The /28 prefix means the first 28 bits of the address identify the network and the remaining 4 identify the host. Written out, the mask is 255.255.255.240, in binary 11111111.11111111.11111111.11110000, and its Cisco wildcard or inverse form is 0.0.0.15. It covers 16 addresses, of which 14 can be given to hosts.
| CIDR prefix | /28 |
|---|---|
| Subnet mask | 255.255.255.240 |
| Mask in binary | 11111111.11111111.11111111.11110000 |
| Wildcard (inverse) mask | 0.0.0.15 |
| Host bits | 4 |
| Total addresses | 16 |
| Usable hosts | 14 |
| Block size (magic number) | 16 in octet 4 |
A 192.168.1.0/24 contains 16 subnets of /28. Here are the first 8, which is enough to see the pattern: each one starts 16 after the last in octet 4.
| Network | First host | Last host | Broadcast |
|---|---|---|---|
| 192.168.1.0/28 | 192.168.1.1 | 192.168.1.14 | 192.168.1.15 |
| 192.168.1.16/28 | 192.168.1.17 | 192.168.1.30 | 192.168.1.31 |
| 192.168.1.32/28 | 192.168.1.33 | 192.168.1.46 | 192.168.1.47 |
| 192.168.1.48/28 | 192.168.1.49 | 192.168.1.62 | 192.168.1.63 |
| 192.168.1.64/28 | 192.168.1.65 | 192.168.1.78 | 192.168.1.79 |
| 192.168.1.80/28 | 192.168.1.81 | 192.168.1.94 | 192.168.1.95 |
| 192.168.1.96/28 | 192.168.1.97 | 192.168.1.110 | 192.168.1.111 |
| 192.168.1.112/28 | 192.168.1.113 | 192.168.1.126 | 192.168.1.127 |
Take the interesting octet of the mask, the one that is neither 255 nor 0. For /28 that is 240 in octet 4. Subtract it from 256:
256 - 240 = 16
That is the block size. Every /28 network address is a multiple of 16 in octet 4, so you can list them by counting: 0, 16, 32, 48, and so on. No binary needed once you know the number.
A /28 gives 14 usable addresses. This is the block an ISP hands a business customer who asked for "some static IPs", and the usual size of a DMZ holding a handful of public-facing servers.
A /28 holds 16 addresses in total. After reserving the network and broadcast addresses, 14 are usable by hosts.
The /28 subnet mask is 255.255.255.240 in dotted-decimal notation.
The wildcard mask, also called the inverse mask, is 0.0.0.15. It is the bitwise inverse of 255.255.255.240 and is what Cisco access lists and OSPF network statements expect.
The /28 mask written out bit by bit is 11111111.11111111.11111111.11110000: 28 ones followed by 4 zeros.
A /24 splits into 16 subnets of /28.