Netmask ↔ CIDR Converter

The Netmask to CIDR Converter provides instant bidirectional conversion between dotted decimal subnet masks like 255.255.255.0 and CIDR prefix notation like /24. Enter either format and get the equivalent value along with the wildcard mask, host bits, and total address count.

Understanding Subnet Mask and CIDR Notation

Every subnet boundary can be expressed in two ways, and knowing how to convert between them is one of those small skills that saves you real time every week. The older format is the dotted decimal subnet mask -- four octets like 255.255.255.0 -- which you will still see in Cisco IOS interface configurations, Windows network settings, and older documentation. The newer format is CIDR notation -- a forward slash followed by a number like /24 -- which is the standard in cloud platforms, Terraform, Linux networking, and most modern tools.

The two notations carry exactly the same information. A subnet mask of 255.255.255.0 has 24 contiguous 1-bits followed by 8 zero-bits, which is exactly what /24 means. The conversion is purely mechanical: count the number of leading 1-bits in the mask to get the CIDR prefix, or generate a mask with that many leading 1-bits to go the other direction. The tricky part comes when the boundary does not fall on an octet edge. A mask of 255.255.240.0 has 20 leading 1-bits, making it a /20, but that is not obvious at a glance. This converter handles all 33 valid masks instantly so you never have to do the binary conversion in your head.

This tool also calculates the wildcard mask (the bitwise inverse of the subnet mask), which is essential for anyone writing Cisco ACLs, OSPF network statements, or EIGRP configurations. Instead of manually subtracting each octet from 255, you get the wildcard alongside the conversion result in one step.

How to Convert Between Netmask and CIDR Notation

1. Enter a dotted decimal subnet mask (e.g., 255.255.255.0) or a CIDR prefix length (e.g., /24)
2. The converter counts contiguous 1-bits in the mask to produce the CIDR prefix, or generates the mask from the prefix length
3. The wildcard mask (bitwise inverse) is calculated automatically
4. Results show the total number of addresses and host bits for the given mask

Netmask to CIDR Conversion Reference Table

When to Use This Tool

• Translating between vendor configurations -- Cisco IOS often uses dotted decimal masks while Terraform and cloud platforms use CIDR notation
• Reading legacy documentation -- older network diagrams and configs may use 255.255.255.0 instead of /24
• Configuring cloud VPCs -- AWS, Azure, and GCP require CIDR notation for subnet definitions
• Writing Cisco ACLs -- convert CIDR to wildcard mask for access-list and network statements
• Cross-referencing firewall rules -- ensure rules in different formats reference the same subnet boundary
• Automating infrastructure -- scripts and IaC tools often need to convert between mask formats programmatically

How Subnet Mask and CIDR Notation Works

Subnet Mask Structure

A valid subnet mask is a 32-bit value where all 1-bits are contiguous from the left and all 0-bits are contiguous from the right. There are exactly 33 valid IPv4 subnet masks, from 0.0.0.0 (/0) to 255.255.255.255 (/32).

/24 in binary: 11111111.11111111.11111111.00000000
               └──── 24 network bits ────┘└ 8 host ┘

A value like 255.255.255.1 (binary: 11111111.11111111.11111111.00000001) is invalid because the 1-bits are not contiguous. The converter rejects non-contiguous masks and reports the error.

Wildcard Mask Relationship

The wildcard mask is the bitwise complement of the subnet mask. Where the subnet mask has a 1, the wildcard has a 0, and vice versa.

Subnet Mask:  255.255.255.0   →  11111111.11111111.11111111.00000000
Wildcard Mask:  0.  0.  0.255 →  00000000.00000000.00000000.11111111

Wildcard masks are used in Cisco IOS for ACLs and OSPF network statements. For example, network 10.0.0.0 0.255.255.255 area 0 uses wildcard 0.255.255.255 (the inverse of 255.0.0.0 or /8).

