# /32 Subnet Mask (255.255.255.255) – Hosts, Range & FAQ

> The /32 subnet mask is 255.255.255.255. A /32 block holds 1 addresses with 1 usable hosts — ranges, wildcard, binary math and FAQs.

- Page URL: https://itinsighthub.com/subnet/32/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# /32 Subnet Mask ReferenceIPv4

One address, no neighbors: a /32 is a route to a single machine. Firewalls love its precision, BGP sessions ride it toward loopback interfaces, and cloud consoles quietly store every single-IP allowlist entry you type as one.

The /32 subnet mask is 255.255.255.255, equivalent to 0.0.0.0 as a wildcard. A /32 block contains 1 IP addresses (1 usable hosts (a single host route)).

## /32 facts at a glance

- **Subnet mask:** 255.255.255.255
- **Wildcard mask:** 0.0.0.0
- **Binary mask:** 11111111.11111111.11111111.11111111
- **Total addresses:** 1
- **Usable hosts:** 1 (host route)
- **Block size:** 1 addresses (20)
- **Typical role:** Single-host route

## Example /32 networks

Three consecutive /32 blocks, starting at the /32 boundary that contains 198.51.100.0:

| Network | Usable range | Usable hosts |
| --- | --- | --- |
| 198.51.100.0/32 | 198.51.100.0 | 1 |
| 198.51.100.1/32 | 198.51.100.1 | 1 |
| 198.51.100.2/32 | 198.51.100.2 | 1 |

## How to calculate a /32 mask

A /32 mask sets the first 32 bits of a 32-bit number to 1 and leaves the remaining 0 bits as 0. In binary that reads `11111111.11111111.11111111.11111111`, which converts to dotted decimal `255.255.255.255`. Each block covers a contiguous run of 20 = 1 addresses, and every block starts at a multiple of that size. The wildcard simply flips every bit, giving `0.0.0.0`.

## Where /32 is used

- Loopback interfaces on routers: stable, interface-independent endpoints for management SSH and BGP peering.
- Firewall and ACL rules permitting exactly one address, using mask 255.255.255.255 and wildcard 0.0.0.0.
- Host routes pinned into routing tables for blackholing or traffic steering.
- AWS security groups: allowing a lone IP stores the rule as that address followed by /32.

A /32 has no network or broadcast twin. The single address is simultaneously the network, the broadcast, and the host, so the usable count is simply 1.

Peering to partners' /32 loopbacks keeps BGP sessions alive even when individual physical interfaces fail, since the route follows whatever path reaches that loopback.

## Frequently asked questions

**What is a /32 IP address?**

A single, fully specified address. The mask 255.255.255.255 fixes all thirty-two bits, so the prefix identifies one exact host and nothing else.

**How many usable hosts are in a /32?**

Exactly one. There are no reserved companion addresses to subtract.

**Why do routers use /32 loopback interfaces?**

A loopback never goes down when a cable does, so management sessions and BGP peerings anchored to its /32 survive physical failures.

**What does adding /32 after an IP mean in a firewall rule?**

It states that the rule matches that single address only, rather than a range. Omitting it invites ambiguity; including it makes intent explicit.

## Open this block in a calculator

[Open the /32 block in the subnet calculator](https://itinsighthub.com/subnet-calculator/?q=198.51.100.0%2F32)

[Get the /32 wildcard mask →](https://itinsighthub.com/wildcard-mask-calculator/?q=%2F32)

### Related prefixes

[/24](https://itinsighthub.com/subnet/24/)[/26](https://itinsighthub.com/subnet/26/)[/28](https://itinsighthub.com/subnet/28/)[/30](https://itinsighthub.com/subnet/30/)[/31](https://itinsighthub.com/subnet/31/)

← /31 subnet mask

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)