CIDR prefix lengths

Every IPv4 prefix length, its mask and how many hosts it holds. Use the subnet calculator to work out a specific network's range.

Got a subnet mask instead? Every mask with its prefix, host count and wildcard — 255.255.255.0 is /24.

Reading a prefix length

An IPv4 address is 32 bits. The prefix says how many of the leading bits identify the network; whatever is left identifies a host inside it. The counter-intuitive part is that a smaller number means a larger network, because fewer network bits leaves more host bits. A /16 is 256 times the size of a /24.

Every step of one bit doubles or halves the network, which is why subnet sizes are always powers of two. There is no way to allocate a network of exactly 300 addresses: you take a /23, which holds 512, and leave the remainder unused.

The two lost addresses

In any subnet of /30 or larger, two addresses cannot be assigned to a machine. The lowest — all host bits zero — is the network address and names the subnet itself. The highest — all host bits one — is the broadcast address. A /24 therefore holds 256 addresses but only 254 hosts.

The waste is negligible at /16 and severe at /30, where half the block is lost. That is exactly why /31 exists: RFC 3021 removes the broadcast address on point-to-point links, making both addresses usable and halving the waste on router-to-router connections.

The sizes you will actually meet

Working out a mask without a calculator

Only nine values can appear in an octet of a subnet mask, because each is a run of leading ones:

Divide the prefix by 8 to get the number of complete 255 octets, and the remainder picks the next octet from this table. A /26 is three complete octets and a remainder of 2, giving 255.255.255.192. If a mask contains any other number, it is wrong.

Where a subnet is allowed to start

A prefix does not just set a size, it sets the boundaries. A /26 is 64 addresses, and the only valid /26 networks inside a /24 begin at .0, .64, .128 and .192 — a subnet must start on a multiple of its own size. 192.168.1.100/26 is not a network; it is a host inside the network that starts at .64.

That is the whole reason "the address is not on a network boundary" errors happen, and the check is arithmetic: divide the last octet by the block size and the remainder must be zero. It is also why the block size, rather than the prefix, is the number worth thinking in — /26 tells you little, 64 tells you where the edges are.

The private ranges, and why there are three

RFC 1918 reserves three blocks that no router on the public internet will forward:

The middle one is the trap. 172.16.0.0/12 covers 172.16 through 172.31, not 172.16 through 172.16 — so 172.20.x.x is private and 172.32.x.x is not, and a firewall rule written for /16 leaves fifteen sixteenths of the range treated as public.

169.254.0.0/16 is a fourth block worth recognising even though it is not RFC 1918: an address in it means DHCP failed and the machine assigned itself one. It never indicates a working network.