/32 subnet: a single host route

What /32 means

All 32 bits are network bits, so the mask is 255.255.255.255 and the wildcard 0.0.0.0, a wildcard that matches only the exact address. 2^0 = 1: 10.0.0.0/32 is just 10.0.0.0, with no network, broadcast or range.

A bare IPv4 address with no prefix is treated as /32 by the calculator, the same convention routers and most firewalls follow.

Where you will see /32

Router loopback interfaces carry a /32 so the router has one stable address that does not depend on any physical link; OSPF and BGP router IDs and iBGP peerings use them. Anycast and floating service IPs are announced as /32 host routes.

Firewall rules and cloud security groups use /32 to allow a single source: an AWS security group rule for one admin IP is written 203.0.113.10/32. Leaving off the prefix, or writing /24 by mistake, opens the rule to a whole block.

Pitfalls

On the public internet, most networks filter IPv4 announcements longer than /24, so a /32 will not propagate globally unless it is a deliberate, agreed exception such as a remote-triggered blackhole route.

Assigning a /32 to an Ethernet interface leaves the host with no on-link neighbours; it needs an explicit route to its gateway. That is how some cloud and container networks work on purpose, which can surprise people reading ip addr output. The next size up, a /31, is the smallest block for a two-device link.

Configuring a /32

On Linux, ip addr add 10.0.0.1/32 dev lo adds a loopback host address; on Cisco IOS the equivalent is interface Loopback0 with ip address 10.0.0.1 255.255.255.255. Advertise it into OSPF or BGP and the router stays reachable on that address over any working path, even when individual links fail. Many teams number loopbacks from one dedicated /24 so a glance at an address tells you it identifies a device rather than a link.