How to Convert CIDR Notation to a Subnet Mask

A CIDR prefix length such as /24 converts to a subnet mask by writing that many 1 bits, padding the rest with 0 bits, then splitting the 32-bit result into four 8-bit octets and converting each to decimal. /24 becomes 11111111.11111111.11111111.00000000, or 255.255.255.0. The same rule works for any prefix from /0 to /32, and you can verify a hand calculation with the CIDR → Mask converter on Networking Toolbox, which is described as converting CIDR notation (e.g. /24) to subnet mask format (255.255.255.0).

The conversion rule in one line

An IPv4 address is 32 bits. The CIDR prefix tells you how many of those bits are the network portion:

• First N bits = 1 (the network mask)
• Remaining 32 − N bits = 0 (the host portion)
• Group the 32 bits into four octets of 8 and convert each octet to decimal

For /26: 26 ones followed by 6 zeros → 11111111.11111111.11111111.11000000 → 255.255.255.192.

Step-by-step for /26

1. Write 26 ones: 11111111111111111111111111
2. Pad to 32 bits with zeros: 11111111111111111111111111000000
3. Split into octets: 11111111 .11111111 .11111111 .11000000
4. Convert each octet: 255 . 255 . 255 . 192
5. Result: 255.255.255.192

Common CIDR-to-mask reference

*Usable hosts = 2^(32−prefix) − 2, except /31 and /32, which are treated as special cases rather than following the −2 rule.

The pattern to memorize: each step past /24 halves the block and adds a bit to the last octet — 128, 192, 224, 240, 248, 252, 254, 255.

From mask to network, broadcast, and host range

Once you have the mask, you can derive the rest of the subnet with bitwise AND:

• Network address = IP AND mask
• Broadcast address = network address with all host bits set to 1
• Host range = network address + 1 through broadcast address − 1

Worked example: 192.168.10.130/26

1. Mask for /26 = 255.255.255.192
2. AND the IP with the mask:
   • 130 in binary = 10000010
   • 192 in binary = 11000000
   • AND = 10000000 = 128
3. Network address = 192.168.10.128
4. Host bits (6 of them) all set to 1 → last octet 10111111 = 191
5. Broadcast address = 192.168.10.191
6. Usable hosts = 192.168.10.129 – 192.168.10.190

Reverse: mask back to CIDR

To go the other way, count the consecutive 1 bits in the mask from left to right:

• 255.255.255.0 → 8 + 8 + 8 + 0 = /24
• 255.255.255.192 → 8 + 8 + 8 + 2 = /26
• 255.255.240.0 → 8 + 8 + 4 + 0 = /20

If the 1 bits are not contiguous — for example 255.255.255.1 or 255.0.255.0 — the mask is invalid and has no CIDR equivalent. This is a common typo to watch for when reading a mask from a device config.

Verifying with an online converter

The Networking Toolbox CIDR → Mask tool takes a prefix like /24 and returns the dotted-decimal mask, which is useful when you want a fast cross-check against your own arithmetic. The site also lists related subnetting tools — IPv4 Subnet Calculator, IPv6 Subnet Calculator, VLSM Calculator, Supernet Calculator, and Subnet Planner — plus CIDR utilities such as IP Range to CIDR, CIDR Summarizer, CIDR Split, and Wildcard Mask Converter, so you can move between prefix, mask, and range formats without redoing the math by hand.

A practical workflow:

1. Convert /N to a mask manually using the 1-bit rule.
2. Run the same prefix through the converter.
3. If the two disagree, recheck your octet grouping — the error is almost always in the last non-zero octet.

Common mistakes to avoid

• Counting from the wrong end. The 1 bits always start at the leftmost bit of the address, never the right.
• Assuming /31 and /32 follow the −2 rule. They don't; /31 is used for point-to-point links and /32 for a single host.
• Accepting a non-contiguous mask. If the ones aren't continuous, it isn't a valid subnet mask.
• Confusing the mask with the network address. The mask defines the boundary; the network address is the result of ANDing the mask with an IP.