/24 subnet mask (255.255.255.0): hosts, splits and why BGP needs a /24

02How many hosts are in a /24?

254. Subtracting 24 from 32 leaves 8 host bits, and 2^8 is 256 addresses. The all-zeros address, 203.0.113.0, names the network, and the all-ones address, 203.0.113.255, is the broadcast address that reaches every host on the segment, so neither is given to a device.

In practice one more goes to the router, which leaves 253 addresses for devices. Many networks also keep a block back for static assignments such as printers, switches or a second gateway and give the DHCP server the rest; a pool from .100 to .199, for example, holds 100 leases. When 253 is not enough, the next size up is a /23 (255.255.254.0) with 510 usable hosts.

03Why /24 is the smallest prefix routed on the internet

A /24 is the longest IPv4 prefix that networks generally accept from each other in BGP. RFC 7454, the IETF's best-practice document for BGP operations, records that IPv4 prefixes longer than /24 are generally neither announced nor accepted on the internet, citing RIPE community practice. Geoff Huston's review of BGP in 2025 states the same convention: a /24 is the smallest block that propagates across the whole default-free zone.

The reason is the size of the global table. Every prefix costs memory and processing in each router that carries a full table, and Huston counted between 1,040,000 and 1,050,000 IPv4 prefixes at the end of 2025, with /22, /23 and /24 prefixes making up 84% of them. Operators filter anything more specific than /24 to keep that growth bounded.

The effect has been measured directly. In October 2014 the RIPE NCC announced a /24, a /25 and a /28, each once with and once without a route object in the routing registry, and counted how many of its 98 full-table route collector peers saw each one. A RIPE Labs follow-up in 2019 found no reason to expect a /25 to propagate any further than it did in 2014.

04What the /24 minimum means for BGP and GRE DDoS protection

Network-level DDoS protection for your own address space works by having the protection provider announce your prefix with BGP, so traffic for it flows through the provider's filters, and then delivering the clean traffic to you, usually through a GRE tunnel. Because nothing longer than a /24 propagates reliably, the block being protected must be at least a /24. A single server address, or a /29 from a hosting company, cannot be announced on its own.

Routers prefer the most specific matching route, so a /24 announced by a protection provider wins over the /22 that its holder announces directly, for the addresses inside it. That lets a network move only the /24 under attack. It also means the holder's route origin authorisations must allow the more specific prefix from the provider's AS, or networks that validate RPKI will reject it.

Without your own /24 there are two common alternatives: protection the hosting company applies to its own larger block, or protected addresses from the provider's space with traffic delivered by tunnel. Remote DDoS protection compares these delivery methods.

Holding a /24 of your own, rather than addresses inside a provider's block, lets you:

• Announce it from your own ASN, or have a provider announce it for you
• Move it between upstreams or protection providers without renumbering hosts
• Have its reverse DNS delegated to you as a single zone
• Create the RPKI route origin authorisations for it yourself, deciding which ASNs may announce it

05How to split a /24 into smaller subnets

Inside your own network the /24 floor does not apply: a /24 can be divided into any mix of smaller subnets, and each extra network bit halves the size and doubles the count. Splitting costs addresses, because every subnet gives up two to its network and broadcast addresses, as the last column shows.

06Worked example: one /24, seven subnets

Suppose 203.0.113.0/24 has to hold a server network of about 100 hosts, an office of 50, a VPN pool of 25, a DMZ of 10, a management segment of 5 and two router links. Allocate the largest first, each starting on a multiple of its own size, and the whole /24 is used without overlap: 128 + 64 + 32 + 16 + 8 + 4 + 4 = 256 addresses. Using /31s for the two router links (RFC 3021) would free another four. The subnet calculator checks any one of these networks.

$ python3 -c "import ipaddress as i; print(*i.ip_network('203.0.113.0/24').subnets(new_prefix=26))"
203.0.113.0/26 203.0.113.64/26 203.0.113.128/26 203.0.113.192/26

$ python3 -c "import ipaddress as i; print(*i.ip_network('10.40.0.0/22').subnets(new_prefix=24))"
10.40.0.0/24 10.40.1.0/24 10.40.2.0/24 10.40.3.0/24

07The four /24s inside a /22, and reverse DNS

Many European networks hold a /22 rather than a single /24. When the RIPE NCC reached its last /8 in 2012, policy limited each member to one /22, and after its pool ran out in November 2019 it moved to a waiting list that allocates single /24s from recovered space to members that have not yet received an IPv4 allocation. A /22 (255.255.252.0) is exactly four consecutive /24s, and it must start on a third octet divisible by four.

Reverse DNS follows the same octet boundary. A /24 maps to exactly one in-addr.arpa zone, such as 113.0.203.in-addr.arpa for 203.0.113.0/24, so it can be delegated to its holder as a whole. Delegating anything smaller requires the CNAME technique of RFC 2317, which is why providers often keep reverse DNS for small blocks themselves.

• 10.40.0.0/22 contains 10.40.0.0/24, 10.40.1.0/24, 10.40.2.0/24 and 10.40.3.0/24 (private space, used only for the arithmetic)
• 10.40.4.0/22 is the next /22; 10.40.2.0/22 is not a valid network, because 2 is not a multiple of 4
• Each of the four /24s can be announced, protected or moved on its own, if the RPKI and routing registry records allow it