The whole chart on a single sheet — mask, wildcard, address and host counts, reserved ranges and a worked VLSM example. Branded, and built to survive being folded into a bag.
Need to work out a specific network rather than read a table? The subnet calculator takes any address with a prefix or mask, splits networks into VLSM tables, and identifies private, CGNAT and reserved space.
Highlighted rows are the ones that come up most — /8, /16 and /24 from classful habits, and /30, /31, /32 for links and host routes.
| CIDR | Subnet mask | Wildcard mask | Hex mask | Total addresses | Usable hosts | Equivalent |
|---|---|---|---|---|---|---|
| /0 | 0.0.0.0 | 255.255.255.255 | 0x00000000 | 4,294,967,296 | 4,294,967,294 | 16,777,216 × /24 |
| /1 | 128.0.0.0 | 127.255.255.255 | 0x80000000 | 2,147,483,648 | 2,147,483,646 | 8,388,608 × /24 |
| /2 | 192.0.0.0 | 63.255.255.255 | 0xC0000000 | 1,073,741,824 | 1,073,741,822 | 4,194,304 × /24 |
| /3 | 224.0.0.0 | 31.255.255.255 | 0xE0000000 | 536,870,912 | 536,870,910 | 2,097,152 × /24 |
| /4 | 240.0.0.0 | 15.255.255.255 | 0xF0000000 | 268,435,456 | 268,435,454 | 1,048,576 × /24 |
| /5 | 248.0.0.0 | 7.255.255.255 | 0xF8000000 | 134,217,728 | 134,217,726 | 524,288 × /24 |
| /6 | 252.0.0.0 | 3.255.255.255 | 0xFC000000 | 67,108,864 | 67,108,862 | 262,144 × /24 |
| /7 | 254.0.0.0 | 1.255.255.255 | 0xFE000000 | 33,554,432 | 33,554,430 | 131,072 × /24 |
| /8 | 255.0.0.0 | 0.255.255.255 | 0xFF000000 | 16,777,216 | 16,777,214 | 65,536 × /24 |
| /9 | 255.128.0.0 | 0.127.255.255 | 0xFF800000 | 8,388,608 | 8,388,606 | 32,768 × /24 |
| /10 | 255.192.0.0 | 0.63.255.255 | 0xFFC00000 | 4,194,304 | 4,194,302 | 16,384 × /24 |
| /11 | 255.224.0.0 | 0.31.255.255 | 0xFFE00000 | 2,097,152 | 2,097,150 | 8,192 × /24 |
| /12 | 255.240.0.0 | 0.15.255.255 | 0xFFF00000 | 1,048,576 | 1,048,574 | 4,096 × /24 |
| /13 | 255.248.0.0 | 0.7.255.255 | 0xFFF80000 | 524,288 | 524,286 | 2,048 × /24 |
| /14 | 255.252.0.0 | 0.3.255.255 | 0xFFFC0000 | 262,144 | 262,142 | 1,024 × /24 |
| /15 | 255.254.0.0 | 0.1.255.255 | 0xFFFE0000 | 131,072 | 131,070 | 512 × /24 |
| /16 | 255.255.0.0 | 0.0.255.255 | 0xFFFF0000 | 65,536 | 65,534 | 256 × /24 |
| /17 | 255.255.128.0 | 0.0.127.255 | 0xFFFF8000 | 32,768 | 32,766 | 128 × /24 |
| /18 | 255.255.192.0 | 0.0.63.255 | 0xFFFFC000 | 16,384 | 16,382 | 64 × /24 |
| /19 | 255.255.224.0 | 0.0.31.255 | 0xFFFFE000 | 8,192 | 8,190 | 32 × /24 |
| /20 | 255.255.240.0 | 0.0.15.255 | 0xFFFFF000 | 4,096 | 4,094 | 16 × /24 |
| /21 | 255.255.248.0 | 0.0.7.255 | 0xFFFFF800 | 2,048 | 2,046 | 8 × /24 |
| /22 | 255.255.252.0 | 0.0.3.255 | 0xFFFFFC00 | 1,024 | 1,022 | 4 × /24 |
| /23 | 255.255.254.0 | 0.0.1.255 | 0xFFFFFE00 | 512 | 510 | 2 × /24 |
| /24 | 255.255.255.0 | 0.0.0.255 | 0xFFFFFF00 | 256 | 254 | 1 × /24 |
| /25 | 255.255.255.128 | 0.0.0.127 | 0xFFFFFF80 | 128 | 126 | 1/2 of a /24 |
| /26 | 255.255.255.192 | 0.0.0.63 | 0xFFFFFFC0 | 64 | 62 | 1/4 of a /24 |
| /27 | 255.255.255.224 | 0.0.0.31 | 0xFFFFFFE0 | 32 | 30 | 1/8 of a /24 |
| /28 | 255.255.255.240 | 0.0.0.15 | 0xFFFFFFF0 | 16 | 14 | 1/16 of a /24 |
| /29 | 255.255.255.248 | 0.0.0.7 | 0xFFFFFFF8 | 8 | 6 | 1/32 of a /24 |
| /30 | 255.255.255.252 | 0.0.0.3 | 0xFFFFFFFC | 4 | 2 | 1/64 of a /24 |
| /31 | 255.255.255.254 | 0.0.0.1 | 0xFFFFFFFE | 2 | 2 | 1/128 of a /24 |
| /32 | 255.255.255.255 | 0.0.0.0 | 0xFFFFFFFF | 1 | 1 | 1/256 of a /24 |
Usable hosts subtracts the network and broadcast address, which is why a /24 gives 254 rather than 256. Two prefixes break that rule: a /31 has two usable addresses on point-to-point links under RFC 3021, and a /32 is a single host route. Plenty of calculators still report zero for both.
