CIDR Cheat Sheet & Core Concepts
Essential rules for cloud engineers, network architects, and exam candidates.
Every IPv4 address consists of 32 bits. The CIDR prefix length (e.g., /24) denotes how many network bits are locked. The remaining bits determine total host count.
Standard networks reserve 2 IP addresses (Network Address and Broadcast Address). AWS VPCs reserve 5 IP addresses per subnet (Network, VPC Router, DNS, Future Use, and Broadcast).
The table uses 10.0.0.0 as the example network for every prefix, so the broadcast address is calculated for that specific block. The IPv4 multicast range is 224.0.0.0/4; multicast is a separate address range, not a special address repeated inside every subnet. None of the example 10.0.0.0/p blocks are multicast.
| CIDR Prefix | Subnet Mask | Total IPs | Usable Hosts (Standard) | Broadcast IP (10.0.0.0/p) | IPv4 Multicast Range | AWS Reserved IPs (first 4 + last) |
|---|---|---|---|---|---|---|
| /32 | 255.255.255.255 | 1 | 1 | 10.0.0.0 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /31 | 255.255.255.254 | 2 | 2 | 10.0.0.1 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /30 | 255.255.255.252 | 4 | 2 | 10.0.0.3 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /29 | 255.255.255.248 | 8 | 6 | 10.0.0.7 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /28 | 255.255.255.240 | 16 | 14 | 10.0.0.15 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.0.15 |
| /27 | 255.255.255.224 | 32 | 30 | 10.0.0.31 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.0.31 |
| /26 | 255.255.255.192 | 64 | 62 | 10.0.0.63 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.0.63 |
| /25 | 255.255.255.128 | 128 | 126 | 10.0.0.127 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.0.127 |
| /24 | 255.255.255.0 | 256 | 254 | 10.0.0.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.0.255 |
| /23 | 255.255.254.0 | 512 | 510 | 10.0.1.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.1.255 |
| /22 | 255.255.252.0 | 1,024 | 1,022 | 10.0.3.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.3.255 |
| /21 | 255.255.248.0 | 2,048 | 2,046 | 10.0.7.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.7.255 |
| /20 | 255.255.240.0 | 4,096 | 4,094 | 10.0.15.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.15.255 |
| /19 | 255.255.224.0 | 8,192 | 8,190 | 10.0.31.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.31.255 |
| /18 | 255.255.192.0 | 16,384 | 16,382 | 10.0.63.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.63.255 |
| /17 | 255.255.128.0 | 32,768 | 32,766 | 10.0.127.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.127.255 |
| /16 | 255.255.0.0 | 65,536 | 65,534 | 10.0.255.255 | 224.0.0.0/4 | Network: 10.0.0.0Router: 10.0.0.1DNS: 10.0.0.2Future: 10.0.0.3Broadcast: 10.0.255.255 |
| /15 | 255.254.0.0 | 131,072 | 131,070 | 10.1.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /14 | 255.252.0.0 | 262,144 | 262,142 | 10.3.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /13 | 255.248.0.0 | 524,288 | 524,286 | 10.7.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /12 | 255.240.0.0 | 1,048,576 | 1,048,574 | 10.15.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /11 | 255.224.0.0 | 2,097,152 | 2,097,150 | 10.31.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /10 | 255.192.0.0 | 4,194,304 | 4,194,302 | 10.63.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /9 | 255.128.0.0 | 8,388,608 | 8,388,606 | 10.127.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | 10.255.255.255 | 224.0.0.0/4 | Not an AWS VPC subnet size |
How to calculate a subnet
An IPv4 address has 32 bits. In /p, the prefix length p is the number of network bits; the remaining 32 - p bits identify addresses within the block. Therefore, Total IPs = 2^(32 - p). The subnet mask is made from p leading 1 bits followed by zero bits. The network address is the first address in the aligned block, and the broadcast address is the last.
Usable hosts and special prefixes
For most traditional IPv4 subnets, usable hosts = total addresses minus two (the network and broadcast addresses). A /31 is a point-to-point link and can use both addresses under RFC 3021, while a /32 identifies one host address. Real broadcast addresses depend on the subnet’s network address; the table uses the aligned 10.0.0.0/p examples to make them concrete.
AWS VPC reservations and multicast
AWS IPv4 VPC subnets support prefixes from /16 to /28. AWS reserves the first four addresses and the final address in each subnet: network, VPC router, DNS, future use, and broadcast, respectively. For example, in 10.0.0.0/28, 10.0.0.0 is the network address, 10.0.0.1 the router, 10.0.0.2 DNS, 10.0.0.3 future use, and 10.0.0.15 the last (broadcast) address. That leaves Total IPs - 5 addresses available; the rows outside /16–/28are included for general subnetting reference and are not valid AWS subnet sizes. IPv4 multicast uses 224.0.0.0 through239.255.255.255 (224.0.0.0/4). It is a group-address range, not a per-subnet reserved IP, and is distinct from subnet-directed broadcast.
To apply this in a network design, choose a prefix that gives each subnet enough addresses for its devices and growth, then calculate the aligned network and last address from the actual base IP. Keep the network and broadcast addresses out of ordinary host assignments; for AWS, also keep all five AWS-reserved addresses out of your usable capacity estimate. Use the calculator above to try prefixes and compare standard and AWS host counts before allocating address space.