Subnet Mask Cheat Sheet

Interactive CIDR-to-hosts reference table you can filter and search.

Reviewed by the ToolNestr Editorial Team — July 2026

CIDR	Subnet Mask	Total IPs	Usable IPs	Wildcard Mask

Visual scale of CIDR prefix lengths relative to address space from /32 (1 IP) to /0 (4,294,967,296 IPs)

The formula

Every subnet is defined by its CIDR prefix length, the number of leading 1-bits in the subnet mask. The math is straightforward:

total_ips = 2^{(32 − cidr)}
usable = total_ips − 2 (except /31 and /32)

For a /24 network: 2^{(32 − 24)} = 2⁸ = 256 total addresses. The network address (all host bits 0) and broadcast address (all host bits 1) are reserved, leaving 254 usable host addresses. For a /16: 2^{(32 − 16)} = 2¹⁶ = 65,536 addresses, minus 2 = 65,534 usable. Each time you increase the prefix by 1, you cut the address space in half. A /25 has 128 total IPs (126 usable), /26 has 64 (62 usable), and so on.

The two exceptions are /31 (RFC 3021) and /32. A /31 has 2 total addresses but no network or broadcast reservation, making both addresses usable for point-to-point links. A /32 is a single-host route — all 1 address is usable (commonly used for loopback interfaces or default routes).

Worked example: /24 subnet

Let us walk through a real /24 network, say 192.168.1.0/24:

CIDR notation: 192.168.1.0/24
Subnet mask: 255.255.255.0
Wildcard mask: 0.0.0.255
Total addresses: 2^{(32 − 24)} = 256
Usable addresses: 256 − 2 = 254
Network address: 192.168.1.0 (all host bits zero)
Broadcast address: 192.168.1.255 (all host bits one)
First usable: 192.168.1.1
Last usable: 192.168.1.254

The same pattern applies to every prefix length. For a /28 (255.255.255.240), the block size is 16 IPs: network + 14 usable + broadcast. For a /30 (255.255.255.252), the block is 4 IPs: network + 2 usable + broadcast — the smallest subnet commonly used for point-to-point links before /31 was standardized.

Use cases

Network design

When planning a new network, choose a CIDR prefix that provides enough host addresses for current devices plus room for growth. A /24 is standard for a department LAN, /23 for a larger floor, and /22 for an entire building. For data center VLANs, /25 or /26 may suffice since each rack typically contains a limited number of servers.

Firewall rules

Firewall access control entries (ACEs) use CIDR notation to match source or destination networks. Instead of listing 254 individual host IPs, a single /24 rule covers the entire range. Understanding the block size helps avoid overly permissive rules that span too many addresses or overly restrictive ones that miss valid traffic.

Cloud VPC sizing

AWS, Azure, and Google Cloud all use CIDR blocks for Virtual Private Cloud (VPC) networks. Choosing the right VPC CIDR is critical because it cannot be changed after creation. A /16 (65,536 addresses) is common for large VPCs, with /24 subnets in each availability zone. Overlapping CIDRs between peered VPCs cause routing conflicts, so careful planning with this cheat sheet prevents costly redesigns.

Tips

Always reserve the first and last IP

In every subnet (except /31 and /32), the first address is the network identifier and the last is the broadcast address. Do not assign these to hosts. Many devices and operating systems behave unexpectedly if a host claims the network or broadcast address, causing duplicate address detection failures, ARP issues, and routing problems.

Use /31 for point-to-point links

RFC 3021 allows /31 subnets on point-to-point links, providing 2 usable addresses (both hosts) with no network or broadcast overhead. This doubles the efficiency of /30 links on router interconnects. When both endpoints support RFC 3021 (most modern routers do), prefer /31 to conserve address space.

Plan for growth

Choose a prefix at least one bit larger than your current needs. A /24 that is 60% full today will run out of addresses sooner than expected as IoT devices, cloud workloads, and remote users multiply. Subnetting a larger block later requires re-addressing, so building in headroom from the start saves significant operational effort.

Wildcard masks for ACLs

In Cisco ACL syntax, the wildcard mask is the inverse of the subnet mask. For 255.255.255.0, the wildcard is 0.0.0.255. For 255.255.255.248 (/29), the wildcard is 0.0.0.7. The wildcard mask tells the ACL which bits to match (0 = match, 1 = ignore). This cheat sheet includes wildcard masks for quick ACL drafting.

Limitations

This cheat sheet covers IPv4 CIDR notation only. IPv6 subnetting uses a 128-bit address space with recommended /64 subnets and follows a fundamentally different hierarchy (see the IPv6 Subnet Calculator). The usable host counts assume standard RFC 791 and RFC 1812 subnet rules. Some cloud providers reserve additional addresses per subnet (AWS reserves the first 4 and last 1 IPs in each VPC subnet), so always check your provider documentation. Additionally, anycast, multicast, and broadcast networks may use different addressing conventions that deviate from standard host counts.