/32 Subnet Mask: 255.255.255.255

1. What a /32 network is

The /32 in a CIDR block is the prefix length: how many leading bits identify the network. Those 32 bits are identical for every address in the block, and the remaining 0 host bits are free to vary. Written out as a mask that is 32 ones followed by 0 zeros, which in dotted decimal is 255.255.255.255.

prefix     /32
mask       255.255.255.255
binary     11111111.11111111.11111111.11111111
wildcard   0.0.0.0

0 host bits give 2⁰ = 1 addresses. A /32 is a single address, so there is nothing to subtract: one address, one host. It has no network or broadcast address, because there is no range for them to sit at either end of.

The wildcard mask is the bitwise inverse of the subnet mask — 0.0.0.0 here — and it is what Cisco access lists and OSPF network statements expect instead of a netmask. A zero bit in a wildcard means “this bit must match”, which is the opposite convention to a netmask, and mixing the two up is one of the most common configuration errors in the subject. In classful terms a /32 is longer than a class C default mask — a subnetted class C in classful terms.

2. The 192.168.1.1/32 block, address by address

A worked example is easier to check than a formula. 192.168.1.1/32 is a real /32 inside a private range, and every figure below follows from the mask alone:

network  11000000.10101000.00000001.00000001
mask     11111111.11111111.11111111.11111111

Line the two up and the rule is visible: wherever the mask has a 1, the network bit is fixed; wherever it has a 0, the address is free to count up. A /32 has no host bits to mask away, so the address you type is already the network — which is exactly why a host route is written this way.

3. How many /32 networks fit inside a bigger block

Prefix arithmetic is powers of two all the way down: each extra bit of prefix halves the block. Going the other way, the number of /32 networks inside a shorter prefix is two to the power of the difference between the two prefix lengths, which is where these counts come from.

The usable-host column is the one worth noticing. Every split costs two addresses per subnet to the network and broadcast addresses, so a plan built from many small subnets always has fewer usable addresses than the block it came from — dividing one /24 into eight /27s leaves 240 usable addresses where the /24 had 254. That is the real price of a subnetting plan, and it is why router-to-router links in a modern design get /31s rather than /30s.

4. Why a /32 cannot be split

Borrowing host bits turns one block into several equal ones. Each bit borrowed doubles the number of subnets and halves their size:

A /32 cannot be split. It is one address — the end of the line for IPv4 prefix arithmetic.

Aggregation is the only direction left. Two adjacent /32s that share their first 31 bits combine into a /31, four aligned /32s into a /30, and so on up — the same arithmetic read backwards. Set the console to the shorter prefix to see which addresses fall inside the result.

5. Where a /32 is used

A single address: a host route, a loopback interface, one line in an ACL, or a service address advertised into BGP.

A prefix length says nothing about whether the addresses are private. That is decided by the address itself: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are the RFC 1918 private ranges, 100.64.0.0/10 is carrier-grade NAT space from RFC 6598, 169.254.0.0/16 is link-local, and 127.0.0.0/8 is loopback. A /32 carved out of any of them is private; the same /32 out of a public allocation is globally routable. The console labels which range an address falls into, including the documentation blocks from RFC 5737 that turn up in tutorials.

IPv6 changes the habit rather than the arithmetic. The mask still marks the network bits, but subnets are conventionally /64 regardless of how many hosts are on them — SLAAC needs 64 host bits — and a site is normally delegated a /48 or /56. There is no broadcast address to subtract, so the “minus two” rule has no IPv6 equivalent. The console handles IPv6 blocks as well; switch the address family above.

6. CIDR to subnet mask, around /32

The neighbouring prefixes, for when the question is really “which one do I need?” — each row is a page of its own with the same worked detail:

The subnet calculator carries the full /8 to /32 chart, and works the question backwards too: give it a host count and it returns the shortest prefix that fits, which is the calculation a design actually starts from.