Subnet Mask Calculator

What a subnet mask does

A subnet mask is a 32-bit value that tells a device which portion of an IP address is the network and which portion identifies the host. Written in dotted-decimal, each bit set to 1 marks a network bit and each bit set to 0 marks a host bit — 255.255.255.0 is 24 one-bits followed by 8 zero-bits, which is exactly what /24 means in CIDR notation. Devices AND the mask against an address to find its network address, and that comparison is how routing and subnet membership get decided.

A valid mask must follow the contiguous-bits rule: all the 1-bits come first, then all the 0-bits, with no mixing. 255.255.255.128 is valid (25 ones then 7 zeros). 255.255.255.253 is not, because 253 is 11111101 in binary — a 0-bit breaks up the run of 1s. And 255.255.255.256 is invalid for an even simpler reason: 256 doesn't fit in a single octet, which only holds values 0–255.

Mask vs. wildcard mask

A wildcard mask is the bitwise inverse of a subnet mask, and it shows up in a different context: Cisco IOS access control lists and OSPF network statements use wildcard masks instead of subnet masks. Where a subnet mask's 1-bits mean "network portion," a wildcard mask's 0-bits mean "must match exactly" and its 1-bits mean "don't care." The mask 255.255.255.0 and the wildcard 0.0.0.255 describe the same /24 boundary — this calculator converts either direction automatically. For ACL and OSPF command examples specifically, see the wildcard mask calculator.