subnethistory.

IPv4 subnet cheat sheet: CIDR sizes, masks and special ranges

3 min read ·

The three tables everyone in this business keeps re-deriving: every prefix length from /8 to /30 with its address count and mask, the reserved ranges that explain the odd addresses in your logs, and the ASN ranges that are never real networks. Bookmark it, and when a number needs more than a table row, the linked explainers pick up from here.

Each longer prefix is half the address space of the one before it, from /21 down to the /24 /21 · 2,048 /22 · 1,024 /23 · 512 /24 · 256
The whole notation in one picture: each bit added to the prefix halves the space. The /24 is solid because it is the row that matters most, the smallest block the routing system carries on its own.

The CIDR table, /8 to /30

The rule behind the whole table: the slash number counts fixed bits out of 32, and every remaining bit doubles the addresses. Notes are left n/a where a size has no special story; the sizes essay covers what the market-relevant rows mean in practice.

Prefix length, address count, and the equivalent subnet mask
PrefixAddressesMaskNotes
/816,777,216255.0.0.0One of the 256 top level blocks; institutions and legacy giants
/98,388,608255.128.0.0n/a
/104,194,304255.192.0.0The size of the CGNAT shared space 100.64.0.0/10
/112,097,152255.224.0.0n/a
/121,048,576255.240.0.0The size of the RFC 1918 172.16.0.0 private range
/13524,288255.248.0.0n/a
/14262,144255.252.0.0n/a
/15131,072255.254.0.0n/a
/1665,536255.255.0.0An institution; 256 /24s
/1732,768255.255.128.0n/a
/1816,384255.255.192.0n/a
/198,192255.255.224.0n/a
/204,096255.255.240.0Serious infrastructure; 16 /24s
/212,048255.255.248.0n/a
/221,024255.255.252.0Common hosting working size; 4 /24s
/23512255.255.254.0n/a
/24256255.255.255.0The atom: the smallest block routed and traded on its own
/25128255.255.255.128Below the routing threshold; internal use only from here down
/2664255.255.255.192n/a
/2732255.255.255.224n/a
/2816255.255.255.240n/a
/298255.255.255.248A common small hosting assignment; 6 usable hosts on a LAN
/304255.255.255.252Point to point links; 2 usable hosts

Reading the counts honestly

The counts are arithmetic totals. Used as a flat LAN, each subnet loses its first and last address to network and broadcast, which is why a /29 is listed as 6 usable and a /30 as 2. A gateway then takes one of those, so a /29 leaves 5 for hosts; on a /30 point-to-point link the 2 usable addresses are simply the two router interfaces. Used as a routed pool for services, nearly the whole count can work. The distinction matters when comparing per-address prices, and the sizing essay walks through it.

Special-use IPv4 ranges

These ranges have no registry holder and no public routing history, by design. Seeing one as a source on the open internet means something is leaking or spoofed, not that you found the user.

The reserved ranges that explain odd log entries
RangeWhat it isDefined by
0.0.0.0/8"This network"; unspecified sourceRFC 791
10.0.0.0/8Private spaceRFC 1918
100.64.0.0/10Shared space for carrier NATRFC 6598
127.0.0.0/8LoopbackRFC 1122
169.254.0.0/16Link-local (self-assigned)RFC 3927
172.16.0.0/12Private spaceRFC 1918
192.0.2.0/24Documentation (TEST-NET-1)RFC 5737
192.168.0.0/16Private spaceRFC 1918
198.18.0.0/15BenchmarkingRFC 2544
198.51.100.0/24Documentation (TEST-NET-2)RFC 5737
203.0.113.0/24Documentation (TEST-NET-3)RFC 5737
224.0.0.0/4MulticastRFC 5771
240.0.0.0/4Reserved for future useRFC 1112
255.255.255.255/32Limited broadcastRFC 919

ASN ranges worth recognising

The same idea applies to AS numbers: some ranges are never real networks, and recognising them saves chasing a ghost.

AS number ranges that are not public networks
RangeWhat it isDefined by
0Reserved; must not originate routesRFC 7607
23456AS_TRANS, the 16-bit stand-in for 32-bit ASNsRFC 6793
64496 to 64511DocumentationRFC 5398
64512 to 65534Private useRFC 6996
65535ReservedRFC 7300
65536 to 65551Documentation (32-bit examples)RFC 5398
4200000000 to 4294967294Private use (32-bit)RFC 6996
4294967295ReservedRFC 7300

When a row is not enough

A table can tell you what a number is; it cannot tell you what the space behind it has been. When the question is a real block or a real network rather than a size, look it up: a reserved range answers instantly with its RFC story, and everything else answers with its registration, routing and dated reputation history. The cheat sheet is for the numbers that never change; the search box is for the ones that do.

Any address, prefix or AS number in these tables can be typed straight into the front page. Reserved space explains itself; everything else comes back with its history, dated and sourced.