Subnet cheat sheet: every prefix from /8 to /32 in one table

Every IPv4 prefix from /8 to /32 is in the table below with its netmask, its wildcard, the total number of addresses and the number you can hand to hosts. Usable is total minus two (the network and broadcast addresses) on every row except /31 and /32, which follow their own rules. If you have one specific address and want its network, broadcast and host range, type it into the subnet calculator. This page is the subnet cheat sheet that sits next to it, for the moments when you only need to know what a /22 is.

The CIDR chart, /8 to /32

The last column compares each block with a /24, the size most of us carry around in our heads.

A minute with the chart shows three patterns. Each row is exactly half the one above it, because each extra prefix bit halves the block. The wildcard is the netmask subtracted from 255, octet by octet, so 255.255.252.0 becomes 0.0.3.255. And a valid mask only ever uses nine values in any octet: 0, 128, 192, 224, 240, 248, 252, 254 and 255. If someone hands you a mask with 253 or 191 in it, the mask is wrong, not the chart.

# Affiliate links: we may earn a commission. As an Amazon Associate I earn from qualifying purchases. We also earn from qualifying purchases on eBay.

Finding a subnet without the chart: the block-size trick

Memorizing 25 rows is not the goal. Find the octet where the mask stops being 255 (the interesting octet), subtract its value from 256, and you have the block size. Subnets in that octet start at multiples of it, and the address you are looking at falls into one of them.

Three addresses worked through by hand, each checked against the calculator's output:

10.20.30.200/27   mask 255.255.255.224    block 256 - 224 = 32, 4th octet
                  starts: 0, 32, 64 ... 192, 224    200 falls in 192 to 223
                  network 10.20.30.192    broadcast 10.20.30.223
                  hosts 10.20.30.193 to 10.20.30.222 (30 usable)

172.16.5.4/20     mask 255.255.240.0      block 256 - 240 = 16, 3rd octet
                  starts: 0, 16, 32 ...             5 falls in 0 to 15
                  network 172.16.0.0      broadcast 172.16.15.255
                  hosts 172.16.0.1 to 172.16.15.254 (4,094 usable)

10.44.7.9/22      mask 255.255.252.0      block 256 - 252 = 4, 3rd octet
                  starts: 0, 4, 8 ...               7 falls in 4 to 7
                  network 10.44.4.0       broadcast 10.44.7.255
                  hosts 10.44.4.1 to 10.44.7.254 (1,022 usable)

The /20 and /22 cases are where people slip, because the host range spans several values of the third octet. 172.16.3.255 is an ordinary host address inside 172.16.0.0/20. Giving it to a printer is fine, whatever your /24 habits say.

If binary is easier for you, the /20 mask is 11111111.11111111.11110000.00000000: twenty ones, then twelve host bits, and 2 to the 12th is the 4,096 in the chart.

Splitting a /24

The most common real job is cutting one /24 into VLAN-sized pieces. For 192.168.10.0/24:

The first /26 is 192.168.10.0/26, hosts .1 to .62, broadcast .63, and the next one starts at .64. The calculator's split menu prints the same list with every range and broadcast spelled out, which is handy to paste into a change ticket.

/31 and /32: the two rows that break the rule

The usable column says 2 for both /30 and /31. That is not a typo.

A /30 has four addresses: network, two hosts, broadcast. For years it was the standard size for a point-to-point router link, and it spends half its space on addresses nobody can use. RFC 3021 allows a /31 on point-to-point links instead: two addresses, both assigned, no network address and no broadcast address. On a link with exactly two ends there is nobody else to broadcast to. 10.0.0.0/31 gives 10.0.0.0 to one router and 10.0.0.1 to the other.

The rules I keep for /31s:

• Use them only on true point-to-point links: router to router, router to firewall, a routed uplink between two switches. Not on a LAN segment, where hosts expect a broadcast address. Plan a /30 there.
• Check both ends before the change window. Current routing platforms generally accept a /31, but an older device or a small firewall may refuse the address or treat the lower one as a network address.
• Check your monitoring too. A discovery range or ping sweep that skips addresses ending in .0 will quietly miss one end of every /31 link.

A /32 is a single address: one in total, one usable, no separate network or broadcast address. You meet it as a router loopback (the address to point SNMP polling and BGP sessions at, because it stays reachable as long as any path to the box does), as a host route, and in ACL entries that match exactly one host. It is never a LAN.

The calculator treats both the way the chart does: a /31 shows two usable hosts and "none" for broadcast, a /32 shows one usable host.

Private and special ranges

These are the blocks you will meet inside networks and in lab notes. The counts come from the same arithmetic as the chart.

The 172.16.0.0/12 row is the one people get wrong. It runs to 172.31.255.255, not 172.16.255.255, so 172.20.1.1 is private and 172.32.1.1 is not. The RFC 1918 blocks are not routed on the public internet, which is why every home router and most offices live in them. 100.64.0.0/10 looks private but is meant for providers' NAT; if your ISP uses carrier-grade NAT, building a lab in that range will collide with it. A host that shows a 169.254 address gave itself one because DHCP never answered, which is a fault to chase, not an address to document.

Picking a prefix for a host count

Work from the number of devices to the prefix, not the other way round. The smallest fit for each count, as the calculator's hosts field reports it:

Usable is not free. The default gateway takes one address, a redundant gateway pair takes three, and switches, access points, printers and DHCP reservations take more. I size a user VLAN at roughly twice today's count and round up to the next row. A /24 for a floor of 100 desks is not waste; it is the renumbering you will never have to schedule. The home VLAN plan applies the same thinking at house scale.

Where the wildcard column earns its place

Wildcards exist for ACLs and routing statements that match on "these bits must match, those can be anything". A standard Cisco IOS access list that lets one /27 of monitoring servers query SNMP, and an OSPF statement for the /22 from the worked example:

access-list 10 permit 10.20.30.192 0.0.0.31
snmp-server community n0c-r34d RO 10

router ospf 1
 network 10.44.4.0 0.0.3.255 area 0

The net-snmp agent takes the prefix form instead, in snmpd.conf:

rocommunity n0c-r34d 10.20.30.192/27

Either way the community string only works from the monitoring subnet. It still crosses the wire in plain text, so on any network you do not fully trust, run SNMPv3 with authentication and privacy and keep the ACL as a second fence.

Before a new subnet goes into a config, run the same short check every time: the network address is a multiple of the block size, the mask uses only the nine legal octet values, the wildcard is 255 minus the mask, the gateway sits where your convention says (first or last usable), and a /31 is on a link where both ends support it. For any address you would rather not work out by hand, the subnet calculator gives the full answer in one line. Then write the result where the next person will look for it; the IPAM and diagrams guide covers a simple way to do that.