Subnet Mask Reference Table
Complete /0 through /32 lookup: CIDR ↔ decimal mask ↔ wildcard ↔ host count. Common subnets highlighted.
The complete /0 through /32 lookup table
Every IPv4 subnet mask, with prefix length, decimal mask, wildcard (inverse) mask, total addresses, and usable hosts. Common subnets are highlighted.
| CIDR | Subnet mask | Wildcard | Total addresses | Usable hosts | Common use |
|---|---|---|---|---|---|
/0 | 0.0.0.0 | 255.255.255.255 | 4,294,967,296 | 4,294,967,294 | |
/1 | 128.0.0.0 | 127.255.255.255 | 2,147,483,648 | 2,147,483,646 | |
/2 | 192.0.0.0 | 63.255.255.255 | 1,073,741,824 | 1,073,741,822 | |
/3 | 224.0.0.0 | 31.255.255.255 | 536,870,912 | 536,870,910 | |
/4 | 240.0.0.0 | 15.255.255.255 | 268,435,456 | 268,435,454 | |
/5 | 248.0.0.0 | 7.255.255.255 | 134,217,728 | 134,217,726 | |
/6 | 252.0.0.0 | 3.255.255.255 | 67,108,864 | 67,108,862 | |
/7 | 254.0.0.0 | 1.255.255.255 | 33,554,432 | 33,554,430 | |
/8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 | Largest RFC 1918 (10.0.0.0/8) |
/9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 | |
/10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 | |
/11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 | |
/12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 | Mid RFC 1918 (172.16.0.0/12) |
/13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 | |
/14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 | |
/15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 | |
/16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 | 192.168.0.0/16, /16 enterprise |
/17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 | |
/18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 | |
/19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 | |
/20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 | |
/21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 | |
/22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 | |
/23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 | |
/24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 | Standard home/office subnet |
/25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 | |
/26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 | |
/27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 | 30 hosts — small VLAN |
/28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 | |
/29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 | 6 hosts — small ISP customer |
/30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 | Point-to-point WAN link |
/31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 (point-to-point) | RFC 3021 P-to-P (no network/broadcast) |
/32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 (host route) | Host route (loopbacks, ACLs) |
Quick math reminders
- Each bit added to the prefix halves the subnet. /24 has 256 addresses, /25 has 128, /26 has 64, and so on.
- Usable hosts = total − 2 in most subnets (one for network address, one for broadcast). Exceptions: /31 (P-to-P, RFC 3021) uses both for hosts, and /32 is a single host route.
- Wildcard mask = inverse of subnet mask. Used in Cisco ACLs. /24 = 255.255.255.0 → wildcard 0.0.0.255.
When you actually need each size
| Subnet size | Typical use |
|---|---|
| /30 — 2 hosts | Point-to-point WAN links between routers |
| /29 — 6 hosts | Small ISP customer block, server VLAN |
| /28 — 14 hosts | Small office VLAN, DMZ |
| /27 — 30 hosts | Medium VLAN, branch office |
| /26 — 62 hosts | Larger VLAN, IoT segment |
| /24 — 254 hosts | Standard home or small office — the default |
| /23 — 510 hosts | Floor or department network |
| /22 — 1,022 hosts | Large enterprise floor or campus segment |
| /16 — 65,534 hosts | Whole enterprise, or 192.168.0.0/16 for home labs |
| /12 — 1,048,574 hosts | 172.16.0.0/12 — RFC 1918 mid-range |
| /8 — 16,777,214 hosts | 10.0.0.0/8 — biggest RFC 1918 block |
Tempting to give every site a /16 "just in case." Don't. Bigger subnets mean bigger broadcast domains, more ARP traffic, harder troubleshooting. A /24 holds 254 hosts — that's already a lot of devices on one segment. If you need more than 254, you probably want multiple smaller VLANs, not one giant /22.
How to use this table without memorizing it
The subnet mask table is a reference for translating between CIDR notation, dotted-decimal subnet masks, wildcard masks, and host counts. In fifteen years of network admin work I've never memorized the whole table; instead I've memorized the common sizes I use daily (/24, /23, /22, /28, /30) and look up the rest when needed. That's the practical approach — know what you use often, look up the rest.
The common sizes worth memorizing
/24 (255.255.255.0)
256 addresses, 254 usable. The default LAN size for essentially every consumer and small-business network. Easy to think about because the first three octets are the network and the last octet is the host. If you can only memorize one, memorize this one.
