Most people remember the CIDR host-count formula as "2^(32-prefix)-2". It checks out for /24 (256-2=254 hosts) and /28 (16-2=14 hosts) without any fuss. Plug in /31, though, and you get 2-2=0. Plug in /32 and you get 1-2=-1. The formula itself falls apart, yet /31 is routinely used to host 2 addresses and /32 to host exactly 1. Here's why those two prefixes are the exception.

What the "-2" actually reserves

In any subnet, the first address is reserved as the network address and the last as the broadcast address — neither is assignable to a host. That's where the "-2" comes from. For 192.168.1.0/24, .0 is the network address, .255 is the broadcast address, and the remaining 254 addresses are usable. This reservation assumes the subnet needs to host three or more devices. Once a subnet only has room for one or two hosts, that assumption stops holding.

/31: with only two addresses, there's nothing left to reserve

A point-to-point link between two routers needs exactly one address on each end — two addresses total. Assign it a traditional /30 and you get four addresses, but the first and last are burned on reservations, leaving only two of the four actually usable. RFC 3021 closed that waste by permitting /31 specifically on point-to-point links: instead of carving out a network and broadcast address, both addresses in the pair are treated as host addresses. The underlying argument is that a reservation scheme built for subnets with three or more hosts simply doesn't apply to a link with exactly two. In code, this shows up as a branch that skips the usual host-range calculation whenever the prefix is 31 or 32 — ip-cidr-calculator's implementation special-cases it the same way.

/32: a notation for exactly one host

A /32 uses all 32 bits as the network portion, so it can only represent a single address. There's no room left for a separate network or broadcast address — that one address is the host. It shows up in routing tables to point at a single IP address explicitly, or to identify one specific server behind a load balancer — less a subnet than a way to name a single host.

What the comparison with /30 reveals

Prefix Total addresses Reserved Usable hosts Typical use /30 4 1 network + 1 broadcast 2 Legacy point-to-point /31 2 none 2 RFC 3021 point-to-point /32 1 none 1 (the host itself) Identifying a single host

/30 and /31 both end up hosting 2 devices, but /31 does it with half the address space. On a large backbone with many point-to-point links, saving two addresses per link adds up to a real difference in address space consumption. The catch is that some equipment still runs firmware that doesn't support /31, so it's worth confirming RFC 3021 support on the peer device before relying on it.

If you want to check the network address, broadcast address, and usable host count a given CIDR actually produces, the tool below covers both IPv4 and IPv6.