FREN

Networking / Guide

Home / Networking

Subnet masks and CIDR notation

What a mask really says, why it is written /24, how to convert from one notation to the other in your head, and how many machines each network size holds.

Networking Guide Beginner Published October 20, 2026 Translated October 27, 2026 10 min read Version française
Blue network cable plugged into a device
Photo: Jordan Harrison on Unsplash

In plain words

An IP address holds two pieces of information: the network (the street) and the machine (the house). The mask says where one ends and the other begins. 255.255.255.0 and /24 say exactly the same thing, in two different ways.

This guide follows on from IP address, subnet mask, gateway and IP address classes.

1. The postal address analogy

Take the address 192.168.1.42. You can read it like a postal address:

Part Role Postal equivalent
192.168.1 The network, shared by every machine on the local network The street
42 The machine, unique within that network The house number

The mask says how many numbers describe the street. With 255.255.255.0, the first three numbers describe the street and the last one the house number. The more precisely the street is described, the fewer numbers are left: that is the whole principle.

2. What a mask really is

In reality, an IP address is not split into numbers but into bits: 32 binary digits (0s and 1s). The mask is 32 bits long too:

  • a 1 in the mask means "this bit is part of the network";
  • a 0 means "this bit identifies the machine".
Address  192.168.1.42    11000000.10101000.00000001.00101010
Mask     255.255.255.0   11111111.11111111.11111111.00000000
                         <------- network: 24 bits -------> <host>

So a mask is always a run of 1s followed by a run of 0s, never mixed. CIDR notation simply counts the 1s: 24 bits set to 1 is /24.

3. The only possible values

Since the 1s are always packed to the left, a mask byte can only take 9 values:

Mask byte In binary Bits set to 1
0 00000000 0
128 10000000 1
192 11000000 2
224 11100000 3
240 11110000 4
248 11111000 5
252 11111100 6
254 11111110 7
255 11111111 8

A number missing from this list (for example 100 or 250) in a mask means a typing error. Learning this list by heart is 90% of the work: every mask calculation follows from it.

4. Converting between notations in your head

From mask to /

Add up the bits set to 1 in each byte, using the table above:

255.255.255.192  →  8 + 8 + 8 + 2  =  /26
255.255.240.0    →  8 + 8 + 4 + 0  =  /20
255.255.255.252  →  8 + 8 + 8 + 6  =  /30

From / to mask

Fill bytes with 8, then place the remainder:

/20  →  8 + 8 + 4      →  255.255.240.0
/27  →  8 + 8 + 8 + 3  →  255.255.255.224
/12  →  8 + 4          →  255.240.0.0

5. How many machines in a network?

The mask's 0 bits are used to number the machines. With a prefix of n bits, 32 − n bits remain for machines, giving 2^(32 − n) addresses. Subtract two: the network address (all machine bits set to 0) and the broadcast address (all set to 1).

usable machines  =  2^(32 − prefix) − 2
Prefix Mask Total addresses Usable machines Typical use
/16 255.255.0.0 65,536 65,534 Large company site
/22 255.255.252.0 1,024 1,022 Campus Wi-Fi network
/23 255.255.254.0 512 510 Building
/24 255.255.255.0 256 254 Home network, office floor
/25 255.255.255.128 128 126 Half of a /24
/26 255.255.255.192 64 62 Department, VLAN
/27 255.255.255.224 32 30 Small VLAN (servers, printers)
/28 255.255.255.240 16 14 Block of public IPs from an ISP
/29 255.255.255.248 8 6 Small block of public IPs
/30 255.255.255.252 4 2 Link between two routers

The doubling rule

Each bit removed from the prefix doubles the size of the network: a /23 contains two /24s, a /22 contains four. Conversely, going from /24 to /25 cuts the network into two halves of 128 addresses.

6. Three special cases

Prefix What it means Where you see it
/31 Two addresses, both usable (no network or broadcast address, RFC 3021) Point-to-point links between two routers, to save addresses
/32 A single address: one specific machine Firewall rules, host routes, router loopback addresses
/0 Every IPv4 address The default route 0.0.0.0/0: "everything else" goes through the gateway

7. Going further: the wildcard mask

Some devices (Cisco access control lists, OSPF configuration) do not use the mask but its inverse, called the wildcard mask. The bits are flipped: 0s become 1s and vice versa.

In your head, just subtract each byte of the mask from 255:

Prefix Mask Wildcard mask
/24 255.255.255.0 0.0.0.255
/26 255.255.255.192 0.0.0.63
/30 255.255.255.252 0.0.0.3
/16 255.255.0.0 0.0.255.255

Example in a Cisco access list, to match the whole 192.168.10.0/24 network:

access-list 10 permit 192.168.10.0 0.0.0.255

8. Mistakes to avoid

Mistake Why it is wrong
Mask 255.255.0.255 1s and 0s are mixed: this is not a valid mask
Confusing /24 and 255.255.0.0 255.255.0.0 is /16, 256 times more addresses
Two machines on the same network with different masks They do not see the network the same way: some traffic fails in one direction only
Giving a machine the network or broadcast address They are reserved: 192.168.1.0 and 192.168.1.255 in a /24

9. Practice

Question Answer
255.255.255.128 in CIDR notation? /25 (8 + 8 + 8 + 1)
/21 as a mask? 255.255.248.0 (8 + 8 + 5)
Usable machines in a /27? 2⁵ − 2 = 30
Smallest prefix for 100 machines? /25 (126 machines); a /26 only offers 62
Wildcard mask of a /28? 0.0.0.15

Key takeaways

  • The mask separates the network (bits set to 1) from the machine (bits set to 0); /24 simply counts the 1 bits.
  • A mask byte can only take 9 values: 0, 128, 192, 224, 240, 248, 252, 254, 255.
  • Usable machines: 2^(32 − prefix) − 2.
  • One bit less in the prefix means a network twice as large.
  • Wildcard mask: 255 minus each byte of the mask.

Sources

Read next