How to Read a CIDR Prefix at a Glance

Someone asks for a subnet that will hold 300 hosts. A /24 gives 254, which is not enough. A /23 gives 510, which is.

Getting from “300 hosts” to “/23” is a lookup, and doing it as arithmetic in a meeting is how people end up ordering a /24 and discovering the problem after the addressing plan is deployed.

What a prefix actually says

A CIDR prefix is the number of leading bits that identify the network. Everything after them addresses hosts.

A /24 means the first 24 bits are the network, leaving 8 bits for hosts. Eight bits gives 256 combinations, so a /24 contains 256 addresses.

total addresses = 2^(32 − prefix)

Each step down the prefix doubles the size. /25 is 128 addresses, /24 is 256, /23 is 512, /22 is 1,024. That doubling is the whole structure, and it is why subnets come in the sizes they do rather than whatever size you wanted.

Why two addresses are unusable

The all-zeros host address identifies the network itself. The all-ones address is the broadcast address for that network. Neither can be assigned to a host.

So usable hosts is always two fewer than total addresses, and that is why a /24 gives 254 rather than 256, and why a /30 — the standard for a point-to-point link between two routers — gives exactly the two addresses those routers need.

The subtraction gets forgotten most often at the boundaries. A /24 for 256 devices is short by two, and finding that out during deployment is a bad afternoon.

Wildcard masks are the inverse

Some network equipment — Cisco access control lists in particular — uses a wildcard mask, which is the bitwise inverse of the subnet mask.

A /24’s subnet mask is 255.255.255.0. Its wildcard mask is 0.0.0.255.

The convention exists for historical reasons and it is a reliable source of confusion, because the two look similar and mean opposite things. In a wildcard mask, a zero bit means “must match” and a one bit means “ignore”.

IPv6 works differently

Almost none of this transfers.

IPv6 has no broadcast address, so the minus-two rule does not apply. Subnets are conventionally /64 regardless of how many hosts they hold, because stateless address autoconfiguration depends on that boundary.

That means IPv6 subnetting is not about fitting hosts into the smallest adequate subnet. A /64 holds an absurd number of addresses and you use one anyway. The planning question becomes how many /64s a site needs, not how large each should be.

Plan for summarisation

An addressing decision that only pays off later, and cannot be retrofitted cheaply.

Routing tables stay small when contiguous subnets can be advertised as a single larger prefix. Four adjacent /24s aligned on a /22 boundary summarise into one route; the same four scattered across the address space cannot.

That means allocating subnets in aligned, contiguous blocks per site or per function rather than assigning the next free one each time. It costs nothing at design time and it is the difference between a routing table with dozens of entries and one with hundreds.

It also makes access control lists shorter and more readable, since a rule covering a whole site is one line rather than one per subnet.

Common mistakes to avoid

• Forgetting the minus two, particularly when sizing exactly to a device count.
• Sizing with no headroom, so any growth needs renumbering.
• Confusing a wildcard mask with a subnet mask on equipment that uses both.
• Applying IPv4 subnetting habits to IPv6, where /64 is the near-universal answer.
• Choosing a subnet size in isolation rather than as part of an addressing plan that can be summarised in routing.

How to do it with Subnet Mask Cheat Sheet

The Subnet Mask Cheat Sheet is a lookup rather than a calculator.

1. Find the prefix you have, or the host count you need.
2. Read across for the mask, wildcard mask and usable hosts.
3. Add headroom — size for growth rather than for today’s device count.
4. Remember the minus two when the requirement is close to a boundary.

Other network tools are in the tools directory.

Frequently asked questions

Why are two addresses unusable?

The all-zeros address identifies the network and the all-ones address is the broadcast address. Neither can be assigned, which is why a /24 gives 254 usable hosts rather than 256.

What is a wildcard mask?

The bitwise inverse of a subnet mask, used in access control lists on some equipment. A /24’s mask of 255.255.255.0 has a wildcard of 0.0.0.255, and the two mean opposite things bit by bit.

Does the minus two apply to IPv6?

No. IPv6 has no broadcast address, and subnets are conventionally /64 regardless of host count. Most IPv4 subnetting arithmetic simply does not carry over.

Final thought

Size for growth and remember the minus two. A subnet that fits exactly today is a renumbering project next year.

Try the free Subnet Mask Cheat Sheet