Subnet Mask Cheat Sheet: CIDR Prefixes, Netmasks and Usable Hosts

Applies to: IPv4 networks (values checked with Python’s ipaddress module and ipcalc)

A subnet mask says which part of an IPv4 address is the network and which part is the host. It is written either as a mask (255.255.255.0) or as a CIDR prefix (/24): the number of bits that belong to the network. The bigger the prefix, the smaller the block.

Cheat sheet

CIDR  Subnet mask         Addresses  Usable hosts   Wildcard
/8    255.0.0.0           16,777,216   16,777,214   0.255.255.255
/9    255.128.0.0          8,388,608    8,388,606   0.127.255.255
/10   255.192.0.0          4,194,304    4,194,302   0.63.255.255
/11   255.224.0.0          2,097,152    2,097,150   0.31.255.255
/12   255.240.0.0          1,048,576    1,048,574   0.15.255.255
/13   255.248.0.0            524,288      524,286   0.7.255.255
/14   255.252.0.0            262,144      262,142   0.3.255.255
/15   255.254.0.0            131,072      131,070   0.1.255.255
/16   255.255.0.0             65,536       65,534   0.0.255.255
/17   255.255.128.0           32,768       32,766   0.0.127.255
/18   255.255.192.0           16,384       16,382   0.0.63.255
/19   255.255.224.0            8,192        8,190   0.0.31.255
/20   255.255.240.0            4,096        4,094   0.0.15.255
/21   255.255.248.0            2,048        2,046   0.0.7.255
/22   255.255.252.0            1,024        1,022   0.0.3.255
/23   255.255.254.0              512          510   0.0.1.255
/24   255.255.255.0              256          254   0.0.0.255
/25   255.255.255.128            128          126   0.0.0.127
/26   255.255.255.192             64           62   0.0.0.63
/27   255.255.255.224             32           30   0.0.0.31
/28   255.255.255.240             16           14   0.0.0.15
/29   255.255.255.248              8            6   0.0.0.7
/30   255.255.255.252              4            2   0.0.0.3
/31   255.255.255.254              2            2   0.0.0.1
/32   255.255.255.255              1            1   0.0.0.0

• Addresses: the size of the block.
• Usable hosts: addresses minus the network address (the first) and the broadcast address (the last).
• Wildcard: the inverse of the mask, used in some firewall and router rules.
• /31 is used for point-to-point links (both addresses usable); /32 is a single address.

Subnets from your provider: one more address for the gateway

When a provider routes a subnet to your server with the gateway inside the block, the gateway uses one more address. That is why a dedicated server’s /29 gives 5 usable addresses, not 6, a /28 gives 13 and a /24 gives 253. See how many IP addresses come with a dedicated server and order an additional IPv4 subnet.

Where blocks start

A block always starts at a multiple of its size: /29 blocks (8 addresses) start at .0.8.16 and so on; /28 blocks (16) at .0.16.32. So 203.0.113.8/29 is a valid block, 203.0.113.10/29 is not a block start.

Calculate a block

ipcalc -n 203.0.113.8/29

Our test printed the network 203.0.113.8/29, first host 203.0.113.9, last host 203.0.113.14, broadcast 203.0.113.15 and Hosts/Net: 6. More: calculate subnets with ipcalc. Without ipcalc, Python works on almost every Linux server:

python3 -c "import ipaddress as i; n=i.ip_network('203.0.113.8/29'); print(n.netmask, n[1], n[-2], n.broadcast_address)"

Common masks at a glance

• /24 = 255.255.255.0: typical office or home network, 254 hosts.
• /16 = 255.255.0.0: large private networks.
• /8 = 255.0.0.0: the whole 10.0.0.0 private range.

Adding extra addresses to a server: add IPv4 addresses on Ubuntu with netplan. The basics of a /24: IPv4 subnets and /24 explained.