Subnet mask calculation

CIDR explained what a prefix length means and mentioned that it's equivalent to a dotted-decimal subnet mask. This article is the hands-on companion: how to actually convert between the two, and how to work out a network's usable address range from either one, by hand, without a calculator.

The mask is a filter over the address's bits

A subnet mask is a 32-bit value, written in the same dotted-decimal form as an IPv4 address, where every bit set to 1 marks a network bit and every bit set to 0 marks a host bit. Applying a subnet mask to an address, bit by bit, using a logical AND, extracts the network portion and zeroes out the host portion — which is exactly how a device determines a packet's destination network.

Converting CIDR to a dotted-decimal mask

A /n prefix means the first n bits are 1s, and the rest are 0s. Since each octet is 8 bits, you can build the mask one octet at a time: give each of the first n / 8 full octets the value 255 (eight 1-bits), and if n isn't a multiple of 8, the octet straddling the boundary gets a value from this fixed set of 8-bit patterns:

Worked example: convert /20 to a dotted-decimal mask. Twenty bits: the first two octets are fully 1s (255.255), leaving 4 bits for the third octet (20 − 16 = 4). From the table, 4 bits set gives 240. The fourth octet gets the remaining 0 bits, which is 0. Result: 255.255.240.0.

Converting a dotted-decimal mask back to CIDR

Run the same table in reverse: count the 1-bits in each octet of the mask and add them up. 255.255.248.0 → 8 + 8 + 5 + 0 = 21, so that mask is /21.

Finding the network address, broadcast address, and usable range

Given an IP address and a mask, three values matter for actually using that network:

1. Network address — the address with all host bits set to 0. This identifies the network itself, never a host.
2. Broadcast address — the address with all host bits set to 1. Used to reach every host on the network at once.
3. Usable range — every address between the network and broadcast addresses.

Worked example: 192.168.1.130/26

A /26 mask sets 26 bits to 1, leaving 6 host bits (32 − 26 = 6). Using the table above, 26 bits means the first three octets are 255.255.255, and the fourth octet gets 2 bits set (26 − 24 = 2), which is 192. So the mask is 255.255.255.192.

Now find the boundaries. With 6 host bits, each /26 subnet holds 2⁶ = 64 addresses, and that number is what sets the spacing: successive /26 subnets start every 64 addresses. Within 192.168.1.0/24 that gives four of them — 192.168.1.0, 192.168.1.64, 192.168.1.128, and 192.168.1.192. The address 192.168.1.130 falls between 192.168.1.128 and the start of the next subnet at 192.168.1.192, so it belongs to 192.168.1.128/26.

That's the shortcut. Here's the same answer worked in actual binary, one bit at a time, because the shortcut is only trustworthy once you've done it the slow way and gotten the same result. Only the last octet matters — the first three are fully covered by the /24 boundary already:

        Octet 4 (decimal 130)     Octet 4 (mask, /26 = 2 host bits)
Address:  1  0  0  0  0  0  1  0     Mask:  1  1  0  0  0  0  0  0
                                              (192 decimal)
AND:      1  0  0  0  0  0  0  0   =  128

Every bit the mask sets to 1 keeps the address's bit; every bit the mask sets to 0 gets zeroed regardless of what the address had there. 130 is 10000010 in binary; ANDing it with the mask's 11000000 keeps only the top two bits (10) and zeroes the remaining six — the six bits the mask marked as host bits — giving 10000000, which is 128. That 128 is exactly the network address's fourth octet, confirming the shortcut's answer without trusting the shortcut.

The broadcast address is the same idea run in the opposite direction: instead of zeroing every host bit, set every host bit to 1. 10000000 with its six host bits flipped to 1 is 10111111, which is 191 — matching the table below.

That's 64 total addresses, minus the network and broadcast addresses reserved on either end, leaving 62 usable host addresses — matching the 2^(host bits) − 2 formula from CIDR.

Note the order of reasoning, because it's easy to get backwards: the subnet size (64) comes from the host-bit count, and the mask value (192) is a consequence of the same prefix length. The mask doesn't cause the 64-address spacing — they're two views of the same 26-bit boundary.

Determining whether two hosts share a network

This calculation answers a very practical question: given a host's IP and mask, and another address, can the two talk directly without going through a router? Apply the mask to both addresses (AND each address's bits with the mask's bits) and compare the results — if they match, both hosts are on the same network and can reach each other directly at Layer 2; if not, traffic between them needs a router.

Take 192.168.1.10/24 and 192.168.1.200. Masking both with /24 (255.255.255.0) keeps the first three octets and zeroes the last: both reduce to 192.168.1.0. Same network — direct communication, no router involved. Now compare 192.168.1.10/24 against 192.168.2.10: masking gives 192.168.1.0 and 192.168.2.0 — different networks, so a router has to forward traffic between them, using the default gateway configured on each host.

