IPv4 CIDR cheat sheet
| CIDR | Subnet mask | Addresses | Usable hosts |
|---|---|---|---|
/8 |
255.0.0.0 |
16,777,216 | 16,777,214 |
/12 |
255.240.0.0 |
1,048,576 | 1,048,574 |
/16 |
255.255.0.0 |
65,536 | 65,534 |
/20 |
255.255.240.0 |
4,096 | 4,094 |
/22 |
255.255.252.0 |
1,024 | 1,022 |
/23 |
255.255.254.0 |
512 | 510 |
/24 |
255.255.255.0 |
256 | 254 |
/25 |
255.255.255.128 |
128 | 126 |
/26 |
255.255.255.192 |
64 | 62 |
/27 |
255.255.255.224 |
32 | 30 |
/28 |
255.255.255.240 |
16 | 14 |
/29 |
255.255.255.248 |
8 | 6 |
/30 |
255.255.255.252 |
4 | 2 |
/31 |
255.255.255.254 |
2 | 2 |
/32 |
255.255.255.255 |
1 | 1 |
How CIDR notation works
An IPv4 address is 32 bits. CIDR (Classless Inter-Domain Routing) notation writes an address plus how many of
those bits belong to the network. For 192.168.10.77/26:
- The mask has 26 one-bits:
255.255.255.192. - ANDing the address with the mask gives the network address:
192.168.10.64. - Setting the remaining 6 host bits to 1 gives the broadcast address:
192.168.10.127. - Everything in between is usable:
192.168.10.65to192.168.10.126, which is 62 hosts.
Planning subnets for a cloud VPC
-
Start big: give the VPC a large private block such as
10.0.0.0/16(65,536 addresses). You can't easily grow it later. -
Split evenly: carve it into
/20or/24subnets per availability zone and tier (public, private, database) with the Split into subnets tool above. -
Avoid overlaps: don't reuse ranges that you may need to peer with other VPCs, on-premises
networks or a VPN.
192.168.0.0/16clashes with many home routers. - Kubernetes needs room: pod and service CIDRs must not overlap the node network, and CNIs that give each pod a VPC IP use up addresses quickly.
IPv6 prefixes
IPv6 addresses are 128 bits. Providers typically assign a /48 or /56 to a site, and
each LAN gets a /64. That's 18 quintillion addresses per subnet, so you count subnets rather than
hosts. The calculator shows compressed and fully expanded forms and recognizes link-local, unique local,
documentation and multicast ranges.
Frequently asked questions
What does /24 mean in an IP address?
The number after the slash is the prefix length: how many leading bits identify the network. /24 means the first 24 bits (the first three numbers in 192.168.1.0/24) are the network, leaving 8 bits for hosts. That is 256 addresses, 254 of them usable for hosts.
How many usable hosts are in a subnet?
Usable hosts = 2^(32 − prefix) − 2, because the first address is the network address and the last is the broadcast address. A /24 has 254 usable hosts, a /26 has 62. The exceptions are /31, which has 2 usable addresses for point-to-point links (RFC 3021), and /32, a single host.
Why does AWS say my /24 subnet only has 251 IPs?
AWS reserves five addresses in every VPC subnet: the network address, the next three (for the VPC router, DNS and future use), and the last address. Azure also reserves five. Plan cloud subnets with that overhead in mind.
What are the private IP address ranges?
RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0–172.31.255.255) and 192.168.0.0/16 for private networks. 100.64.0.0/10 is reserved for carrier-grade NAT. For IPv6, the private equivalent is unique local addresses in fc00::/7, usually fd00::/8.
What is a wildcard mask?
A wildcard mask is the inverse of the subnet mask: 0.0.0.255 for a /24. Cisco ACLs and OSPF configuration use it to match address ranges.