When an address is not behaving the way you expect, check it here before assuming a fault. Recognising 100.64.0.0/10 or 169.254.0.0/16 on sight saves a lot of time.
| Range | Purpose | RFC | Worth knowing |
|---|---|---|---|
| 0.0.0.0/8 | This network | RFC 1122 | 0.0.0.0 means "any" in a bind or default route |
| 10.0.0.0/8 | Private | RFC 1918 | 16,777,216 addresses — the big one |
| 100.64.0.0/10 | Carrier-grade NAT | RFC 6598 | Your ISP may use it; looks public, is not routable |
| 127.0.0.0/8 | Loopback | RFC 1122 | The whole /8, not just 127.0.0.1 |
| 169.254.0.0/16 | Link-local / APIPA | RFC 3927 | A host here failed to get DHCP |
| 172.16.0.0/12 | Private | RFC 1918 | 172.16.0.0 – 172.31.255.255 — note it stops at .31 |
| 192.0.0.0/24 | IETF protocol assignments | RFC 6890 | Includes DS-Lite and NAT64 discovery |
| 192.0.2.0/24 | Documentation (TEST-NET-1) | RFC 5737 | Safe for docs and examples |
| 192.168.0.0/16 | Private | RFC 1918 | The default on nearly every consumer router |
| 198.18.0.0/15 | Benchmarking | RFC 2544 | Device performance testing only |
| 198.51.100.0/24 | Documentation (TEST-NET-2) | RFC 5737 | Safe for docs and examples |
| 203.0.113.0/24 | Documentation (TEST-NET-3) | RFC 5737 | Safe for docs and examples |
| 224.0.0.0/4 | Multicast (class D) | RFC 5771 | 224.0.0.1 all-hosts, 224.0.0.2 all-routers |
| 240.0.0.0/4 | Reserved (class E) | RFC 1112 | Never allocated |
| 255.255.255.255/32 | Limited broadcast | RFC 919 | Never forwarded by a router |
Subnetting is this table plus subtraction.
| Power | Addresses | Prefix | Usable hosts |
|---|---|---|---|
| 20 | 1 | /32 | 1 |
| 21 | 2 | /31 | 2 |
| 22 | 4 | /30 | 2 |
| 23 | 8 | /29 | 6 |
| 24 | 16 | /28 | 14 |
| 25 | 32 | /27 | 30 |
| 26 | 64 | /26 | 62 |
| 27 | 128 | /25 | 126 |
| 28 | 256 | /24 | 254 |
| 29 | 512 | /23 | 510 |
| 210 | 1,024 | /22 | 1,022 |
| 211 | 2,048 | /21 | 2,046 |
| 212 | 4,096 | /20 | 4,094 |
| 213 | 8,192 | /19 | 8,190 |
| 214 | 16,384 | /18 | 16,382 |
| 215 | 32,768 | /17 | 32,766 |
| 216 | 65,536 | /16 | 65,534 |
A guide, not a rule. Reaching for /24 everywhere wastes space and makes broadcast domains bigger than they need to be — but the opposite mistake, sizing exactly to today's device count, is worse. Aim for roughly double what you need now.
| Prefix | Usable hosts | Typically fits |
|---|---|---|
| /29 | 6 | Point-to-point links, tiny closets, DMZ pairs |
| /28 | 14 | A small office — printers and APs on their own VLAN |
| /27 | 30 | Typical small-business user VLAN |
| /26 | 62 | A busy floor, or a camera VLAN at a small site |
| /25 | 126 | Mid-size user VLAN with room to grow |
| /24 | 254 | The default habit — often larger than needed |
| /23 | 510 | Large flat network; consider splitting instead |
| /22 | 1,022 | Site supernet to carve into VLANs |
A wildcard mask is the bitwise inverse of a subnet mask, and it is what Cisco ACLs and OSPF network statements expect. Where a subnet mask has 1s, a wildcard has 0s.
255.255.255.0 (/24) → 0.0.0.255255.255.255.192 (/26) → 0.0.0.63255.255.0.0 (/16) → 0.0.255.255255.255.255.255 (/32) → 0.0.0.0 — a single hostWriting a subnet mask where a wildcard belongs produces an ACL that matches nothing and logs nothing. One of the quieter ways to lose an afternoon.
Subnet on nibble boundaries. Prefixes on /4 steps — /20, /24, /28 — line up with hex digits, which keeps the arithmetic doable in your head and the plan readable by whoever is on call at 2 a.m.
Write the plan down. The expensive addressing problems are rarely calculation errors. They are two people independently assigning 10.0.5.0/24 eighteen months apart. A one-page document beats a perfect subnet calculation.
Calculating one subnet is arithmetic. Laying out addressing, VLANs, routing and wireless for an actual building is network design, and we do it on site across Central Oregon.
We do managed IT, networking and security for businesses across Central Oregon.
Managed IT Services Call 541-508-8797