CIDR vs. Classful Addressing

Before CIDR, networks were allocated in fixed classes:

CIDR (introduced in 1993 via RFC 1519) eliminated these fixed boundaries, allowing subnetting at any bit position and enabling route aggregation to slow the growth of global routing tables.

Notation Conversion in Practice

The most common scenario where you need this conversion is when you work with multiple vendor platforms simultaneously. A Cisco switch might show you an interface configured with ip address 10.10.5.1 255.255.254.0, and you need to enter that same subnet into an AWS VPC as a CIDR block. Without converting, it is easy to guess wrong -- 255.255.254.0 is a /23, not a /24, and entering the wrong prefix length in your cloud configuration can either waste address space or, worse, leave hosts unable to communicate because they think they are on different subnets.

Another common pitfall involves the masks that fall on non-octet boundaries. Most network engineers can instantly recognize 255.255.255.0 as /24 and 255.255.0.0 as /16, but what about 255.255.248.0? That is a /21 (21 ones followed by 11 zeros), giving you 2,048 addresses. These mid-octet masks are common in real deployments -- cloud VPCs frequently use /20 or /21 subnets for workloads -- and converting them by hand is error-prone. The reference table above covers the most common ones, and the calculator handles all 33 valid values.

A third area where this conversion matters is in automation. If you are writing Ansible playbooks, Terraform modules, or Python scripts that manage network infrastructure, you will often need to convert between formats programmatically. While the calculation is simple (count leading bits or generate a mask), getting it wrong in code can cause outages. Using this tool to validate your logic against known-good conversions is a quick sanity check before deploying changes.

Frequently Asked Questions

Why do some devices use subnet masks instead of CIDR notation?

Subnet masks in dotted decimal predate CIDR and are the native format on many older operating systems and network devices. Cisco IOS still uses dotted decimal for interface configurations (ip address 10.0.0.1 255.255.255.0) while JUNOS and most modern tools prefer CIDR. The two notations are fully interchangeable.

What is a wildcard mask and when do I need it?

A wildcard mask is the bitwise inverse of a subnet mask. It is used in Cisco ACLs and routing protocol configurations where 0 means "this bit must match" and 1 means "this bit can be anything." For example, access-list 10 permit 192.168.1.0 0.0.0.255 permits all addresses from 192.168.1.0 to 192.168.1.255.

Can a subnet mask have non-contiguous bits?

No. Valid subnet masks must have all 1-bits on the left and all 0-bits on the right. A mask like 255.0.255.0 is not a valid subnet mask. Some legacy ACL wildcard masks can be non-contiguous for advanced matching, but that is a separate use case from subnetting.

What is the difference between /23 and /24?

A /23 has 23 network bits and 9 host bits, yielding 512 total addresses (510 usable). A /24 has 24 network bits and 8 host bits, yielding 256 total addresses (254 usable). The subnet mask for /23 is 255.255.254.0, while /24 is 255.255.255.0. A /23 is essentially two contiguous /24 blocks combined into one subnet.

How do I quickly convert a subnet mask to CIDR in my head?

For octet-boundary masks, it is simple: 255.0.0.0 = /8, 255.255.0.0 = /16, 255.255.255.0 = /24. For masks that split within an octet, memorize the key values: 128=/1 within that octet, 192=/2, 224=/3, 240=/4, 248=/5, 252=/6, 254=/7, 255=/8. So 255.255.240.0 has two full octets (16 bits) plus 240 in the third octet (4 bits), giving /20.

Related Tools

• IPv4 Subnet Calculator - Calculate network, broadcast, and host range from CIDR notation
• Wildcard Mask Calculator - Calculate wildcard masks for ACLs and routing protocols
• Network Address Calculator - Find the network address for any IP and subnet mask
• Total Hosts Calculator - Calculate total number of addresses in a subnet (IPv4/IPv6)
• Usable Hosts Calculator - Calculate number of usable host addresses in a subnet
• IP in Subnet? Checker - Check if an IP address belongs to a specific subnet