IPv4 Subnet Mask

Subnet mask —

CIDR prefix: —
Wildcard mask: —
Binary mask: —
Hex mask: —
Total addresses: —
Usable hosts: —

A subnet mask marks which bits of an IPv4 address belong to the network. Enter a prefix like /20 or a mask like 255.255.240.0 and you get the other form, plus the wildcard mask, binary and hex forms, and host counts. A /20 holds 4,096 addresses, 4,094 of them usable.

About this tool

Router configs, firewall rules and cloud VPC consoles each ask for the same thing in different forms: Cisco ACLs want a wildcard mask, Linux and AWS want a /prefix, and older Windows dialogs want dotted decimal. This converter takes either a prefix length or a dotted mask and prints every form side by side, together with the total address count and the number of assignable hosts. A small table lists the three prefixes on either side, which helps when you are sizing a subnet up or down. It also rejects masks whose 1 bits are not contiguous, such as 255.0.255.0, because no modern router accepts them. It works on the mask alone; it does not take a specific IP address, so it does not show network or broadcast addresses for a host.

How to use it

Type a prefix or a mask
Enter /24, 24 or 255.255.255.0 in the single field; the leading slash is optional.
Read the converted forms
The dotted mask, CIDR prefix, wildcard, binary and hex forms appear together.
Check the host count
Total addresses and usable hosts show how many devices the subnet can hold.
Compare nearby sizes
The table shows the prefixes three bits shorter and longer, with their masks and host counts.

Examples

The common /24

Prefix length or subnet mask: /24

Result Subnet mask: 255.255.255.0
CIDR prefix: /24
Wildcard mask: 0.0.0.255
Binary mask: 11111111.11111111.11111111.00000000
Hex mask: 0xFFFFFF00
Total addresses: 256
Usable hosts: 254

Prefix /24 = 24 network bits followed by 8 host bits.
Binary mask 11111111.11111111.11111111.00000000 = 255.255.255.0 in dotted decimal.
Wildcard = 255.255.255.255 − mask = 0.0.0.255.
Addresses = 2^8 = 256; usable hosts = 256 − 2 = 254.

A /24 gives 256 addresses, of which 254 can be assigned once the network and broadcast addresses are set aside.

Mask 255.255.240.0

Prefix length or subnet mask: 255.255.240.0

Result Subnet mask: 255.255.240.0
CIDR prefix: /20
Wildcard mask: 0.0.15.255
Binary mask: 11111111.11111111.11110000.00000000
Hex mask: 0xFFFFF000
Total addresses: 4,096
Usable hosts: 4,094

Prefix /20 = 20 network bits followed by 12 host bits.
Binary mask 11111111.11111111.11110000.00000000 = 255.255.240.0 in dotted decimal.
Wildcard = 255.255.255.255 − mask = 0.0.15.255.
Addresses = 2^12 = 4096; usable hosts = 4096 − 2 = 4094.

240 is 11110000 in binary, so the mask has 8 + 8 + 4 = 20 network bits.

A /31 router link

Prefix length or subnet mask: 31

Result Subnet mask: 255.255.255.254
CIDR prefix: /31
Wildcard mask: 0.0.0.1
Binary mask: 11111111.11111111.11111111.11111110
Hex mask: 0xFFFFFFFE
Total addresses: 2
Usable hosts: 2

Prefix /31 = 31 network bits followed by 1 host bits.
Binary mask 11111111.11111111.11111111.11111110 = 255.255.255.254 in dotted decimal.
Wildcard = 255.255.255.255 − mask = 0.0.0.1.
Addresses = 2^1 = 2; usable hosts = 2 (special case for /31).

RFC 3021 lets both addresses of a /31 be used on a point-to-point link, so it shows 2 usable hosts.

How it is calculated

mask = p ones followed by (32 − p) zeros; addresses = 2^(32 − p); usable = addresses − 2

p: prefix length, the number of network bits, 0 to 32
wildcard: 255.255.255.255 minus the mask, octet by octet

The prefix length sets that many leading bits to 1; each group of 8 bits becomes one decimal octet, so 11110000 reads as 240. Going the other way, the mask is written in binary and the 1 bits are counted, after checking that no 1 follows a 0. Usable hosts subtract the network and broadcast addresses, except for /31, which RFC 3021 allows on point-to-point links with both addresses usable, and /32, a single host.

When not to use it

For IPv6 networks, which use 128-bit prefixes and no dotted masks.
When you need the network, broadcast and first host of a specific address, which needs an address as well as a mask.

Common mistakes

Pasting a wildcard mask such as 0.0.0.255 where a subnet mask is expected; it reads as a non-contiguous mask.
Forgetting that usable hosts are two fewer than total addresses on most subnets.
Assuming a /31 wastes the link; on point-to-point links both addresses are assignable.

Frequently asked questions

What subnet mask is /24?

255.255.255.0. The first 24 bits are network bits, which fills three octets with 255 and leaves the last octet at 0. It gives 256 addresses and 254 usable hosts.

What is a wildcard mask?

It is the bitwise inverse of the subnet mask, written as 255 minus each octet. Cisco access lists and OSPF network statements use it, so 255.255.255.0 becomes 0.0.0.255.

Why is 255.0.255.0 rejected?

A valid mask must be a run of 1 bits followed by a run of 0 bits. 255.0.255.0 has 1 bits after 0 bits, so it cannot be written as a prefix and routers refuse it.

Why does a /31 show two usable hosts?

RFC 3021 lets a /31 drop the network and broadcast addresses on point-to-point links, so both addresses go to the two routers. Older equipment may not support it.

Which octet values can a mask contain?

Only 0, 128, 192, 224, 240, 248, 252, 254 and 255. Each is a run of leading 1 bits in an 8-bit octet; any other number makes the mask invalid.

How many hosts fit in a /16?

65,536 addresses, of which 65,534 are usable. The mask is 255.255.0.0, and the 16 host bits give 2 to the power 16 combinations.