Subnet cheat sheet: the CIDR chart

The formula, with a worked example

• Subnet mask = prefix ones followed by (32 − prefix) zeros, written as four octets.
• Wildcard mask = 255.255.255.255 minus the subnet mask, octet by octet.
• Total addresses = 2^(32 − prefix). Each step down in prefix length doubles it.
• Usable hosts = total − 2, except /31 (2 usable, RFC 3021) and /32 (1).
• Worked example: /26 has 6 host bits, so 2^6 = 64 addresses, 62 usable, mask 255.255.255.192, wildcard 0.0.0.63.

How to read the chart

Each row is one prefix length. The prefix is the number after the slash in CIDR notation, such as the 24 in 192.168.1.0/24, and it counts the network bits. The subnet mask column writes those bits as a dotted mask, the wildcard column flips them, the total column gives the size of the block and the usable column takes away the network and broadcast addresses.

The most common rows are /24 (255.255.255.0, 256 addresses, 254 usable), /16 (255.255.0.0, 65,536 addresses) and /8 (255.0.0.0, 16,777,216 addresses), which line up with whole octets. Between them sit the prefixes that split an octet, such as /20, /26 and /30, and those are the ones worth learning the patterns for.

The eight mask values

A mask is a run of ones then zeros, so inside any one octet the mask can only take nine values: 0, 128, 192, 224, 240, 248, 252, 254 and 255. Those come from adding the bit values 128, 64, 32, 16, 8, 4, 2 and 1 from the left. One network bit gives 128, two give 128 + 64 = 192, three give 224, and so on up to eight, which gives 255.

That is why the chart repeats itself every eight rows. /17, /25 and /9 all end their mask on 128 in a different octet; /18, /26 and /10 all end on 192. Learn the sequence 128, 192, 224, 240, 248, 252, 254, 255 once and you can write the mask for any prefix: fill whole octets with 255, then take the value from the sequence for the leftover bits.

Block sizes and the powers of two

Every step from one prefix to the next shorter one doubles the block. A /30 has 4 addresses, a /29 has 8, a /28 has 16, a /27 has 32, a /26 has 64, a /25 has 128 and a /24 has 256. Going the other way halves it. So the total for any prefix is 2 raised to the number of host bits, 32 minus the prefix.

In the octet where the mask stops being 255, the block size is 256 minus the mask value. For /26 the mask ends in 192, so the block size is 64 and the subnets start at .0, .64, .128 and .192. For /21 the mask is 255.255.248.0, so the block size in the third octet is 8 and the networks start at 0, 8, 16, 24 and so on in that octet.

Edge cases at both ends of the chart

The usable count is the total minus 2 for every prefix up to /30, which leaves 2 hosts. A /31 would leave none under that rule, so RFC 3021 lets both of its addresses be used on a point-to-point link and the chart shows 2. A /32 is one address on its own and shows 1.

At the top, /0 has a mask of 0.0.0.0 and covers all 4,294,967,296 IPv4 addresses. Prefixes from /1 to /7 are bigger than any normal allocation and appear mostly in routing tables, where they describe large slices of the whole address space.

Reading the wildcard column

The wildcard mask is the subnet mask with every bit flipped, so each octet of the wildcard is 255 minus the same octet of the mask. A /24 mask of 255.255.255.0 gives a wildcard of 0.0.0.255, and a /27 mask of 255.255.255.224 gives 0.0.0.31. The last octet of the wildcard is always one less than the block size in that octet, which makes it a quick check on the rest of the row.