/32: A Single IP Address

How many /32 networks fit

256 × /32 = one /24. A /32 is the longest possible IPv4 prefix.

Worked example: 192.0.2.10/32

You need to allow just one admin workstation, 192.0.2.10, through a firewall. What does the /32 cover?

1. A /32 has zero host bits, so the mask is 255.255.255.255 and every bit of the address is fixed.
2. The "network" is the address itself: 192.0.2.10/32. There is no separate broadcast, and the one usable address is 192.0.2.10.

Address  11000000.00000000.00000010.00001010|
Mask     11111111.11111111.11111111.11111111|
Network  11000000.00000000.00000010.00001010|

Where /32 is used in real networks

• Router loopbacks and router IDs

  Loopback interfaces use a /32 (e.g. 10.0.0.1/32). OSPF and BGP router IDs and iBGP peering often point at them, because a loopback never goes down with a physical link.

• Allow lists and security groups

  AWS security groups and most firewalls take CIDR notation, so a single IP is written 203.0.113.7/32. In a Cisco ACL it's host 203.0.113.7 or wildcard 0.0.0.0.

• Host routes and anycast

  A /32 static or BGP route sends traffic for one address a specific way — common for anycast DNS, load balancer VIPs and Calico pod routes in Kubernetes.

Common /32 mistakes

• Entering a bare IP where CIDR is expected. Some tools reject it, and others guess a mask from the old address classes. Always add /32 for a single host.
• Configuring a /32 on an Ethernet interface for normal traffic. With no other address "on-link", the host can't ARP for neighbours without extra routes.
• Writing 0.0.0.0/32 instead of 0.0.0.0/0 for "any". The first means the single address 0.0.0.0; the second means everything.

/32 FAQ

Related tools