Convert between CIDR prefix lengths and dotted-decimal subnet masks instantly. Get the wildcard mask, usable hosts, binary representation, and block size — plus a full subnet mask reference chart for every prefix from /0 to /32.
Enter prefix length 0 to 32 (e.g. 24 for /24)Enter a valid prefix length between 0 and 32.
Subnet Mask
—
⚠️ Disclaimer: Modern networks use CIDR notation. Dotted-decimal subnet masks are equivalent representations used in legacy device configurations.
Enter dotted-decimal subnet mask (e.g. 255.255.255.0)Enter a valid subnet mask (e.g. 255.255.255.0 or 255.255.240.0).
CIDR Prefix
—
Enter the number of hosts you need (excluding network and broadcast)Enter a valid host count between 1 and 16,777,214.
Recommended Mask
—
Sources & Methodology
✓Subnet mask calculations verified against RFC 950 (subnetting standard) and RFC 4632 (CIDR). Wildcard mask formula per Cisco IOS documentation. Binary conversions use standard 8-bit per octet representation.
Defines subnet masks as consecutive 1-bits followed by 0-bits, the bitwise AND operation for network address extraction, and the mathematical relationship between prefix length and host capacity.
Establishes CIDR prefix notation (/24, /16, etc.) as the standard for expressing subnet masks, replacing the older classful system and enabling flexible allocation.
Cisco's authoritative guide to subnet mask calculation, wildcard masks for ACLs, and the relationship between subnet masks, CIDR notation, and network addressing.
Methodology: Mask from prefix: first N bits = 1, remaining (32-N) bits = 0Prefix from mask: count leading consecutive 1-bits in 32-bit maskWildcard mask: 255.255.255.255 - Subnet Mask (octet by octet)Usable hosts: 2^(32-prefix) - 2 (subtract network + broadcast addresses)
Hosts-to-mask: find smallest N where 2^N - 2 is greater than or equal to required hosts. Prefix = 32 - N. Invalid masks (non-contiguous 1-bits) are rejected.
The subnet mask is one of the three essential components of any IPv4 network configuration, alongside the IP address and default gateway. Without a correct subnet mask, your device cannot determine which traffic stays on the local network and which must be routed to a gateway. This guide covers subnet masks in depth: what they are, how to convert between formats, how to calculate wildcard masks, and the complete reference table for all 33 valid subnet masks (/0 through /32).
Complete Subnet Mask Reference Chart (/0 to /32)
This is the authoritative reference for all valid subnet masks. Every network prefix from /0 to /32, with its dotted-decimal mask, wildcard mask, block size, total addresses, and usable host count. Bookmark this table for CCNA study and daily network engineering use.
CIDR
Subnet Mask
Wildcard Mask
Block Size
Total IPs
Usable Hosts
/32
255.255.255.255
0.0.0.0
1
1
1 (host route)
/31
255.255.255.254
0.0.0.1
2
2
2 (RFC 3021 P2P)
/30
255.255.255.252
0.0.0.3
4
4
2
/29
255.255.255.248
0.0.0.7
8
8
6
/28
255.255.255.240
0.0.0.15
16
16
14
/27
255.255.255.224
0.0.0.31
32
32
30
/26
255.255.255.192
0.0.0.63
64
64
62
/25
255.255.255.128
0.0.0.127
128
128
126
/24
255.255.255.0
0.0.0.255
256
256
254
/23
255.255.254.0
0.0.1.255
512
512
510
/22
255.255.252.0
0.0.3.255
1,024
1,024
1,022
/21
255.255.248.0
0.0.7.255
2,048
2,048
2,046
/20
255.255.240.0
0.0.15.255
4,096
4,096
4,094
/19
255.255.224.0
0.0.31.255
8,192
8,192
8,190
/18
255.255.192.0
0.0.63.255
16,384
16,384
16,382
/17
255.255.128.0
0.0.127.255
32,768
32,768
32,766
/16
255.255.0.0
0.0.255.255
65,536
65,536
65,534
/8
255.0.0.0
0.255.255.255
16,777,216
16,777,216
16,777,214
/0
0.0.0.0
255.255.255.255
4,294,967,296
4,294,967,296
Default route
How Subnet Masks Work: The Bitwise AND Explained
A subnet mask works by performing a bitwise AND operation with an IP address. This operation compares each bit of the IP address with the corresponding bit of the mask. Where the mask bit is 1, the IP bit is preserved. Where the mask bit is 0, the result is always 0. This zeroes out the host portion and leaves only the network address. Network devices use this operation constantly to determine whether a destination IP is on the local subnet or must be sent to a router.
