CIDR, subnet mask and wildcard converter
Convert a prefix length to dotted-decimal mask and wildcard, or validate a contiguous IPv4 subnet mask and recover its CIDR prefix.
What CIDR notation means
CIDR represents an IPv4 prefix with an address followed by a slash and a prefix length. In IPv4, the length ranges from /0 through /32 and indicates how many of the 32 most-significant address bits belong to the prefix. For example, /24 corresponds to 24 leading one bits in the subnet mask and 8 remaining host bits.
CIDR subnet masks are contiguous
For conventional CIDR prefix notation, a subnet mask is formed by a contiguous sequence of one bits from the most-significant side followed only by zero bits. Thus /24 is 11111111.11111111.11111111.00000000, or 255.255.255.0. A pattern such as 255.0.255.0 is not a valid contiguous CIDR subnet mask.
Wildcard mask: inverse of the subnet mask in this conversion
For the CIDR-to-wildcard conversion shown here, each subnet-mask bit is inverted: 255.255.255.0 becomes 0.0.0.255. In Cisco-style ACL matching, a wildcard bit of 0 means the corresponding address bit must match, while a wildcard bit of 1 means that bit can be ignored. Unlike subnet masks, ACL wildcard masks can also be intentionally noncontiguous, so not every possible wildcard represents the inverse of a valid CIDR subnet mask.
How many IPv4 addresses fit in a prefix?
IPv4 has 32 address bits. A /P prefix therefore leaves 32 − P host bits, producing 2^(32−P) addresses in the block. A /24 has 256 addresses, /25 has 128, /26 has 64, /27 has 32, /28 has 16, /29 has 8 and /30 has 4.
/31 is a special and useful point-to-point case
The traditional “total addresses minus network and broadcast” shortcut does not apply to an RFC 3021 /31 point-to-point link. A /31 contains two addresses and, for the limited point-to-point use defined by RFC 3021, both are interpreted as endpoint addresses. The RFC does not generalize this behavior to every type of interface.
/32 identifies a single IPv4 address
A /32 has no host bits and contains exactly one IPv4 address. It is commonly used as a host route, loopback prefix or an exact-address match in routing and policy contexts. It should not be processed with the old “subtract two hosts” rule.
The 256-minus-mask shortcut
For subnetting by hand, identify the first mask octet that is not 255 and subtract it from 256. For /26, the mask is 255.255.255.192, so the increment is 256 − 192 = 64. Subnet boundaries in that octet occur at 0, 64, 128 and 192. The calculator shows the relevant octet and block increment.
CIDR and VLSM are related, but not identical concepts
CIDR provides classless prefix-length notation and aggregation. VLSM — Variable Length Subnet Masking — describes using different prefix lengths inside an addressing plan so subnets can be sized according to need. Both rely on classless prefix handling, but one term should not simply be used as a synonym for the other.
CIDR replaced fixed class boundaries
Modern IPv4 routing is classless: the prefix length explicitly defines the significant network bits. Historical Class A, B and C terminology can still appear in training material, but it is not required to determine a modern CIDR prefix. For example, /20, /23 and /27 are perfectly normal classless prefixes.
How wildcard masks are read in ACLs
In Cisco IP ACL wildcard matching, zero means “check this corresponding address bit” and one means “ignore this bit”. Therefore 192.0.2.0 with wildcard 0.0.0.255 matches values where the first 24 bits must agree and the final eight bits are not checked. Wildcard syntax is a matching mechanism, not another way to configure an interface subnet mask.