Network

Subnet Mask Cheat Sheet

IPv4 & IPv6

Every IPv4 prefix with its subnet mask, wildcard mask and host count, plus the octet values, reserved ranges and IPv6 sizes you need when planning a network. To work out a specific address, use the subnet calculator.

IPv4 subnet masks, /0 to /32

Grouped by the octet where the mask changes. Select a prefix to open it in the calculator.
PrefixSubnet maskWildcardAddressesUsable hostsCommon use
First octet /0–/8. The mask changes in the first number.
/00.0.0.0255.255.255.2554,294,967,29616,777,216 × /244,294,967,294
/1128.0.0.0127.255.255.2552,147,483,6488,388,608 × /242,147,483,646
/2192.0.0.063.255.255.2551,073,741,8244,194,304 × /241,073,741,822
/3224.0.0.031.255.255.255536,870,9122,097,152 × /24536,870,910
/4240.0.0.015.255.255.255268,435,4561,048,576 × /24268,435,454
/5248.0.0.07.255.255.255134,217,728524,288 × /24134,217,726
/6252.0.0.03.255.255.25567,108,864262,144 × /2467,108,862
/7254.0.0.01.255.255.25533,554,432131,072 × /2433,554,430
/8255.0.0.00.255.255.25516,777,21665,536 × /2416,777,214Largest private block (10.0.0.0/8)
Second octet /9–/16. The mask changes in the second number.
/9255.128.0.00.127.255.2558,388,60832,768 × /248,388,606
/10255.192.0.00.63.255.2554,194,30416,384 × /244,194,302Carrier-grade NAT (100.64.0.0/10)
/11255.224.0.00.31.255.2552,097,1528,192 × /242,097,150
/12255.240.0.00.15.255.2551,048,5764,096 × /241,048,574Private block 172.16.0.0/12
/13255.248.0.00.7.255.255524,2882,048 × /24524,286
/14255.252.0.00.3.255.255262,1441,024 × /24262,142
/15255.254.0.00.1.255.255131,072512 × /24131,070
/16255.255.0.00.0.255.25565,536256 × /2465,534192.168.0.0/16; largest AWS VPC
Third octet /17–/24. The mask changes in the third number.
/17255.255.128.00.0.127.25532,768128 × /2432,766
/18255.255.192.00.0.63.25516,38464 × /2416,382
/19255.255.224.00.0.31.2558,19232 × /248,190
/20255.255.240.00.0.15.2554,09616 × /244,094Default subnet size in an AWS default VPC
/21255.255.248.00.0.7.2552,0488 × /242,046
/22255.255.252.00.0.3.2551,0244 × /241,022Medium site or campus VLAN
/23255.255.254.00.0.1.2555122 × /24510
/24255.255.255.00.0.0.2552561 × /24254Typical LAN; smallest block routed on the internet
Fourth octet /25–/32. Subnets smaller than a /24.
/25255.255.255.1280.0.0.1271281/2 of a /24126
/26255.255.255.1920.0.0.63641/4 of a /2462Small VLAN or DMZ
/27255.255.255.2240.0.0.31321/8 of a /2430
/28255.255.255.2400.0.0.15161/16 of a /2414Smallest AWS VPC subnet
/29255.255.255.2480.0.0.781/32 of a /246Small static IP block from an ISP; smallest Azure subnet
/30255.255.255.2520.0.0.341/64 of a /242Point-to-point link (classic)
/31255.255.255.2540.0.0.121/128 of a /242Point-to-point link without wasted addresses (RFC 3021)
/32255.255.255.2550.0.0.011/256 of a /241A single host; loopback or a firewall rule for one IP
Usable hosts leave out the network and broadcast addresses. A /31 keeps both for point-to-point links, and a /32 is one address.

Mask values in one octet

Read a mask one number at a time
BitsValueBinaryWildcardBlock size
0000000000255256
112810000000127128
2192110000006364
3224111000003132
4240111100001516
52481111100078
62521111110034
72541111111012
82551111111101
Block size is the step between subnets in that octet. With 255.255.255.224 (/27), networks start at .0, .32, .64 and so on.

Private and reserved ranges

Blocks that aren’t routed on the public internet
BlockUsed forDefined in
10.0.0.0/8Private networkRFC 1918
172.16.0.0/12Private network (172.16.0.0 – 172.31.255.255)RFC 1918
192.168.0.0/16Private networkRFC 1918
100.64.0.0/10Carrier-grade NAT (shared address space)RFC 6598
127.0.0.0/8LoopbackRFC 1122
169.254.0.0/16Link-local; cloud metadata at 169.254.169.254RFC 3927
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24Documentation and examplesRFC 5737
224.0.0.0/4MulticastRFC 5771
fc00::/7IPv6 unique local (the private range)RFC 4193
fe80::/10IPv6 link-localRFC 4291
2001:db8::/32IPv6 documentationRFC 3849

IPv6 prefix sizes

IPv6 is planned in /64 LANs, so sizes are counted in networks, not hosts
PrefixContainsAddressesTypical use
/3265,536 /48s296Typical allocation from a registry to an ISP
/4865,536 /64s280One organisation or site
/56256 /64s272Common delegation to a home or small business
/6016 /64s268Smaller home delegation some ISPs use
/641 LAN264A single network segment; SLAAC requires exactly /64
/1272 addresses21Point-to-point link between routers (RFC 6164)
/1281 address20A single host or loopback

Related tools

Keep debugging with tools from the same suite
3 tools
Subnet Calculator
Calculate IP subnet ranges, network address, broadcast, subnet mask, wildcard mask and usable hosts from any CIDR notation
CIDR Aggregator
Merge a list of IPs, ranges and CIDR blocks into the fewest CIDRs, find duplicates and overlaps, and export nginx, Apache, iptables or nftables rules
WireGuard AllowedIPs Calculator
Route everything through WireGuard except your LAN, an IP or any subnet: subtracts CIDR ranges and returns the exact AllowedIPs line

Frequently asked questions

Quick answers about subnet masks
5 Q&A

255.255.255.0. It has 256 addresses, of which 254 can be given to hosts. Its wildcard mask is 0.0.0.255.

Count the 1-bits in the mask. Each 255 is 8 bits, and the octet table on this page gives the rest: 255.255.240.0 is 8 + 8 + 4 = /20.

2(32 − prefix) − 2, because the first address is the network and the last is the broadcast. The exceptions are /31, which has 2 usable addresses on point-to-point links, and /32, a single address.

The subnet mask inverted: every 255 becomes 0 and every 0 becomes 255. Cisco ACLs and OSPF use it. The wildcard for 255.255.255.0 is 0.0.0.255.

Stateless address autoconfiguration (SLAAC) builds each host’s address from a 64-bit interface identifier, so a LAN prefix must be exactly /64. Shorter prefixes are for grouping LANs, not for a single segment.