Subnet mask cheat sheet: every prefix from /8 to /32
Every row below is computed, not typed. Masks, wildcards, block sizes and host counts are generated from the prefix at build time, so there are no transcription errors — which is the usual failing of cheat sheets you find online. Scroll to the table, or read the two shortcuts underneath it and stop needing the table at all.
The full table
Usable is what you can assign to interfaces. Block size is the spacing between consecutive subnets in the final octet — the number you count in when working out which subnet an address falls into.
| Prefix | Subnet mask | Wildcard mask | Addresses | Usable | Block |
|---|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 1,67,77,216 | 1,67,77,214 | — |
| /9 | 255.128.0.0 | 0.127.255.255 | 83,88,608 | 83,88,606 | — |
| /10 | 255.192.0.0 | 0.63.255.255 | 41,94,304 | 41,94,302 | — |
| /11 | 255.224.0.0 | 0.31.255.255 | 20,97,152 | 20,97,150 | — |
| /12 | 255.240.0.0 | 0.15.255.255 | 10,48,576 | 10,48,574 | — |
| /13 | 255.248.0.0 | 0.7.255.255 | 5,24,288 | 5,24,286 | — |
| /14 | 255.252.0.0 | 0.3.255.255 | 2,62,144 | 2,62,142 | — |
| /15 | 255.254.0.0 | 0.1.255.255 | 1,31,072 | 1,31,070 | — |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 | — |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 | — |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 | — |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 | — |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 | — |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 | — |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 | — |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 | — |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 | — |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 | 128 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 | 64 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 | 32 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 | 16 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 | 8 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 | 4 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 | 1 |
Highlighted rows are the range CCNA 200-301 concentrates on. /31 shows 2 usable under RFC 3021, which permits both addresses on point-to-point links; /32 is a single host, as used by loopbacks and single-address ACL matches.
Two shortcuts that replace the table
A cheat sheet is fine until you are in an exam without one. Both of these are quicker than looking up a row once you have used them a few times.
1. Mask octet = 256 − block size
A /27 has 5 host bits, so the block size is 25 = 32. Then 256 − 32 = 224, giving 255.255.255.224. Works for every prefix, in any octet.
2. Count in block sizes to find the subnet
Which subnet holds 172.16.4.100/27? Block size 32, so subnets begin at 0, 32, 64, 96, 128. Stop before passing 100 — the subnet is 172.16.4.96/27, broadcast .127, usable .97 to .126. No binary needed.
Subnet mask or wildcard mask?
They are inverses — subtract each octet from 255 — but IOS is fussy about which one a command expects, and mixing them up is one of the most common lab errors:
! Interface addressing — SUBNET mask
R1(config-if)# ip address 172.16.4.97 255.255.255.224
! ACL matching — WILDCARD mask
R1(config)# access-list 10 permit 172.16.4.96 0.0.0.31
! OSPF network statement — WILDCARD mask
R1(config-router)# network 172.16.4.96 0.0.0.31 area 0Same subnet, three commands, two mask formats. If a permit statement silently matches nothing, check this first — a subnet mask where a wildcard belongs is almost always the cause. There is more on the inverted form in wildcard masks explained.
Frequently asked
What is the subnet mask for /26?
A /26 is 255.255.255.192. It leaves 6 host bits, giving 64 addresses per subnet of which 62 are usable, and subnets fall on boundaries of 64: .0, .64, .128 and .192. The wildcard mask, which is what an ACL or an OSPF network statement expects, is 0.0.0.63.
How do I convert a prefix to a subnet mask without looking it up?
Work out the block size first: it is 2 raised to the number of host bits, which is 32 minus the prefix. Then the interesting mask octet is 256 minus the block size. For a /27 there are 5 host bits, so the block size is 32, and 256 minus 32 is 224 — giving 255.255.255.224. Every octet to the left of the interesting one is 255 and every octet to the right is 0.
What is a wildcard mask and how does it relate to a subnet mask?
A wildcard mask is the subnet mask inverted — subtract each octet from 255. A /24 mask of 255.255.255.0 becomes a wildcard of 0.0.0.255. In a wildcard, a zero bit means the corresponding address bit must match exactly and a one bit means ignore it. Cisco ACLs and OSPF network statements take wildcard masks, while interface configuration takes subnet masks, which is why the two get confused.
Why do you subtract 2 from the number of addresses?
Because two addresses in every ordinary subnet are reserved. The first, where all host bits are zero, is the network identifier itself. The last, where all host bits are one, is the directed broadcast address. Neither can be assigned to an interface. The exceptions are /31, where RFC 3021 permits both addresses to be used on point-to-point links, and /32, which describes a single host such as a loopback.
Which subnet masks does CCNA 200-301 actually test?
The exam concentrates on /24 through /30, because those are what appear on real LANs, departmental segments and point-to-point WAN links. You are expected to identify the subnet an address belongs to, its broadcast address and its usable range, quickly and without a calculator. Prefixes shorter than /16 appear mostly in summarisation and route-aggregation questions rather than host-addressing ones.
If the table still feels like magic, read CIDR notation explained for where the numbers come from, then drill it with CCNA subnetting practice and IP addressing and subnetting.