Why one mask has four different spellings
A subnet mask is a single 32-bit number. Everything else — the slash notation, the dotted decimal, the wildcard, the hex string — is a way of writing that number down, and which one you see depends only on which vendor's tool you are looking at. Cisco interface configuration wants dotted decimal. Cisco access lists want the wildcard. Linux, Windows and every cloud provider's VPC console want CIDR. Packet captures and some firewall exports show hex.
The number itself has a rigid shape: n ones followed by 32 − n zeros, and nothing else. That is why a prefix length is a complete description. There are only 33 legal masks, one for each value of n from 0 to 32, and each octet of a legal mask can only take one of nine values: 0, 128, 192, 224, 240, 248, 252, 254 and 255. Any other octet value means someone typed a digit wrong.
The rule exists because routing hardware matches prefixes by comparing a fixed number of leading bits. A mask with a gap in it — 255.255.255.200, binary 11001000 in the last octet — would describe a set of addresses that is not a contiguous range, which no longest-prefix-match lookup can represent. Wildcard masks in ACLs are allowed to have gaps, precisely because ACL matching is done bit by bit rather than by prefix length. That is the one real difference between the two notations, and it is worth remembering.
Converting in each direction
Prefix to mask. Write n ones, pad to 32 bits with zeros, then read the result eight bits at a time. For /26 that is 11111111.11111111.11111111.11000000, and the last octet, 11000000, is 128 + 64 = 192. The arithmetic shortcut avoids the binary entirely: in the octet where the mask breaks, the value is 256 minus the increment, and the increment is 2 raised to the number of host bits in that octet. A /26 leaves 6 host bits in the fourth octet, 26 = 64, and 256 − 64 = 192.
Mask to prefix. Count the 1 bits. Full octets of 255 contribute 8 each, so 255.255.255.192 gives 8 + 8 + 8 and then the partial octet. For the partial octet, subtract it from 256 to get the increment, and take the base-2 logarithm to get the host bits: 256 − 192 = 64, log264 = 6 host bits, so 8 − 6 = 2 network bits in that octet. Total 24 + 2 = 26.
Mask to wildcard. Subtract each octet from 255. 255.255.255.192 becomes 0.0.0.63. Equivalently, the wildcard is the block size minus one, which is why a /26 wildcard is 63 and a /22 wildcard is 1,023 written as 0.0.3.255.
To hexadecimal. Convert each octet to two hex digits and concatenate. 255 is FF, 192 is C0, so /26 is 0xFFFFFFC0. This is the form you see in tcpdump filters and in some vendor APIs.
Worked example: turning 255.255.248.0 into every other notation
A firewall reports an interface mask of 255.255.248.0 and you need the CIDR prefix, the wildcard and the host capacity.
- Count the full octets. The first two octets are 255, contributing 8 + 8 = 16 bits.
- Handle the partial octet. The third octet is 248. The increment is 256 − 248 = 8, and 8 = 23, so that octet has 3 host bits and therefore 8 − 3 = 5 network bits.
- Add them up. 16 + 5 + 0 = 21 network bits, so the mask is /21.
- Confirm in binary.
11111111.11111111.11111000.00000000— twenty-one 1 bits followed by eleven 0 bits. - Block size. 32 − 21 = 11 host bits, 211 = 2,048 addresses. In the third octet the increment is 8, so blocks start at .0.0, .8.0, .16.0 and so on.
- Usable hosts. 2,048 − 2 = 2,046, after removing the network number and the directed broadcast.
- Wildcard. 255 − 255 = 0, 255 − 255 = 0, 255 − 248 = 7, 255 − 0 = 255, giving 0.0.7.255. Check: block size 2,048 − 1 = 2,047 = 7 × 256 + 255. Correct.
- Hexadecimal. FF FF F8 00 → 0xFFFFF800.
Every one of those steps is reversible, which is the point of the tool: enter /21 instead and you get 255.255.248.0 back.
