A quick reference for IPv4 subnet masks and prefix lengths. Useful when configuring an address on a server — see How to add an additional IP address on Linux — or when working out how many addresses a block contains.
Prefix lengths and masks
Usable hosts are two fewer than the total addresses in a block: one address is the network address and one is the broadcast address.
| Prefix | Addresses | Usable hosts | Netmask | In /24 blocks |
|---|---|---|---|---|
| /32 | 1 | 1 | 255.255.255.255 | single host |
| /31 | 2 | 2 | 255.255.255.254 | point-to-point |
| /30 | 4 | 2 | 255.255.255.252 | 1/64 |
| /29 | 8 | 6 | 255.255.255.248 | 1/32 |
| /28 | 16 | 14 | 255.255.255.240 | 1/16 |
| /27 | 32 | 30 | 255.255.255.224 | 1/8 |
| /26 | 64 | 62 | 255.255.255.192 | 1/4 |
| /25 | 128 | 126 | 255.255.255.128 | 1/2 |
| /24 | 256 | 254 | 255.255.255.0 | 1 |
| /23 | 512 | 510 | 255.255.254.0 | 2 |
| /22 | 1024 | 1022 | 255.255.252.0 | 4 |
| /21 | 2048 | 2046 | 255.255.248.0 | 8 |
| /20 | 4096 | 4094 | 255.255.240.0 | 16 |
| /19 | 8192 | 8190 | 255.255.224.0 | 32 |
| /18 | 16384 | 16382 | 255.255.192.0 | 64 |
| /17 | 32768 | 32766 | 255.255.128.0 | 128 |
| /16 | 65536 | 65534 | 255.255.0.0 | 256 |
/32 denotes a single address and is what you use for a firewall rule covering one host. /31 is used for point-to-point links, where both addresses are usable.
Sub-blocks within a /24
Where a /24 is divided, the block boundaries fall on multiples of the block size. The pattern for the common cases:
| Prefix | Blocks | First block | Second block | Boundaries at |
|---|---|---|---|---|
| /25 | 2 | .1–.126, bcast .127 | .129–.254, bcast .255 | every 128 |
| /26 | 4 | .1–.62, bcast .63 | .65–.126, bcast .127 | every 64 |
| /27 | 8 | .1–.30, bcast .31 | .33–.62, bcast .63 | every 32 |
| /28 | 16 | .1–.14, bcast .15 | .17–.30, bcast .31 | every 16 |
| /29 | 32 | .1–.6, bcast .7 | .9–.14, bcast .15 | every 8 |
| /30 | 64 | .1–.2, bcast .3 | .5–.6, bcast .7 | every 4 |
In each case the network address is the boundary itself and the broadcast address is the one before the next boundary.
Working it out on the server
Rather than calculating by hand, ask the system:
ipcalc 192.0.2.10/27
Most distributions provide ipcalc or sipcalc, which print the network address, broadcast address and usable range for any block.
Note on your own server
Use the netmask given in your server's details rather than assuming /24. Configuring the wrong netmask produces a server that reaches some addresses and not others — which is more confusing to diagnose than one with no network at all.
See RFC 4632 for the CIDR specification.
