Free reference

Subnet, CIDR and port cheat sheet

The table everyone keeps reopening in a browser tab, plus the reserved ranges worth recognising on sight and the arithmetic nobody does in their head at 3am.

CIDR

CIDRNETMASKADDRSHOSTS
/8255.0.0.01677721616777214
/16255.255.0.06553665534
/20255.255.240.040964094
/22255.255.252.010241022
/23255.255.254.0512510
/24255.255.255.0256254
/25255.255.255.128128126
/26255.255.255.1926462
/27255.255.255.2243230
/28255.255.255.2401614
/29255.255.255.24886
/30255.255.255.25242
/31255.255.255.25422
/32255.255.255.25511

Hosts is addresses minus two, for the network and the broadcast. /31 and /32 are the exceptions.

SUBNET MATH

Usable hosts = 2 to the power of (32 minus prefix), minus 2.

Block size = 256 minus the last octet of the mask. A /26 is .192, so blocks of 64: .0, .64, .128, .192.

RANGES TO KNOW

10.0.0.0/8private
172.16.0.0/12private, 172.16 to 172.31
192.168.0.0/16private
127.0.0.0/8loopback
169.254.0.0/16link-local, DHCP failed
224.0.0.0/4multicast

TOOLS

ip a addresses
ip r routes
ping -c 4 host
mtr host traceroute, live
dig +short host
dig @8.8.8.8 host
dig -x 1.2.3.4 reverse
nc -zv host 443
ss -tulpn
curl -sSI https://host
tcpdump -i any -n port 443

PORTS

20/21FTP
22SSH, SCP, SFTP
25SMTP
53DNS
67/68DHCP
80HTTP
88Kerberos
110POP3
123NTP
135/139NetBIOS
143IMAP
161/162SNMP
179BGP
389LDAP
443HTTPS
445SMB
465SMTPS
500IPsec IKE
514syslog
587SMTP submission
636LDAPS
993IMAPS
995POP3S
1194OpenVPN
1521Oracle DB
1812/13RADIUS auth, acct
2049NFS
3000dev servers
3306MySQL
3389RDP
5060/61SIP
5353mDNS
5432PostgreSQL
5672AMQP
6379Redis
6443Kubernetes API
8080HTTP alt
8443HTTPS alt
9090Prometheus
9092Kafka
9100node exporter
11211memcached
15672RabbitMQ UI
27017MongoDB

The parts people get wrong

These are the distinctions that cost real time. They are the reason this sheet exists rather than another list of commands.

Does 172.16.0.0/12 include 172.255?

172.16.0.0/12 covers 172.16 through 172.31. Not through 172.255. This is the single most common subnetting mistake.

What a 169.254 IP address means

An address starting 169.254 means DHCP never answered. Nothing is routing and no amount of DNS work will help.

Can you use a /31 subnet?

A /31 on a point-to-point link is legal and standard. RFC 3021. Both addresses are usable.

Why dev servers run on port 3000 and 8080

Ports above 1023 do not need root to bind. That is the only reason dev servers live at 3000 and 8080.

Ping works but the service is unreachable

Ping succeeding proves ICMP works, nothing more. Test the actual port with nc -zv before blaming the network.

Mismatched subnet masks on the same network

Two hosts in the same subnet with different masks will talk one way and not the other. Check the mask on both ends.

Other cheat sheets