How to read the result
The block size is also the increment. This is the single most useful consequence of the conversion. A /26 has a block size of 64, so subnets of that size start at .0, .64, .128 and .192 in the fourth octet. A /21 has a block size of 2,048, which is 8 × 256, so subnets start every 8 in the third octet. Knowing the increment lets you place a boundary without a tool.
Usable hosts is block size minus two, except at the ends. A /31 has two usable addresses under RFC 3021 because point-to-point links need no broadcast, and a /32 has one because it is a single host route. Everywhere from /0 to /30 the subtraction applies.
Treat a rejected mask as a typo, not a limitation. When this calculator refuses a mask it is because the 1 bits are not contiguous. In practice that means a transposed digit — 255.255.255.240 typed as 255.255.255.204, or 252 typed as 225. The binary form shown in the error message makes the gap obvious.
The mask alone tells you nothing about which network you are on. It describes the shape of the block, not its position. To resolve an actual address to its network number and host range, use the IPv4 subnet calculator.
Complete CIDR prefix to subnet mask table
| Prefix | Subnet mask | Wildcard mask | Block size | Usable hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 |
Wildcard = block size − 1. Usable = block size − 2 except at /31 (RFC 3021) and /32.
The nine-value trick
You never need to convert binary in your head. Memorise the sequence 128, 192, 224, 240, 248, 252, 254, 255 — each is the previous one plus the next halving of 128 — and note that they correspond to 1 through 8 network bits in that octet. Then a mask like 255.255.240.0 reads directly: two full octets is 16, and 240 is the fourth value in the sequence, so 4 more bits, giving /20.
Conversion mistakes that cost an outage
- Putting a wildcard where a mask belongs. Configuring 0.0.0.63 on an interface, or 255.255.255.192 in an OSPF network statement, produces an adjacency that never forms and a route that never appears.
- Reading 255.255.255.0 as /25. The count is of 1 bits, not of octets that are not 255. Three full octets is 24 bits, so 255.255.255.0 is /24.
- Assuming a /24 is always 192.168.x.0. The mask fixes the block size, not the address. A /24 inside 10.0.0.0/8 is just as much a /24.
- Typing a non-contiguous mask. 255.255.255.224 and 255.255.255.242 differ by one keystroke; only the first is legal. Any octet outside the nine legal values is a typo.
- Confusing the mask with the network prefix in IPv6. IPv6 has no dotted-decimal mask notation at all — only prefix length — so a converter like this one has no IPv6 equivalent, and none is needed.
- Forgetting that a /31 or /32 breaks the minus-two rule. Applying it blindly gives 0 and −1 usable hosts, which is where a lot of home-grown scripts fall over.
Where notation conversion fits in a design workflow
Conversion is the smallest of the three addressing tasks, and usually the last one. You start by deciding how many hosts a segment needs, which the hosts per subnet calculator turns into a prefix length. You then place that prefix inside a parent allocation and read off its network number, broadcast and host range with the IPv4 subnet calculator. Only when you go to configure the thing do you need the mask in whatever notation the device speaks — which is this page.
The historical reason for the two notations is worth one paragraph. Before 1993, IPv4 was classful: the first octet implied the mask, so 10.x.x.x was always a /8 and 192.168.x.x was always a /24. Masks were written in dotted decimal because they were an extension bolted onto that scheme by RFC 950. CIDR, defined in RFC 1519 and updated by RFC 4632, made the prefix length an explicit part of every route, and slash notation is simply the compact way to carry it. Dotted decimal survives because operating systems and interface configuration syntax never changed.
One practical note for cloud work: AWS, Azure and Google Cloud all use CIDR exclusively for VPC and subnet definitions, and all three reserve extra addresses beyond the standard two — typically the first few addresses of each subnet for their own gateway, DNS and future use. That reduces the usable count this page reports, so check your provider's documentation before sizing a subnet down to the last address. If those subnets host instances you are paying for by the hour, the cloud VM monthly cost calculator turns the instance plan into a monthly figure.