Network Mask Calculation

What Is a Network Mask?

A network mask (also called a subnet mask or netmask) is a 32-bit binary value that tells a router or host how to split an IP address into its network portion and its host portion. Every bit that is set to 1 in the mask means "this bit belongs to the network address," and every bit set to 0 means "this bit belongs to the host address."

In my day-to-day work configuring routers and diagnosing connectivity issues, I constantly convert between the three representations of the same underlying binary pattern: slash notation (also called CIDR prefix length, like /24), dotted-decimal mask (like 255.255.255.0), and binary mask (like 11111111.11111111.11111111.00000000). These three forms are equivalent — the slash notation is just a count of consecutive 1 bits from the left; the decimal form is those 32 bits grouped into four 8-bit octets. Once you understand the binary, all three make perfect sense.

When I was partitioning a /24 into four /26 subnets for a multi-tier application, I did the mask calculations by hand to double-check the infrastructure-as-code output. Each /26 adds 2 bits to the mask (192 in decimal), and I wanted to be sure no subnets overlapped.

The mask is applied using a bitwise AND operation between the IP address and the mask. If you already understand how bitwise AND works (and if not, our bitwise operations guide covers it in detail), you already know how subnetting works at the binary level. It is the same operation: 1 AND 1 = 1 keeps the bit, 1 AND 0 = 0 clears it.

Converting Slash Notation to Decimal Mask

Slash notation (CIDR notation) is the simplest: the number after the slash tells you how many leading 1 bits the mask has. The remaining (32 - N) bits are zeros. To convert, I write N ones, pad with zeros to reach 32 bits, split into four octets, and convert each octet to decimal.

Here is the conversion formula in a nutshell:

Let me walk through a few more so the pattern becomes clear. For each slash value, the octets where all bits are 1 become 255, octets with a mix of ones and zeros require a quick binary-to-decimal conversion, and octets with all zeros become 0.

Binary Breakdown: Reading the Mask as Bits

Every time I look at a decimal mask, I mentally convert the non-255 or non-0 octets to binary. This tells me exactly where the network-host boundary falls within that octet. The boundary always falls on a bit boundary — never between bits — but it can fall in the middle of an octet.

For example, 255.255.255.192 is a /26 mask. The last octet, 192, has binary 11000000, meaning the top 2 bits of the last octet are part of the network prefix and the bottom 6 bits are the host portion. This tells me each subnet has 2^6 - 2 = 62 usable addresses, and the subnets increment by 64 in the last octet (0, 64, 128, 192).

Binary breakdown of common masks:

255.255.255.192    /26
  Binary:  11111111.11111111.11111111.11000000
  Network bits: 26   |   Host bits: 6
  Subnets: 2^(26-24) = 4   |   Hosts per subnet: 62

255.255.255.224    /27
  Binary:  11111111.11111111.11111111.11100000
  Network bits: 27   |   Host bits: 5
  Subnets: 2^(27-24) = 8   |   Hosts per subnet: 30

255.255.255.248    /29
  Binary:  11111111.11111111.11111111.11111000
  Network bits: 29   |   Host bits: 3
  Subnets: 2^(29-24) = 32  |   Hosts per subnet: 6

The pattern is straightforward: the number of host bits tells you the block size (2^host_bits), and the smallest nonzero value in the interesting octet (the octet where the boundary falls) tells you the subnet increment. For /26, the interesting octet value is 192, and the increment is 256 - 192 = 64.

The Bitwise AND: How Masks Work with IP Addresses

The actual computation a router performs is a bitwise AND between the IP address and the mask. This produces the network address — the base address of the subnet, with all host bits set to zero. I find it helpful to write both the IP and the mask in binary, line them up, and do the AND bit by bit.

Here is how it works for the IP 192.168.5.130 with a /26 mask (255.255.255.192):

IP:      192.168.5.130
Binary:  11000000.10101000.00000101.10000010

Mask:    255.255.255.192
Binary:  11111111.11111111.11111111.11000000

AND:     ---------------------------------------
         11000000.10101000.00000101.10000000

Result:  192.168.5.128  (network address)
Block:   192.168.5.128 - 192.168.5.191
Broadcast: 192.168.5.191  (host bits all 1s)
Usable:  192.168.5.129 - 192.168.5.190 (62 addresses)

Notice what happened: the mask retained the first 26 bits of the IP exactly as they were (because the mask has 1s there) and zeroed out the last 6 bits (because the mask has 0s there). The result 192.168.5.128 is the network address for that subnet. The broadcast address is obtained by setting all host bits to 1: 192.168.5.191. The usable range sits between them.

This same AND operation happens at every hop along a packet's path. When a router receives a packet destined for 192.168.5.130, it ANDs the destination with each route's subnet mask until it finds a match. The most specific match wins — this is called longest prefix match, and it is the fundamental forwarding algorithm of the internet.

Common Network Masks Reference Table

Here is a quick reference I keep handy for the most frequently used masks. The "bits borrowed" column assumes a default Class C (/24) network, which is the most common starting point for subnetting in practice.

Slash   Decimal Mask       Binary Mask                        Hosts       Block
/24     255.255.255.0      11111111.11111111.11111111.00000000   254      256
/25     255.255.255.128    11111111.11111111.11111111.10000000   126      128
/26     255.255.255.192    11111111.11111111.11111111.11000000    62       64
/27     255.255.255.224    11111111.11111111.11111111.11100000    30       32
/28     255.255.255.240    11111111.11111111.11111111.11110000    14       16
/29     255.255.255.248    11111111.11111111.11111111.11111000     6        8
/30     255.255.255.252    11111111.11111111.11111111.11111100     2        4
/16     255.255.0.0        11111111.11111111.00000000.00000000  65534    65536
/8      255.0.0.0          11111111.00000000.00000000.00000000  16.7M   16.7M

The /30 mask is special: it provides exactly 2 usable host addresses per subnet, making it the standard for point-to-point links between routers. You will see /30 and /31 (which allows 2 addresses with no broadcast) on WAN interfaces between provider and customer equipment.

Wildcard Masks: The Inverse

A wildcard mask is simply the bitwise NOT of the subnet mask. Where the subnet mask has a 1, the wildcard mask has a 0, and vice versa. Wildcard masks are used in Cisco IOS access control lists (ACLs) and OSPF network statements to specify which bits of an address must match exactly and which can vary.

For a /24 network with mask 255.255.255.0, the wildcard mask is 0.0.0.255. This means "match the first three octets exactly; allow any value in the last octet."

The quick way to compute a wildcard mask: subtract each octet of the subnet mask from 255. For 255.255.240.0, that gives 0.0.15.255. No binary conversion needed — just make sure the result makes sense (it should have a contiguous block of zeros corresponding to the network bits).