/20 Subnet: Mask 255.255.240.0

A /20 is sixteen /24s in a row: 4,096 addresses. The third octet moves in steps of 16. Both AWS and Google Cloud pick /20 as their default subnet size, so you will see it everywhere in the cloud.

/20 at a glance

Subnet mask
255.255.240.0
Wildcard mask
0.0.15.255
Usable hosts
4,094
Total addresses
4,096 (212)
Block size (third octet)
16
Network / host bits
20 / 12
Mask in hex
0xFFFFF000

Mask in binary: 11111111.11111111.11110000.00000000

Network bits Host bits

Try it: which /20 is an address in?

Network address
172.31.32.0/20
First usable host
172.31.32.1
Last usable host
172.31.47.254
Broadcast address
172.31.47.255
Next /20 starts at
172.31.48.0

How many /20 networks fit

How /20 relates to /8, /16 and /24 blocks
Parent block Relationship
/8 4,096 × /20 fit inside one /8
/16 16 × /20 fit inside one /16
/24 One /20 covers 16 × /24

A /20 holds 16 × /24. Sixteen /20s make a /16.

Worked example: 172.31.37.140/20

An EC2 instance in an AWS default VPC has the IP 172.31.37.140. Default subnets are /20s. Which one is it in?

  1. The mask is 255.255.240.0. The third octet (240) is the "interesting" one — the first that is not 255.
  2. Block size = 256 − 240 = 16. Networks start at multiples of 16 in the third octet: 0, 16, 32, …
  3. The third octet of 172.31.37.140 is 37. 37 ÷ 16 = 2 remainder 5, so the block starts at 2 × 16 = 32.
  4. Network = 172.31.32.0 (octets after the third become 0). Broadcast = 32 + 16 − 1 = 47, giving 172.31.47.255 (octets after it become 255).
  5. Usable hosts: 172.31.32.1 to 172.31.47.254, which is 212 − 2 = 4,094 addresses.

Same thing in binary (network bits | host bits):

Address  10101100.00011111.0010|0101.10001100
Mask     11111111.11111111.1111|0000.00000000
Network  10101100.00011111.0010|0000.00000000

Where /20 is used in real networks

  • AWS default subnets

    The default VPC (172.31.0.0/16) has one /20 subnet per Availability Zone: 172.31.0.0/20, 172.31.16.0/20, 172.31.32.0/20 and so on. AWS reserves 5 addresses in each, leaving 4,091 usable.

  • Google Cloud auto-mode subnets

    Each region in an auto-mode VPC gets a /20 from 10.128.0.0/9, e.g. 10.128.0.0/20 for us-central1.

  • Docker user-defined networks

    Once 172.17–172.31 are used, Docker's default address pool carves networks out of 192.168.0.0/16 as /20s. A new compose project can suddenly take 192.168.0.0/20 and cut a laptop off from a home router on 192.168.1.1.

Common /20 mistakes

  • Writing 172.31.40.0/20. The third octet must be a multiple of 16, so it becomes 172.31.32.0/20.
  • Thinking the broadcast for 172.31.32.0/20 is 172.31.32.255. It is 172.31.47.255 — the block spans 16 values of the third octet (32 to 47).
  • Forgetting that an address like 172.31.40.0 is a normal, usable host inside a /20. Only the very first and very last addresses of the whole block are reserved.

/20 FAQ

How many hosts are in a /20?

4,094 usable: 2^12 = 4,096 minus network and broadcast. In AWS it is 4,091 because AWS reserves 5 addresses.

How many /24s are in a /20?

16. A /20 has 4 more host bits than a /24, and 2^4 = 16, which is also why the third octet moves in steps of 16.

What is the block size of a /20?

16 in the third octet: 256 − 240 = 16. Valid /20 networks start at x.x.0.0, x.x.16.0, x.x.32.0 … x.x.240.0.

Related tools