How to Calculate a Subnet Mask (CIDR Explained With a Worked Example)
To calculate a subnet mask from a CIDR prefix, set that many bits to 1 starting from the left of a 32-bit number, fill the rest with 0, then read each 8-bit group back as a decimal number. A /24 prefix sets the first 24 bits to 1, which converts to 255.255.255.0.
What the CIDR number actually means
An IPv4 address is 32 bits, written as four 8-bit groups (octets) in decimal. CIDR notation, the slash and number after an address like 192.168.1.0/24, tells you how many of those 32 bits are fixed as the network portion. The bits left over belong to hosts on that network.
A /24 fixes the first 24 bits, leaving 8 bits for hosts. A /26 fixes 26 bits, leaving only 6. The fewer bits left for hosts, the fewer devices that network can hold, and the math behind that is a straight power of two: a network with h host bits has 2^h total addresses.
Calculating the mask by hand: 192.168.1.0/24
Take the CIDR prefix, 24, and write out a 32-bit number with the first 24 bits set to 1 and the last 8 set to 0:
11111111.11111111.11111111.00000000Convert each 8-bit group to decimal. Eight 1s in a row is 255, and eight 0s is 0:
255 . 255 . 255 . 0That’s the subnet mask: 255.255.255.0. To get the network address, line up the IP address and the mask in binary and apply a bitwise AND, bit by bit, keeping a 1 only where both inputs have a 1:
| Octet 1 | Octet 2 | Octet 3 | Octet 4 | |
|---|---|---|---|---|
| IP address | 11000000 | 10101000 | 00000001 | 00000000 |
| Subnet mask | 11111111 | 11111111 | 11111111 | 00000000 |
| Network (AND) | 11000000 | 10101000 | 00000001 | 00000000 |
That gives a network address of 192.168.1.0, unchanged in this case because the host portion of the original address was already all zeros. The broadcast address is the opposite operation: take the network address and set every host bit to 1, which here gives 192.168.1.255. Everything in between, 192.168.1.1 through 192.168.1.254, is a usable host address. That’s 256 total addresses in the block, minus 2 reserved ones (the network address and the broadcast address), for 254 usable hosts.
Splitting a /24 into four /26 subnets
Say you have 192.168.1.0/24 and need to split it into four smaller, separate networks, maybe one per floor of an office. Moving from /24 to /26 borrows 2 extra bits for the network portion (26 − 24 = 2), and 2 borrowed bits always produce 2^2 = 4 equal subnets. Each /26 subnet has 32 − 26 = 6 host bits left, so each one holds 2^6 = 64 total addresses, 62 of them usable.
| Subnet | Network address | Usable range | Broadcast |
|---|---|---|---|
| 1 | 192.168.1.0/26 | 192.168.1.1 – 192.168.1.62 | 192.168.1.63 |
| 2 | 192.168.1.64/26 | 192.168.1.65 – 192.168.1.126 | 192.168.1.127 |
| 3 | 192.168.1.128/26 | 192.168.1.129 – 192.168.1.190 | 192.168.1.191 |
| 4 | 192.168.1.192/26 | 192.168.1.193 – 192.168.1.254 | 192.168.1.255 |
Notice each network address jumps by 64, the block size, and every subnet’s broadcast address is exactly one less than the next subnet’s network address. That pattern holds no matter what prefix you’re splitting into: the block size is always 2^h where h is the number of host bits left, and subnets tile the address space with no gaps and no overlap.
CIDR to subnet mask reference table
A cheat sheet for the prefixes you’ll actually run into, from a single /32 host route up to a /8 block:
| CIDR | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 (point-to-point) |
| /32 | 255.255.255.255 | 1 | 1 (host route) |
Calculate with your own address
Type any IPv4 address and CIDR prefix or mask below, and the breakdown, network address, broadcast, usable range, and the mask in binary, updates as you type.
Common mistakes and edge cases
Forgetting that the network and broadcast addresses aren’t usable hosts. A /24 has 256 total addresses, but only 254 you can actually assign to a device. It’s a common off-by-one error to plan capacity around the total address count instead of the usable count, and then run out of room two addresses earlier than expected.
Treating /31 and /32 like every other prefix. RFC 3021 makes /31 a special case for point-to-point links: both addresses in the pair are usable, since there’s no room in a 2-address block to spare one for a broadcast. A /32 is a single address on its own, most often seen as a host route or a loopback address, and it has no network or broadcast address to subtract at all.
Mixing up the subnet mask and the wildcard mask. The subnet mask marks network bits with 1s, 255.255.255.0 for a /24. The wildcard mask is its bitwise inverse, marking host bits with 1s instead, 0.0.0.255 for that same /24. Wildcard masks show up in access control lists on Cisco and similar gear, and typing a subnet mask where a device expects a wildcard mask (or the reverse) silently matches the wrong set of addresses.
Assuming a subnet mask is always a valid, contiguous run of 1s. A mask like 255.0.255.0 looks plausible at a glance but isn’t valid: the 1 bits aren’t a single unbroken block from the left, so it can’t be expressed as a CIDR prefix at all. Real subnet masks are always some number of leading 1 bits followed by trailing 0 bits, nothing else.
Frequently asked questions
How do I convert a subnet mask back into a CIDR prefix?
Count the number of 1 bits in the mask, reading left to right in binary. 255.255.255.0 is 11111111.11111111.11111111.00000000, which has 24 ones, so it’s a /24. This only works cleanly when the mask is a valid contiguous run of 1s followed by 0s; a mask like 255.0.255.0 has no CIDR equivalent because its bits aren’t contiguous.
Why does borrowing bits for subnets always produce a power of two? Each bit you borrow from the host portion doubles the number of possible values that bit can represent, 0 or 1. Borrow 1 bit and you get 2 subnets, borrow 2 and you get 4, borrow 3 and you get 8. It’s the same reason a byte (8 bits) can represent 256 distinct values: every extra bit doubles the count.
What’s the difference between a subnet mask and a default gateway? A subnet mask tells a device which part of an IP address is the network and which part is the host, so it can figure out whether another address is on its own local network. A default gateway is a separate setting, the IP address of the router a device sends traffic to when the destination isn’t on its local network. You need both configured correctly for a device to reach anything outside its own subnet.
Can I subnet using a prefix that doesn’t divide evenly, like splitting a /24 into 3 networks? Not into exactly 3 equal parts, no, because subnetting always splits a block into a power of two. Splitting a /24 gets you 2, 4, 8, 16, and so on, never 3. In practice this means you’d subnet into 4 (borrowing 2 bits) and either leave one /26 unused or split it further for a smaller department, rather than trying to force an exact 3-way split.