Network Address = IP Address AND Subnet Mask
Example: IP 192.168.1.100 with mask 255.255.255.0
192.168.1.100 = 11000000.10101000.00000001.01100100
255.255.255.0 = 11111111.11111111.11111111.00000000
AND result = 11000000.10101000.00000001.00000000 = 192.168.1.0
The .100 host portion is zeroed out, revealing the network address.
How to Calculate a Wildcard Mask
A wildcard mask is used in Cisco ACLs, OSPF network commands, and firewall rules. It is the bitwise inverse of the subnet mask. The simplest calculation method is to subtract each octet of the subnet mask from 255. For subnet mask 255.255.255.0, wildcard = 255-255 . 255-255 . 255-255 . 255-0 = 0.0.0.255. For 255.255.240.0, wildcard = 0.0.15.255. A 0-bit in the wildcard means the corresponding IP bit must match exactly. A 1-bit means that bit is ignored.
💡 ACL example: To permit all traffic from 192.168.1.0/24, the Cisco ACL statement is: permit 192.168.1.0 0.0.0.255 where 0.0.0.255 is the wildcard mask. For a single host /32, the wildcard is 0.0.0.0: permit host 192.168.1.100 (shorthand) or permit 192.168.1.100 0.0.0.0 (explicit wildcard).
Choosing the Right Subnet Mask for Your Network
Selecting the correct subnet mask is the first step in network planning. The mask must be large enough to accommodate all hosts now and in the future, with growth headroom of 20 to 30%. Use the Hosts to Mask tab above to find the minimum mask for your host count. For point-to-point links, use /30 (2 usable hosts) or /31 (RFC 3021). For large server farms consider /25 or /24. For backbone management networks a /28 or /29 is appropriate.
Subnet Masks in Cloud Environments
AWS, Azure, and Google Cloud use subnet masks extensively in their virtual networking. AWS VPCs are assigned a CIDR block and subdivided into subnets with different masks per availability zone and application tier. AWS reserves 5 addresses per subnet (network, VPC router, DNS, reserved, broadcast), reducing usable hosts compared to standard subnetting. A /24 AWS subnet provides 251 usable addresses instead of 254. Always account for cloud provider reservations when choosing subnet masks for cloud deployments.
Subnet Masks on the CCNA and Network+ Exams
Subnet mask questions appear throughout the Cisco CCNA 200-301 and CompTIA Network+ exams. You must be able to convert CIDR prefixes to dotted-decimal masks and back, calculate wildcard masks, determine the number of usable hosts for any mask, and identify valid versus invalid subnet masks. A valid subnet mask always consists of consecutive 1-bits followed by consecutive 0-bits. Non-contiguous masks like 255.255.0.255 are invalid and not supported on standard network equipment.
Frequently Asked Questions
A subnet mask is a 32-bit number that identifies which portion of an IP address represents the network and which represents the host. It consists of consecutive 1-bits (network portion) followed by consecutive 0-bits (host portion). The mask is applied to an IP address using bitwise AND to extract the network address. For 255.255.255.0, the first 24 bits are network and the last 8 bits are host.
Set the first N bits to 1 and the remaining (32 minus N) bits to 0 in a 32-bit number. For /24: 24 ones followed by 8 zeros = 11111111.11111111.11111111.00000000 = 255.255.255.0. For /20: 20 ones followed by 12 zeros = 11111111.11111111.11110000.00000000 = 255.255.240.0. Use the CIDR to Mask tab above to convert any prefix instantly.
