Subnet calculator cheatsheet: CIDR, masks, and host counts
A quick-reference for IPv4 subnet math — how to read a CIDR, what the mask actually means, and the easy way to count usable hosts.
If you've ever stared at 192.168.1.0/24 and tried to remember what the /24 actually means — this is for you. It's not magic, it's just bits.
Reading a CIDR
The number after the slash is the prefix length — the count of leading 1 bits in the subnet mask. So /24 means the first 24 bits are network, the last 8 are host.
192.168.1.0/24
└──────────────┘└┘
network host (8 bits = 256 addresses, 254 usable)The four addresses you can't use
For every subnet, two addresses are reserved: the network address (all host bits = 0) and the broadcast address (all host bits = 1). So a /24 has 256 addresses, but only 254 are usable for hosts.
The exception is /31 — RFC 3021 allows both addresses to be used (point-to-point links) and /32 (single host).
Masks you'll see every day
/8— 16,777,216 addresses. Class A territory./16— 65,536 addresses. Class B. The classic /16 you got at your first ISP./24— 256 addresses. The smallest "normal" subnet. One ethernet segment./25— 128 addresses. Half of a /24./26— 64 addresses. Often used to carve up a /24 into four pieces./27— 32 addresses./28— 16 addresses. A small office./30— 4 addresses, 2 usable. Point-to-point links (router-to-router)./32— 1 address. A single host (e.g. a route to a specific server).
Common arithmetic
Total addresses in a subnet = 2^(32 - prefix). Usable hosts = total − 2 (except /31, /32).
Network address: AND the IP and the mask bitwise.
Broadcast address: OR the network address with the inverted mask.
Don't want to do that in your head? Our Subnet Calculator does it for you, including the wildcard mask (the inverted mask, used in Cisco ACLs and OSPF network statements).
Keep reading
- What is my IP address, and why does it matter?Your public IP is the address the rest of the internet uses to talk to you. Here's what it reveals, what it doesn't, and how to check it.
- How to read an open port (and when to actually worry)An 'open port' isn't a vulnerability by itself — it's information. Here's how to tell whether a port being open is fine, suspicious, or actively dangerous, and what to do about each case.
- How to check DNS propagation (and how long it actually takes)Just changed an A record and your friend in another country still sees the old site? That's DNS propagation. Here's how to verify when it's actually done — and how long it can take.