/30 vs /29 vs /28 vs /27 Subnet Masks: Host Bits Explained

In the last octet, /25 is .128, /26 is .192, /27 is .224, /28 is .240, /29 is .248 and /30 is .252. Usable hosts are 2 raised to the host bits, minus 2.

host bits = 32 − prefix usable hosts = 2^(host bits) − 2

The two addresses you subtract are the network address (all host bits 0) and the broadcast address (all host bits 1). Neither can be assigned to an interface on a normal subnet.

A /30 uses the subnet mask 255.255.255.252. It has 4 addresses and exactly 2 usable hosts, which is why it is the classic choice for a router-to-router link.

Take 10.0.0.8/30. The network is 10.0.0.8, the two routers use 10.0.0.9 and 10.0.0.10, and the broadcast is 10.0.0.11. The next /30 starts at 10.0.0.12.

Many modern networks use /31 instead. RFC 3021 allows both addresses of a /31 on a point-to-point link, which saves half the space. Check that both devices support it before you switch.

Search terms such as "cidr /30", "subnet mask /30" and "subnet mask 30" all describe the same block. Open the /30 preset to list every /30 inside a larger range.

A /29 uses 255.255.255.248. It has 8 addresses and 6 usable hosts, the size most ISPs hand out as a small static IP block.

When a provider sells "5 static IPs", they usually route a /29 to you. One usable address goes to their gateway, which leaves 5 for your firewall and servers.

A /29 boundary falls on a multiple of 8 in the last octet: .0, .8, .16, .24 and so on. The /29 preset shows the exact range for any address you enter.

A /28 uses 255.255.255.240. It has 16 addresses and 14 usable hosts, a good fit for a small DMZ or management VLAN.

Blocks start on multiples of 16, so 192.168.5.32/28 covers .32 to .47. Hosts use .33 to .46.

Cloud subnets need extra care at this size. Azure and AWS reserve 5 addresses in every subnet, which leaves only 11 usable in a /28. AWS also sets /28 as the smallest subnet you can create. Try the /28 subnet preset to compare.

A /27 uses 255.255.255.224. It has 32 addresses and 30 usable hosts, and its blocks start on multiples of 32.

A /24 splits into eight /27 subnets: .0, .32, .64, .96, .128, .160, .192 and .224. That makes "27 subnet mask" a common answer for floors, departments or small server farms.

The /27 preset lists all eight child networks of any /24 with their broadcast addresses.

Five bits identify the host. 255.255.255.224 is a /27, which leaves 32 − 27 = 5 host bits and 2^5 − 2 = 30 usable host addresses.

This question shows up in CompTIA Network+, Cisco CCNA and many university networking exams. Work through it in three steps.

1. The first three octets are 255, which gives 24 network bits.
2. Write the last octet in binary: 224 = 11100000. That adds 3 more network bits, so the prefix is /27.
3. Count the zeros in the last octet. There are 5, so 5 bits identify the host.

255.255.255.224 = 11111111.11111111.11111111.11100000 → 27 ones, 5 zeros → 2^5 − 2 = 30 hosts

Worked example: 192.168.10.77/27

The block size is 32, so find the multiple of 32 at or below 77. That is 64. The network is 192.168.10.64, the broadcast is 192.168.10.95, and hosts use .65 to .94.

People also search "255-224", which is the shortcut in the next section. 256 minus 224 gives 32, the block size of a /27.

A /25 uses 255.255.255.128 and splits a /24 into two halves of 128 addresses, each with 126 usable hosts.

The first half of 10.1.1.0/24 is 10.1.1.0/25 (hosts .1 to .126). The second half is 10.1.1.128/25 (hosts .129 to .254). The /25 CIDR preset shows both halves side by side.

Yes. Subtract the last mask octet from 256 to get the block size, then count in that step from zero to find each network address.

block size = 256 − last mask octet e.g. 256 − 224 = 32 → networks at .0, .32, .64, .96 …

ipcalc 192.168.10.77/27

python3 - <<'EOF'
import ipaddress
net = ipaddress.ip_interface("192.168.10.77/27").network
print(net, net.netmask, net.broadcast_address, net.num_addresses - 2)
EOF
# 192.168.10.64/27 255.255.255.224 192.168.10.95 30

When you write detection rules for a small subnet, the same numbers apply. The KQL & SPL builder shows how to filter a /27 with ipv4_is_in_range() in Sentinel or cidrmatch() in Splunk.

A /24 holds 64 /30s, 32 /29s, 16 /28s, 8 /27s, 4 /26s and 2 /25s. Each extra prefix bit doubles the count.

subnets in a /24 = 2^(new prefix − 24) e.g. /28 → 2^4 = 16

The last column shows the cost of small subnets. Every subnet loses two addresses to the network and broadcast, so 64 /30 links use half of the /24 on overhead.

Mix sizes when you plan a /24. Allocate the largest subnets first from the bottom of the range, then fill the gaps with smaller ones, so every block stays aligned.