Count the number of consecutive 1-bits from the left in the 32-bit binary representation of the mask. For 255.255.255.0: binary is 11111111.11111111.11111111.00000000, which has 24 leading 1-bits, so the CIDR is /24. For 255.255.240.0: binary is 11111111.11111111.11110000.00000000 with 20 leading 1-bits, giving /20.
A wildcard mask is the inverse of a subnet mask. Calculate it by subtracting each octet from 255. For 255.255.255.0: 255-255.255-255.255-255.255-0 = 0.0.0.255. Wildcard masks are used in Cisco ACLs, OSPF network commands, and firewall rules. A 0-bit requires an exact match; a 1-bit allows any value. This calculator shows the wildcard mask for every conversion.
Usable hosts = 2 to the power of (32 minus prefix length) minus 2. The minus 2 accounts for the network address and broadcast address. Key values: /30 = 2 hosts, /29 = 6, /28 = 14, /27 = 30, /26 = 62, /25 = 126, /24 = 254, /23 = 510, /22 = 1,022, /21 = 2,046, /20 = 4,094, /16 = 65,534. See the full reference table in the guide above.
For 200 hosts, you need 2^N minus 2 to be greater than or equal to 200. 2^7 = 128 minus 2 = 126 (too few). 2^8 = 256 minus 2 = 254, which is greater than or equal to 200. So N = 8 and prefix = 32 minus 8 = /24, giving subnet mask 255.255.255.0 with 254 usable hosts. Use the Hosts to Mask tab above for any host count.
The /30 subnet mask (255.255.255.252) provides exactly 2 usable host addresses, making it ideal for point-to-point WAN links between routers where you only need addresses for each end of the connection. Using /30 instead of /24 for each WAN link saves 252 IP addresses. RFC 3021 introduced /31 (255.255.255.254) which provides 2 addresses with no wasted network or broadcast, but /30 remains more widely supported on older equipment.
255.255.255.255 is equivalent to /32. All 32 bits are network bits with zero host bits. It identifies a single specific IP address. It is used for loopback interface addressing, host-specific entries in routing tables, BGP next-hop specifications, and ACL entries that must match exactly one IP address.
A valid subnet mask must consist of consecutive 1-bits followed by consecutive 0-bits. Non-contiguous masks like 255.255.0.255 or 255.0.255.0 are invalid because the 1-bits and 0-bits are not grouped together. Standard network equipment rejects non-contiguous masks. Valid masks only use the values 0, 128, 192, 224, 240, 248, 252, 254, and 255 in each octet, in a specific valid combination.
In OSPF configuration, the network command uses a wildcard mask to specify which interfaces to include in OSPF. For example, network 192.168.1.0 0.0.0.255 area 0 tells OSPF to advertise any interface with an IP in the 192.168.1.0/24 range. The wildcard 0.0.0.255 is the inverse of the 255.255.255.0 subnet mask. Modern Cisco IOS also supports the network prefix-length format without wildcard masks.
Class A (first octet 1-126) default mask is 255.0.0.0 or /8. Class B (128-191) default is 255.255.0.0 or /16. Class C (192-223) default is 255.255.255.0 or /24. These classful defaults define the original boundary between network and host bits without subnetting. Modern CIDR allows any prefix length on any address regardless of class, making these defaults mainly relevant for CCNA study.
A subnet mask of 0.0.0.0 equals /0, meaning all 32 bits are host bits with zero network bits. It is used in routing tables to represent the default route (0.0.0.0/0), which matches any destination IP address not covered by a more specific route. It is never used as the subnet mask of an interface address but appears in routing configurations as the catch-all route pointing to the default gateway.
AWS reserves 5 addresses in every subnet: the network address, the VPC router (.1), the AWS DNS server (.2), a reserved address for future use (.3), and the broadcast address. Standard subnetting only subtracts 2 (network and broadcast), leaving 254 usable hosts in a /24. AWS subtracts 5, leaving 251 usable hosts. Azure and Google Cloud use the same 5-address reservation. Factor this in when sizing subnets for cloud deployments.