Why does subnet report 2 usable hosts for a /31 when other calculators say 0?

[saeed205]

I was cross-checking netprobe subnet against a couple of online calculators and hit a disagreement.

$ netprobe subnet 192.168.1.0/31
network         : 192.168.1.0
prefix          : 31
total_addresses : 2
usable_hosts    : 2

Several calculators report 0 usable hosts for a /31, and one reports -1 for a /32. Which behaviour is right, and why does this tool differ?

[saeed205]

Short version: the calculators reporting 0 are applying a rule that has an explicit exception, and netprobe implements the exception.

Where "subtract 2" comes from

In a normal IPv4 subnet, two addresses are not assignable to a host:

• the network address (all host bits 0)
• the broadcast address (all host bits 1)

So usable = 2^host_bits - 2. For a /24 that is 256 - 2 = 254, which is right.

Why it breaks at /31

A /31 has exactly two addresses. Apply the rule blindly and you get 2 - 2 = 0 - a subnet that cannot hold anything, which would make the prefix useless. That was in fact the situation until RFC 3021 (December 2000), which defines /31 for point-to-point links:

... the /31 addressing scheme ... uses the two addresses as the two endpoints of the link.

On a point-to-point link there is no need for a broadcast address - there is exactly one other node, so "broadcast" and "unicast to the peer" are the same packet. RFC 3021 therefore assigns both addresses to hosts. Two usable, not zero.

This is not theoretical: /31 is standard practice on router-to-router links precisely because it halves the address waste compared to a /30. Cisco IOS (ip address ... 255.255.255.254), Junos and Linux all support it.

And /32

A /32 is a single address - a host route. Loopbacks, Address=10.0.0.1/32 on a WireGuard interface, an anycast VIP. It is one usable address. The calculator reporting -1 is doing 1 - 2 and printing the result without noticing it went negative, which is a decent hint that no exception is being handled at all.

What the code does

def usable_hosts(net):
    if net.version == 6:
        return net.num_addresses
    if net.prefixlen >= 31:
        return net.num_addresses
    return net.num_addresses - 2

IPv6 is a separate branch because it has no broadcast address at all - it uses multicast instead - so nothing is ever reserved and a /127 point-to-point link (RFC 6164) has 2 usable addresses.

Summary

prefix	naive -2	correct	why
/24	254	254	rule applies
/30	2	2	rule applies
/31	0	2	RFC 3021, no broadcast on a p2p link
/32	-1	1	host route
/127 v6	0	2	IPv6 has no broadcast

These five rows are pinned in tests/test_ipmath.py as TestUsableHosts, since it is exactly the kind of thing that gets "simplified" back into a bug.

One caveat worth stating: a /31 is only valid on point-to-point links. Putting one on a multi-access segment like Ethernet with more than two nodes will not work, because ARP and broadcast still matter there.