/23 (255.255.254.0)
512 addresses, 510 usable. Twice the size of a /24. Useful when you outgrow a /24 but don't need a /22.
/22 (255.255.252.0)
1024 addresses, 1022 usable. Common size for a mid-sized office or campus segment.
/28 (255.255.255.240)
16 addresses, 14 usable. Common for DMZ networks, small server pools, security camera segments, and similar small isolated groups.
/29 (255.255.255.248)
8 addresses, 6 usable. Small pools, occasional point-to-point uses.
/30 (255.255.255.252)
4 addresses, 2 usable. The classic point-to-point link size. Just enough for a router at each end.
/31 (255.255.255.254)
2 addresses, 2 usable (RFC 3021). Modern point-to-point where the /30's network and broadcast reservations are unnecessary.
/32 (255.255.255.255)
One address. Used to identify a single host in ACLs, or as a loopback address.
Wildcard masks and why they matter
Cisco ACLs use "wildcard masks" instead of subnet masks. A wildcard mask is the bit-inverse of the subnet mask. Where the subnet mask has a 1, the wildcard mask has a 0, and vice versa.
The concept is "match zeros; don't care about ones." An ACL rule that matches 192.168.1.0 with wildcard mask 0.0.0.255 matches any address where the first three octets are exactly 192.168.1 (because those bits are marked with 0 in the wildcard mask, meaning "must match") and any value in the last octet (because those bits are 1, meaning "don't care").
Common wildcard masks:
- /24 wildcard: 0.0.0.255
- /25 wildcard: 0.0.0.127
- /26 wildcard: 0.0.0.63
- /27 wildcard: 0.0.0.31
- /28 wildcard: 0.0.0.15
- /29 wildcard: 0.0.0.7
- /30 wildcard: 0.0.0.3
- /32 wildcard: 0.0.0.0
The relationship: wildcard = 255.255.255.255 minus subnet mask. So /24's 255.255.255.0 subtracts to 0.0.0.255. Do this arithmetic once and you can compute any wildcard mask on demand.
Common mistakes when using these values
Forgetting the network and broadcast reservations
A /24 has 256 addresses but only 254 usable ones. The .0 is the network address and the .255 is the broadcast. Trying to assign a device to either causes conflicts.
Confusing subnet mask and wildcard mask
Cisco ACLs use wildcard; Cisco interface configs use subnet mask; every other Cisco context uses one or the other but not both. Getting them backwards produces ACLs that either match nothing or match everything. Read the documentation for the specific command.
Assuming /31 works everywhere
RFC 3021 says /31 can be used for point-to-point links, but not every router implementation supports it. Modern Cisco IOS-XE, Juniper Junos, MikroTik, and most modern routers do. Some older or embedded devices don't. When in doubt, /30 is universally supported.
Overlapping subnets in the same routing domain
Two routes to overlapping subnets create ambiguity. More-specific routes win in principle, but keeping subnets non-overlapping is much cleaner and avoids surprising route selection.
Assuming CIDR blocks start on nice numeric boundaries
A /28 has to start on a multiple of 16 in the last octet: .0, .16, .32, .48, .64, .80, .96, .112, .128, .144, .160, .176, .192, .208, .224, .240. Writing "192.168.1.10/28" is technically ambiguous — depending on the tool, it might be normalized to 192.168.1.0/28 (the block containing .10) or rejected as an invalid network address.
Practical uses for the table
Planning a new office network
Figuring out what size subnet to allocate for the different types of devices — production VMs, user workstations, IoT devices, security cameras, guest network — often involves looking at the host count column and picking the smallest prefix that fits with headroom.
Migrating between network sizes
When a customer outgrows their current /24 and needs to grow, comparing the block size column tells you whether /23, /22, or larger makes sense. Growing by one bit doubles the block; growing by two bits quadruples it.
Configuring Cisco ACLs
Every time I write a Cisco ACL, I look up the wildcard mask for the source and destination subnets. The wildcard column in the table is faster than computing 255.255.255.255 minus subnet mask in my head.
Converting between notation styles
Legacy documentation and older network gear often use dotted-decimal subnet masks. Modern documentation uses CIDR notation. Translating between them is what this table is for.
Related tools
For subnet calculations that include specific IP addresses (network address, broadcast address, usable range), use the Subnet Calculator. For CIDR-based range calculations, use the CIDR Range Tool. For working with individual IPs in different formats, use the IP Converter.