Subnet prefix cheatsheet
A /24 is mask 255.255.255.0, wildcard 0.0.0.255, 256 addresses and 254 usable hosts: pick a range of prefix lengths and get one row per prefix, ready for exams, access lists and runbooks. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Prefix from
- 24
- Prefix to
- 30
- Row count
- 7
IPv4 subnetting still starts from a prefix length: a slash-24 is not a guess, it is the mask 255.255.255.0, an eight-bit host field, two hundred fifty-six addresses, and two hundred fifty-four usable hosts once the network and broadcast addresses are reserved. Students, CCNA candidates, firewall operators, and ACL authors look up that mapping dozens of times a day and should not recompute powers of two on a whiteboard. Each row lists the dotted subnet mask, the inverted wildcard mask used by Cisco-style access lists, the total address count two to the power of host bits, and the usable host count with the modern slash-31 point-to-point and slash-32 host-route conventions.
How prefix length becomes mask, wildcard, and host counts
An IPv4 address is a thirty-two-bit string. Writing a prefix length n next to that address is a contract: the first n bits name the network and the remaining thirty-two minus n bits name hosts inside that network. The subnet mask is simply those n ones followed by thirty-two minus n zeros, printed as four decimal octets.
Slash-24 therefore becomes 255.255.255.0, slash-16 becomes 255.255.0.0, slash-8 becomes 255.0.0.0, and slash-0 becomes 0.0.0.0. The wildcard mask is the bitwise complement of the subnet mask and is the form Cisco IOS access lists, some OSPF network statements, and a surprising number of exam questions still demand: slash-24 becomes 0.0.0.255 and slash-16 becomes 0.0.255.255. Total addresses in the block equal two raised to the host-bit count.
For every prefix from slash-0 through slash-30 the classroom rule then subtracts two reserved addresses—the all-zeros network identifier and the all-ones broadcast—to obtain the usable host count. Slash-31 is the RFC 3021 point-to-point exception: both addresses are usable and there is no broadcast. Slash-32 is a host route that contains a single address.
Where a subnet prefix cheatsheet earns its keep
Certification courses and classroom labs still ask candidates to fill a prefix-length table from memory: given slash-26, write the mask, the wildcard, the block size, and the usable host count. Firewall and ACL authors convert a prefix into a wildcard mask when they translate a CIDR allow-list into a classic extended access list; emitting every prefix in a planning range avoids off-by-one errors on slash-23 versus slash-25.
Runbook generators dump the full slash-0 through slash-32 table into an internal wiki once and stop arguing about whether slash-31 has zero or two usable addresses. Failed validation does not consume balance. Request only the prefix range you need, treat slash-31 and slash-32 with the RFC 3021 and host-route conventions documented here, and you get a reproducible IPv4 prefix table for homework, ACL reviews, and edge workers without standing up an IP address management stack.
What you can do with it
CCNA and classroom prefix tables
Fill or grade the classic /8 through /32 cheatsheet: mask, wildcard, block size, and usable hosts for each prefix length.
ACL wildcard planning
Translate a prefix range into Cisco-style wildcard masks when converting a CIDR allow-list into an extended access list.
FAQ
How many usable hosts does each IPv4 prefix have?
For prefix 0–30, usable hosts equal 2^(32-prefix) minus 2 (network and broadcast). A /31 has 2 usable addresses (RFC 3021). A /32 is a host route with 1 address.
What is the difference between the subnet mask and the wildcard mask?
The subnet mask is prefix ones followed by host-bit zeros (slash-24 is 255.255.255.0). The wildcard mask is its bitwise complement (0.0.0.255) and is what classic Cisco ACLs match against.
How do I get the full slash-0 through slash-32 table?
The response has 33 rows, one per IPv4 prefix length, including the /31 point-to-point and /32 host-route conventions.
Is this the same as a subnet calculator that takes 192.168.1.0/24?
No. That tool sizes one concrete network (first host, last host, broadcast). This cheatsheet maps each prefix length to mask, wildcard, total addresses, and usable hosts.
Why are two addresses subtracted from every block?
Because the all-zeros address names the network and the all-ones address is the broadcast, so a /24 has 256 addresses but 254 usable hosts. The exceptions are /31, where both addresses are usable, and /32, a single host address.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev/subnet-hosts-table \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"prefix_from":24,"prefix_to":30}'const res = await fetch("https://api.kit.forhosting.com/dev/subnet-hosts-table", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"prefix_from": 24,
"prefix_to": 30
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev/subnet-hosts-table",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"prefix_from": 24,
"prefix_to": 30
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/subnet-hosts-table", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"prefix_from":24,"prefix_to":30}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"prefix_from":24,"prefix_to":30}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/subnet-hosts-table", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"prefix_from": 24,
"prefix_to": 30
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev.subnet_hosts_table",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
This subnet prefix cheatsheet calculator builds a reference table for every requested IPv4 prefix length from prefix_from through prefix_to inclusive.
How prefix length becomes mask, wildcard, and host counts
This subnet prefix cheatsheet calculator walks each integer prefix from prefix_from through prefix_to inclusive and emits those four derived columns so a student, an ACL author, or a documentation generator can read a complete lookup table in one response instead of recomputing a power of two on every row.
Input contract, table shape, and the slash-31 and slash-32 exceptions
Both must be integers from zero through thirty-two. Keep the range inside the thirty-three possible IPv4 prefix lengths and pin the numeric columns in tests so goldens stay byte-stable across runtimes. POST a JSON body with two required integer fields. prefix_from is the inclusive start of the IPv4 prefix-length range and prefix_to is the inclusive end. The aliases from and min_prefix are accepted for prefix_from; the aliases to and max_prefix are accepted for prefix_to. If prefix_from is greater than prefix_to the task fails with invalid_input naming the ordering rule. Missing fields, non-integers, booleans, and values outside zero through thirty-two also fail with invalid_input and are not billed. On success the body echoes prefix_from and prefix_to, sets row_count to the number of emitted rows, and returns rows as an array ordered by increasing prefix. Each row contains prefix (the integer length), cidr (the slash form such as /24), subnet_mask and wildcard_mask as dotted-decimal strings, host_bits (thirty-two minus prefix), total_addresses as the integer power of two, and usable_hosts using the modern conventions described above. Example: prefix_from twenty-four and prefix_to thirty returns seven rows, beginning with slash-24 (mask 255.255.255.0, wildcard 0.0.0.255, two hundred fifty-six addresses, two hundred fifty-four usable hosts) and ending with slash-30 (mask 255.255.255.252, wildcard 0.0.0.3, four addresses, two usable hosts). Pair the table with your own network-address arithmetic if you also need first host, last host, or broadcast for a concrete CIDR; this endpoint is the prefix-length reference, not a per-network calculator.
Where a subnet prefix cheatsheet earns its keep
A live cheatsheet that is also an API lets an auto-grader mark those four cells without maintaining a private spreadsheet.
Integration use cases
Runbooks and generated docs
Dump a stable IPv4 prefix table into a wiki or CI fixture so teams stop arguing about /31 and /32 host counts.
Technical questions
What does the subnet prefix cheatsheet calculator cost?
The browser tool is free. API requests use prepaid KIT balance at $0.002 per successful call; invalid input is not billed.