Subnet mask cheat sheet & reference

This is the table you came for, followed by the few tricks that let you stop needing it. Each row lists a CIDR prefix, its dotted-decimal subnet mask, the Cisco wildcard mask (the inverse), the total number of addresses, and the usable host count after reserving the network and broadcast addresses.

Full reference: /8 to /32

* /31 gives two usable addresses on point-to-point links per RFC 3021; /32 is a single host route. Both skip the usual network/broadcast reservation.

How to read a mask

A subnet mask is always a solid run of 1 bits followed by a solid run of 0 bits. The ones mark network bits, the zeros mark host bits, and the CIDR number is just how many ones there are. Because the boundary can fall anywhere, only nine values ever appear in a mask octet:

bits added:   0    1    2    3    4    5    6    7    8
octet value:  0   128  192  224  240  248  252  254  255

Each step turns on one more bit from the left. If you see any other number (like 255.255.255.100), it is not a valid mask.

The magic-number trick

To find subnet boundaries without binary, take the mask's last non-zero octet and subtract it from 256. That "magic number" is the block size — subnets start at multiples of it.

/26 mask = 255.255.255.192   →   256 − 192 = 64
networks: .0  .64  .128  .192   (steps of 64)

/28 mask = 255.255.255.240   →   256 − 240 = 16
networks: .0 .16 .32 .48 .64 ... (steps of 16)

Given any host address, round it down to the nearest multiple of the magic number to get its network address; add the magic number and subtract one to get the broadcast.

Converting CIDR ↔ dotted-decimal in your head

• CIDR → mask: fill that many bits with ones. /20 = 8 + 8 + 4 bits → 255.255.240.0 (4 bits in the third octet = 240).
• Mask → CIDR: add up the bits. 255.255.255.248 = 8 + 8 + 8 + 5 = /29 (248 = 5 bits).
• Mask → wildcard: subtract each octet from 255. 255.255.255.0 → 0.0.0.255. Cisco ACLs use the wildcard, not the mask.