Subnet Mask Converter

What is Subnet Mask Converter?

A subnet mask converter translates between the three interchangeable ways of writing the same IPv4 network boundary: a CIDR prefix length such as /24, a dotted-decimal mask such as 255.255.255.0, and a wildcard mask such as 0.0.0.255.

What this Subnet Mask Converter does

All three notations describe one 32-bit value. The prefix length counts the leading one-bits; the dotted mask writes those bits out in decimal; the wildcard mask is the bitwise inverse. This converter accepts whichever form you have and derives the rest, along with the block size, the usable host count, the binary layout and the hexadecimal value.

It also rejects masks that cannot exist. A valid IPv4 mask has its one-bits contiguous from the left, so 255.255.0.255 is a well-formed address but not a legal mask — a distinction most converters quietly ignore.

How to use it

1. Enter a prefix length (/26), a dotted mask (255.255.255.192) or a wildcard (0.0.0.63).
2. The tool works out which notation you used, so there is nothing to select.
3. Read across for the other forms, the address count and the usable host count.
4. Use the copy buttons to paste directly into a router, firewall or DHCP configuration.

Understanding your results

Addresses in block — every address the prefix covers, including the network and broadcast addresses.

Usable hosts — normally two fewer, because the first and last addresses name the network and the broadcast domain rather than an interface.

Wildcard mask — the inverse. Cisco access lists and OSPF network statements take a wildcard, not a mask, and swapping the two is a classic reason a rule silently matches nothing at all.

Mask in binary — where the network part ends and the host part begins. Reading this is the fastest way to see why /26 gives four subnets of 62 hosts rather than some other split.

Why this matters

Subnetting is difficult to undo. A block chosen too small forces renumbering across DHCP scopes, firewall rules, monitoring targets and documentation, usually under time pressure. A block far too large wastes space and, on a flat segment, enlarges both the broadcast domain and the reach of anything moving laterally inside it.

The security consequence of an arithmetic slip is quiet. A rule written against 10.0.0.0/16 when the author meant 10.0.0.0/24 admits 255 times more address space than intended, and nothing in the syntax will object.

Common mistakes

Using a wildcard where a mask belongs. 0.0.0.255 and 255.255.255.0 describe the same boundary but are not interchangeable in configuration syntax.

Assuming a /31 has no usable hosts. On point-to-point links RFC 3021 makes both addresses usable, which is why it is the conventional choice for router-to-router links.

Treating /24 as a rule rather than a habit. Nothing requires networks to fall on octet boundaries; /22 and /26 are ordinary and often the better fit.

Limitations

IPv4 only. IPv6 uses prefix lengths in the same way but across 128 bits, with no broadcast address and different conventions for host counts.

This describes what a mask means, not how your network is configured. It cannot tell you whether a range is already allocated, routed or filtered.

Frequently asked questions

References

• RFC 4632 — Classless Inter-domain Routing (CIDR)
• RFC 3021 — Using 31-Bit Prefixes on IPv4 Point-to-Point Links
• RFC 1918 — Address Allocation for Private Internets