An IPv4 /31 contains two addresses, while a /32 contains exactly one. That arithmetic is simple. The confusing part is whether those addresses are usable, because the answer depends on how the prefix is being used.
On a normal multi-access subnet, engineers reserve the lowest address as the network identifier and the highest as the directed broadcast address. Applying that old rule mechanically leaves no host addresses in a /31. RFC 3021 defines a deliberate exception for point-to-point links: both addresses can identify the two endpoints. A /32, meanwhile, identifies one exact IPv4 address rather than a shared link.
/31 for a two-device point-to-point link when both ends support RFC 3021. Use a /32 when a route, loopback, policy, or configuration must refer to one host. Use a /30 when you need conventional network and broadcast semantics or must support equipment that does not handle /31 links./30 vs /31 vs /32 at a glance
| Prefix | Total addresses | Usable endpoints | Typical purpose |
|---|---|---|---|
/30 | 4 | 2 conventional hosts | Point-to-point link with network and broadcast addresses |
/31 | 2 | 2 on an RFC 3021 point-to-point link | Address-efficient router, firewall, tunnel, or WAN link |
/32 | 1 | 1 exact address, not a shared subnet | Host route, loopback, tunnel endpoint, ACL object, or peer ID |
“Usable” is contextual here. A calculator that always subtracts two for network and broadcast addresses will report zero hosts for /31 and a nonsensical negative result for/32. That formula is useful for traditional subnets from /0 through/30, but it is not the operational rule for these special cases.
How an IPv4 /31 works
A /31 mask is 255.255.255.254. Only the final bit varies, so every aligned block contains an even-numbered address and the following odd-numbered address. For example, 192.0.2.10/31 contains:
192.0.2.10— endpoint A192.0.2.11— endpoint B
On this point-to-point link, neither address is treated as a broadcast address. Each endpoint sends traffic for the other address directly across the link. The next aligned block is192.0.2.12/31, containing .12 and .13.
Why use /31 instead of /30?
A traditional /30 spends four addresses to number two endpoints. A/31 spends two. If an operator has 500 numbered point-to-point links,/30 allocations consume 2,000 addresses; /31 allocations consume 1,000. The saving matters in public IPv4 space and can also keep private address plans smaller and easier to summarize.
The saving is exactly 50 percent per link, but it does not make /31 a universal replacement for /30. The link must truly have two endpoints. Ethernet broadcast domains with multiple hosts, first-hop redundancy protocols, and platforms without RFC 3021 support need a different design. Check the behavior of both devices and the control-plane protocols you intend to run before rollout.
/31 boundaries and alignment
A valid network boundary occurs on every even address. Entering 192.0.2.11/31still describes the same block as 192.0.2.10/31; the host bits normalize to the even network boundary. The following block starts at 192.0.2.12, not192.0.2.11.
This distinction is important in automation. Store normalized prefixes, but keep the actual interface address separately. Otherwise two strings that describe the same block can look like separate allocations.
What an IPv4 /32 means
A /32 mask is 255.255.255.255. All 32 bits are fixed, so192.0.2.10/32 means only 192.0.2.10. There is no second address and no ordinary Layer 2 subnet to discover neighbors on.
Common uses include:
- Host routes: a routing-table entry that matches one destination more specifically than any covering prefix.
- Router loopbacks: a stable address that is independent of any one physical interface and can be advertised through a routing protocol.
- Security policy: an ACL, firewall object, or allowlist entry for one source or destination.
- Tunnel and peer identifiers: an exact endpoint used by BGP, VPN, or overlay configuration.
A /32 route does not mean the target is physically isolated. A router can reach that exact address through a next hop learned on another connected network. Likewise, a loopback configured as /32 becomes reachable when another route points toward the device. Prefix length describes the match; the routing table describes the path.
Worked allocation example
Suppose a provider assigns 192.0.2.8/29 for infrastructure addressing. The block contains eight addresses, from 192.0.2.8 through 192.0.2.15. It can be divided into four point-to-point /31 links:
192.0.2.8/31: endpoints.8and.9192.0.2.10/31: endpoints.10and.11192.0.2.12/31: endpoints.12and.13192.0.2.14/31: endpoints.14and.15
Dividing the same /29 into conventional /30 links produces only two links. The /31 design doubles the number of point-to-point links without obtaining more address space.
If the router also needs a stable loopback, allocate a separate /32 from a loopback pool. Do not silently take one address out of a /31; doing so breaks the pair and wastes the other endpoint. Keeping point-to-point and loopback pools separate also makes route filtering and summarization easier to reason about.
Deployment checklist
- Confirm the segment has exactly two Layer 3 endpoints.
- Verify RFC 3021 support on both platforms and in the intended software versions.
- Allocate the
/31on an even address boundary. - Record the normalized prefix and each endpoint assignment separately.
- Test adjacency, routing protocols, monitoring, and management access.
- Keep a
/30fallback for legacy or multi-access designs.
For repeated tunnel or BGP endpoint assignments, theBGP VPN point-to-point generator can build paired allocations. For a broader parent block, use thehierarchical subnet plannerto reserve distinct infrastructure pools before assigning individual links.