A subnet mask marks which part of an IP address is the network and which part is the host. To calculate it from a CIDR prefix, write that many 1 bits, fill the remaining bits with 0 to reach 32, and group the result into four octets. A /24 gives 255.255.255.0. The subnet calculator does this for any prefix and also returns the network address, broadcast address and usable host range.
That is the short version. Here is why it works, and how to get the other numbers a network plan needs.
A mask is just bits
An IPv4 address is 32 bits, written as four 8-bit octets in decimal. The mask is also 32 bits, but it is a single run of 1s followed by a run of 0s. The 1s cover the network part of the address and the 0s cover the host part.
The CIDR prefix is simply the count of 1 bits. So a /24 mask is 24 ones and 8 zeros:
11111111.11111111.11111111.00000000 = 255.255.255.0To convert any octet of 1s and 0s to decimal, add the place values of the bits that are set: 128, 64, 32, 16, 8, 4, 2, 1. A full octet (11111111) is 255. An octet of 11111100 is 128+64+32+16+8+4 = 252, which is where a /22 mask gets its 255.255.252.0.
Network and broadcast address
Once you have the mask, two key addresses fall out of it.
- Network address: the IP with every host bit set to 0. You compute it by a bitwise AND of the IP and the mask. For 192.168.1.40 and a /24, the result is 192.168.1.0.
- Broadcast address: the IP with every host bit set to 1. For the same subnet, that is 192.168.1.255.
Every address between those two, not counting the two themselves, is a usable host address. So a /24 gives the range 192.168.1.1 to 192.168.1.254.
Counting usable hosts
The number of host bits is 32 minus the prefix. The total number of addresses is 2 raised to that power, and the usable count is two fewer, because the network and broadcast addresses cannot be assigned to a device.
| Prefix | Mask | Total | Usable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /22 | 255.255.252.0 | 1024 | 1022 |
Two prefixes break the minus-two rule. A /31 is meant for point-to-point links, where RFC 3021 allows both addresses to be used, so it has 2 usable hosts and no broadcast. A /32 describes one exact host.
The wildcard mask
Some equipment, especially Cisco access lists, wants the inverse of the subnet mask, called the wildcard mask. It has 0s where the subnet mask has 1s, and 1s where the mask has 0s. The wildcard for a /24 is 0.0.0.255. The subnet calculator shows both forms so you can paste whichever a device expects.
Doing it without the maths
The bit method is worth understanding, because it is what the hardware actually does, and it is what exams test. Day to day, though, you will want the answer in one step. Enter an IP and a prefix (or paste a full CIDR such as 192.168.1.0/24) into the subnet calculator and it returns the mask, wildcard, network, broadcast and host range at once, with the binary shown so you can verify the bit pattern yourself.