linux, Windows and WSL. The commands for each, plus the newline and encoding problems that break pasted text.Read ](https://relic.space/blog/copy-to-clipboard-from-the-command-line) developernetworkingreference