Run this calculation separately for each host, using each host's own mask, and you get the explanation for the one-way failure in IP addressing: host A with /24 computes 192.168.1.0 for both itself and its neighbour and concludes they're local, while host B with /25 computes 192.168.1.128 for itself and 192.168.1.0 for A and concludes they're not. Both calculations are correct. They just disagree, and nothing in the protocol forces them to agree.

Splitting a network into subnets

Sometimes a design calls for taking one larger allocated block and dividing it into several smaller networks — for instance, an office with a 192.168.0.0/24 allocation that needs to keep three departments on separate broadcast domains. Borrowing bits from the host portion for additional network bits creates that split. Borrowing 2 bits from a /24 (making it a /26) creates four equally sized subnets — 192.168.0.0/26, 192.168.0.64/26, 192.168.0.128/26, 192.168.0.192/26 — each with 62 usable hosts. Borrowing 3 bits instead (a /27) would create eight subnets of 30 usable hosts each. The tradeoff is direct: more subnets means fewer usable hosts per subnet, since the total number of host bits available doesn't change — you're just deciding how to divide it.

Practical scenario: splitting a staging VPC into four subnets

Cloud networks use the same math, even if the console hides some of the arithmetic. Suppose a staging environment receives 10.50.0.0/24, and you want four equal subnets:

Original block: 10.50.0.0/24
Need:           4 equal subnets
Borrow:         2 host bits, because 2^2 = 4
New prefix:     /26
Addresses each: 2^(32 - 26) = 64
Usable each:    62 by IPv4 arithmetic

The resulting blocks are:

That table also shows why overlapping subnets are invalid. 10.50.0.70 belongs to 10.50.0.64/26; it cannot also belong to 10.50.0.0/26. A router or cloud route table needs one clear answer for "which subnet owns this destination?" If two subnets overlap, that answer becomes ambiguous, and most platforms reject the configuration before traffic ever flows.

Common mistakes

• Forgetting the mask must be a contiguous run of 1s followed by 0s. A mask like 255.0.255.0 is invalid — CIDR requires the network bits to be a single unbroken block starting from the left.
• Miscounting host bits when the prefix doesn't fall on an octet boundary. Always compute 32 − prefix_length for the total host bits, then work out which octet the boundary falls in before reaching for the conversion table.
• Assuming the network address or broadcast address can be assigned to a host. They're reserved by definition, except on /31 point-to-point links, which have neither.
• Doing the AND operation in decimal instead of binary. Subnet masking is a bitwise operation — it only gives the right answer when you actually work in binary, or at minimum use the reference table's boundary values rather than guessing.

Practice exercises

1. Convert /28 to a dotted-decimal subnet mask, showing the per-octet calculation.
2. Given the host 172.16.5.50/20, find its network address, broadcast address, and usable host range.
3. An organization has 10.10.0.0/22 and needs to create four equally sized subnets for four separate departments. What prefix length should each subnet use, and what are the four resulting network addresses?
4. Go back to exercise 4 in IP addressing — the three pairs of hosts with mismatched prefixes — and now answer it properly by masking each address with its own mask and comparing the results. For each pair, state whether host 1 thinks host 2 is local, whether host 2 thinks host 1 is local, and what symptom the mismatch would produce.

Self-check: give yourself any address and prefix, out loud, and produce the network address, broadcast address, and usable range within a minute or two on paper. If you can also say, immediately, whether some third address falls inside that range, the mechanical skill is there.

That skill is about to become the tool you reach for constantly, because everything from here on assumes it. But notice what the whole "are these two hosts on the same network?" question is really deciding: whether a host can put a frame directly onto the wire, or has to hand it to a router instead. Putting a frame on the wire needs a different kind of address entirely — one that has nothing to do with IP and doesn't survive past the first hop. That's MAC address.

What a strong answer should include

If asked to subnet an address on the spot — on a whiteboard, in a CCNA-style question, or in an interview — a complete answer covers four things, in this order, and skipping any one of them is what separates a memorized shortcut from actual understanding:

1. The host-bit count, from 32 − prefix length, stated explicitly rather than skipped.
2. The subnet size, 2^(host bits), and where that boundary actually falls — which octet, and at what multiple.
3. The network and broadcast addresses, derived from the boundary, not guessed from the given address.
4. The usable range, as "total minus 2," with the two exceptions (/31, /32) named if they're relevant to the question.

A candidate who jumps straight to a memorized answer without showing which octet the boundary falls in, or why, usually gets caught the moment the interviewer changes the prefix length by one bit and asks for the new answer. The mask-table approach in this article is deliberately mechanical for exactly that reason — it survives a follow-up question that a memorized answer doesn't.

Sources

• IETF, RFC 4632 – Classless Inter-domain Routing (CIDR)
• IETF, RFC 950 – Internet Standard Subnetting Procedure
• Cisco, IP Addressing and Subnetting for New Users