This free two-way CIDR converter lets you instantly translate between CIDR prefix notation and dotted-decimal subnet masks. Enter a prefix like /24 to get the subnet mask, wildcard mask, binary representation, and usable host count — or enter a subnet mask like 255.255.255.0 to get the equivalent CIDR prefix. Whether you are configuring a router, setting up a firewall rule, or studying for a networking exam, understanding both formats is essential. If you want to go further and calculate actual IP ranges, use our companion IP Range Calculator.
CIDR Prefix → Subnet Mask
Subnet Mask → CIDR Prefix
CIDR stands for Classless Inter-Domain Routing, a compact way to express both an IP address and its subnet mask in a single string. Before CIDR was standardized in RFC 1518 in 1993, IP addresses were assigned in rigid classes: Class A used a /8 mask, Class B a /16, and Class C a /24. This was extremely wasteful — a company that needed 300 hosts would receive an entire Class B block with 65,534 addresses.
CIDR solved this by allowing any prefix length from 0 to 32. A company needing 300 hosts can receive a /23 (510 usable addresses) instead of wasting a full /16. The prefix number tells you how many of the 32 bits in an IPv4 address are fixed for the network. Learn more about how addresses work in our What Is an IP Address guide.
A subnet mask and a CIDR prefix represent the same information in different formats. The subnet mask is written in dotted-decimal notation (four groups of 0–255), while the CIDR prefix is a single integer. Both describe where the network portion ends and the host portion begins in a 32-bit IP address.
For example, all four of these are equivalent ways to express the same network boundary:
/24255.255.255.011111111.11111111.11111111.000000000.0.0.255The wildcard mask is simply the inverse of the subnet mask — each bit that is 1 in the subnet mask becomes 0 in the wildcard, and vice versa. Wildcard masks are used extensively in Cisco ACLs (Access Control Lists) and OSPF configurations, where you specify which bits of an address must match. Your router uses the subnet mask when you access it at 192.168.1.1 or 10.0.0.1 to determine which devices are local vs. remote.
The table below covers every practically useful CIDR prefix from /8 through /32. Memorizing the most common ones — especially /24, /16, and /8 — is required for most networking certifications.
| CIDR | Subnet Mask | Wildcard Mask | Hosts (Usable) | Binary (last octet) |
|---|---|---|---|---|
/8 | 255.0.0.0 | 0.255.255.255 | 16,777,214 | 00000000 |
/16 | 255.255.0.0 | 0.0.255.255 | 65,534 | 00000000 |
/20 | 255.255.240.0 | 0.0.15.255 | 4,094 | 00000000 |
/22 | 255.255.252.0 | 0.0.3.255 | 1,022 | 00000000 |
/23 | 255.255.254.0 | 0.0.1.255 | 510 | 00000000 |
/24 | 255.255.255.0 | 0.0.0.255 | 254 | 00000000 |
/25 | 255.255.255.128 | 0.0.0.127 | 126 | 10000000 |
/26 | 255.255.255.192 | 0.0.0.63 | 62 | 11000000 |
/27 | 255.255.255.224 | 0.0.0.31 | 30 | 11100000 |
/28 | 255.255.255.240 | 0.0.0.15 | 14 | 11110000 |
/29 | 255.255.255.248 | 0.0.0.7 | 6 | 11111000 |
/30 | 255.255.255.252 | 0.0.0.3 | 2 | 11111100 |
/31 | 255.255.255.254 | 0.0.0.1 | 2 (P2P) | 11111110 |
/32 | 255.255.255.255 | 0.0.0.0 | 1 (host) | 11111111 |
The wildcard mask is the bitwise inverse of the subnet mask. Where the subnet mask has a 1-bit (network), the wildcard mask has a 0-bit (must match exactly). Where the subnet mask has a 0-bit (host), the wildcard mask has a 1-bit (can be anything). This "don't care" logic is why wildcard masks are used in access control lists and routing protocols.
Consider a Cisco ACL rule: permit ip 192.168.1.0 0.0.0.255. The wildcard 0.0.0.255 means "match any IP where the first three octets are 192.168.1 — don't care about the last octet." This is equivalent to allowing the entire 192.168.1.0/24 subnet. Another example: to match only the even-numbered hosts in a /24 (e.g., .0, .2, .4 …), you would use wildcard 0.0.0.254.
Wildcard masks are less intuitive than subnet masks but more powerful. They can describe non-contiguous bit patterns that subnet masks cannot. For home router users, you rarely need wildcard masks directly — but understanding them helps when reading firewall logs or setting up a VPN on your router.
