CIDR subnet sizes from /8 to /32
How many addresses does a /24 hold, and what does a /20 look like? The table below is computed by code, then a calculator lets you check any block.
Last reviewed 2026-10-21. Usable-host counts follow the classic rule (total minus network and broadcast), with /31 and /32 as special cases. The AWS column follows the reserved-address rule in the AWS documentation linked below.
Is an IP inside this block?
Split into smaller subnets
The idea in one line
A CIDR block is an address plus a prefix length: 10.0.0.0/24 means the first 24 of 32 bits are fixed and the last 8 bits are free, so the block holds 2^8 = 256 addresses. Each step down in prefix length doubles the block. RFC 4632 defines the notation and the way blocks aggregate.
Usable hosts are usually the block size minus two, because the first address names the network and the last is the broadcast address. A /31 has no room for that, and RFC 3021 allows both addresses of a /31 on a point-to-point link. A /32 is a single host route.
IPv4 prefix table
Find your prefix, read across. The mask and wildcard columns are what firewalls and older router syntax ask for.
| Prefix | Netmask | Wildcard | Addresses | Usable hosts | Usable in an AWS subnet |
|---|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 | not allowed |
| /9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 | not allowed |
| /10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 | not allowed |
| /11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 | not allowed |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 | not allowed |
| /13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 | not allowed |
| /14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 | not allowed |
| /15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 | not allowed |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 | 65,531 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 | 32,763 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 | 16,379 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 | 8,187 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 | 4,091 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 | 2,043 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 | 1,019 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 | 507 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 | 251 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 | 123 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 | 59 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 | 27 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 | 11 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 | not allowed |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 | not allowed |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 (point to point) | not allowed |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 (single host) | not allowed |
AWS reserves five addresses in every IPv4 subnet (the first four and the last), and allows subnet sizes from /28 to /16, so blocks larger than a /16 or smaller than a /28 are not valid subnets there.
Planning: how many subnets fit in a /16
A common plan is one /16 per network and /20 to /24 per subnet. Each extra bit of prefix halves the subnet size and doubles how many fit in the /16.
| Subnet size | Subnets in a /16 | Addresses each |
|---|---|---|
| /17 | 2 | 32,768 |
| /18 | 4 | 16,384 |
| /19 | 8 | 8,192 |
| /20 | 16 | 4,096 |
| /21 | 32 | 2,048 |
| /22 | 64 | 1,024 |
| /23 | 128 | 512 |
| /24 | 256 | 256 |
| /25 | 512 | 128 |
| /26 | 1024 | 64 |
| /27 | 2048 | 32 |
| /28 | 4096 | 16 |
Counts are 2 to the power of (prefix minus 16) and 2 to the power of (32 minus prefix).
Private ranges
RFC 1918 reserves three blocks for private networks. Pick VPC and office ranges that do not overlap, or you cannot peer or VPN them later without renumbering.
| Block | Range | Addresses |
|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 to 10.255.255.255 | 16,777,216 |
| 172.16.0.0/12 | 172.16.0.0 to 172.31.255.255 | 1,048,576 |
| 192.168.0.0/16 | 192.168.0.0 to 192.168.255.255 | 65,536 |
Source: RFC 1918, section 3.
Common mistakes
- Planning to the usable-host number and forgetting the cloud reservations: a /28 in AWS has 16 addresses and 11 you can use.
- Using a /24 for everything. It is easy to read, but a /24 spread across a few services wastes space, and a /16 of /24s is only 256 subnets.
- Overlapping ranges between environments. Choose distinct blocks per environment and region from day one.
- Treating the table as IPv6 guidance. IPv6 subnets are normally /64, and the host-count arithmetic here does not apply.
Frequently asked questions
How many hosts are in a /24?
A /24 holds 256 addresses and 254 usable hosts under the classic rule. In an AWS subnet, 251 are usable because AWS reserves five.
What is the difference between a netmask and a wildcard mask?
The wildcard is the bitwise inverse of the netmask. 255.255.255.0 and 0.0.0.255 describe the same /24. Access lists on some routers use the wildcard form.
Why is /31 usable on a link?
RFC 3021 allows a /31 on point-to-point links so both addresses can be assigned to the two ends, saving the network and broadcast addresses.
What size should my VPC be?
AWS lets a subnet be between /28 and /16. Choose a block that leaves room to add subnets, avoids overlap with other networks you may connect, and sits inside an RFC 1918 range.
Sources
- RFC 4632: Classless Inter-domain Routing (CIDR) checked 2026-10-21
- RFC 1918: Address Allocation for Private Internets checked 2026-10-21
- RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links checked 2026-10-21
- AWS VPC User Guide: Subnet CIDR blocks checked 2026-10-21