Most consumer routers display the subnet mask in dotted-decimal form, not CIDR notation. When you log into your router at 192.168.1.1 and look at the LAN settings, you will typically see fields like:
Advanced or enterprise routers (pfSense, Ubiquiti, MikroTik) often accept CIDR notation directly, displaying the interface as 192.168.1.1/24. When changing your DNS server on a router or configuring static routes, you may need to enter the network in CIDR format. Use this converter to translate on the fly. If you need to find your router's current IP first, check our router IP finder guide.
The original IPv4 addressing system divided all addresses into three classes based solely on the first octet. Class A (1–126) had 16 million hosts per network. Class B (128–191) had 65,534. Class C (192–223) had 254. This system caused two major problems.
First, address exhaustion: organizations needing more than 254 hosts but fewer than 65,534 were forced to request a Class B, wasting tens of thousands of addresses. Second, routing table explosion: every Class C block required a separate routing table entry, and ISPs were handing out Class C blocks so fast that backbone routers were overwhelmed.
CIDR solved both problems simultaneously. ISPs could allocate exactly the size block a customer needed (e.g., a /23 for 500 hosts), and multiple smaller allocations within a larger block could be aggregated into a single routing entry — a process called supernetting or route summarization. This is also why understanding NAT and DHCP matters for modern network design.
Pro Tip: When a router config asks for both an IP address and a subnet mask separately, always convert them together to verify they are consistent. A mismatch — like entering IP
10.0.1.50with mask255.255.0.0— creates routing confusion because the router thinks the network is10.0.0.0/16rather than10.0.1.0/24. Use this converter alongside our IP Range Calculator to double-check before saving any changes. Also consider updating your router firmware if your interface looks outdated.
Key Takeaways
/24) and subnet masks (255.255.255.0) are two formats for the same information./24=255.255.255.0, /16=255.255.0.0, and /8=255.0.0.0 as the three anchors.The number after the slash (e.g., the 24 in 192.168.1.0/24) represents the number of bits in the 32-bit IP address that are dedicated to the network portion. The remaining bits (32 minus the prefix) are available for individual host addresses. So /24 means 24 network bits and 8 host bits, giving 2^8 = 256 total addresses.
Count the number of consecutive 1-bits in the binary representation of the subnet mask, reading left to right. For 255.255.255.0, the binary is 11111111.11111111.11111111.00000000 — that is 24 consecutive 1-bits, so the CIDR prefix is /24. You can also count by noting that each 255 = 8 bits and each 0 = 0 bits, so 255.255.255.0 = 8+8+8+0 = /24. Use the converter above to do this instantly.
A wildcard mask is the bitwise inverse of a subnet mask. Where the subnet mask has 1 (network), the wildcard has 0 (must match). Where the subnet mask has 0 (host), the wildcard has 1 (don't care). Wildcard masks are used in Cisco ACLs, OSPF network statements, and some firewall rule syntax to define which IPs a rule applies to.
Yes — when the prefix boundary falls in the middle of an octet, the subnet mask will have a value between 1 and 254 in that octet. For example, /25 gives mask 255.255.255.128 (128 = 10000000 in binary), and /26 gives 255.255.255.192 (192 = 11000000). These are called non-octet boundaries and are common in subnetting exercises.
They are the same thing. "Host mask" and "wildcard mask" are two names for the inverse of the subnet mask. Cisco documentation typically calls it a wildcard mask; some other vendors call it a host mask. Both are calculated the same way: subtract each octet of the subnet mask from 255. For 255.255.255.0, the wildcard/host mask is 0.0.0.255.
RFC 3021 (published in 2000) allows /31 subnets to use both addresses for point-to-point links — there is no broadcast or network address reserved. This makes /31 efficient for connecting two routers directly, since a traditional /30 wastes 2 of its 4 addresses on network and broadcast. Modern enterprise routers support RFC 3021; some older equipment does not.
No. CIDR notation is also used with IPv6, where prefix lengths can range from /0 to /128 (since IPv6 addresses are 128 bits). For example, 2001:db8::/32 is an IPv6 CIDR block used for documentation. The concept is identical — the prefix length tells you how many bits identify the network. IPv6 routing tables are built entirely on CIDR principles, with no classful addressing at all.
 |
 |
 |
 |
About Tommy N.
Tommy is the founder of RouterHax and a network engineer with 10+ years of experience in home and enterprise networking. He specializes in router configuration, WiFi optimization, and network security. When not writing guides, he's testing the latest mesh WiFi systems and helping readers troubleshoot their home networks.
Promotion for FREE Gifts. Moreover, Free Items here. Disable Ad Blocker to get them all.
Once done, hit any button as below
|
|
|
|