Subnet mask cheat sheet: CIDR, wildcard and hosts

This is the table you came for, followed by the few tricks that let you stop needing it. Each row lists a CIDR prefix, its dotted-decimal subnet mask, the Cisco wildcard mask (the inverse), the total number of addresses, and the usable host count after reserving the network and broadcast addresses.

Full reference: /8 to /32

* /31 gives two usable addresses on point-to-point links per RFC 3021; /32 is a single host route. Both skip the usual network/broadcast reservation.

How to read a mask

A subnet mask is always a solid run of 1 bits followed by a solid run of 0 bits. The ones mark network bits, the zeros mark host bits, and the CIDR number is just how many ones there are. Because the boundary can fall anywhere, only nine values ever appear in a mask octet:

bits added:   0    1    2    3    4    5    6    7    8
octet value:  0   128  192  224  240  248  252  254  255

Each step turns on one more bit from the left. If you see any other number (like 255.255.255.100), it is not a valid mask.

The magic-number trick

To find subnet boundaries without binary, take the mask's last non-zero octet and subtract it from 256. That "magic number" is the block size — subnets start at multiples of it.

/26 mask = 255.255.255.192   →   256 − 192 = 64
networks: .0  .64  .128  .192   (steps of 64)

/28 mask = 255.255.255.240   →   256 − 240 = 16
networks: .0 .16 .32 .48 .64 ... (steps of 16)

Given any host address, round it down to the nearest multiple of the magic number to get its network address; add the magic number and subtract one to get the broadcast.

Wildcard mask cheat sheet

A wildcard mask, also called an inverse mask, is the subnet mask with every bit flipped: 0 means "this bit must match", 1 means "ignore this bit". Cisco access lists and OSPF network statements take a wildcard, not a mask. To get one, subtract each octet of the mask from 255. These are the ones you will type most:

! permit the 192.168.10.0/24 LAN in a standard ACL
access-list 10 permit 192.168.10.0 0.0.0.255

! put a /30 router link into OSPF area 0
router ospf 1
 network 10.0.0.0 0.0.0.3 area 0

Converting CIDR ↔ dotted-decimal in your head

• CIDR → mask: fill that many bits with ones. /20 = 8 + 8 + 4 bits → 255.255.240.0 (4 bits in the third octet = 240).
• Mask → CIDR: add up the bits. 255.255.255.248 = 8 + 8 + 8 + 5 = /29 (248 = 5 bits).
• Mask → wildcard: subtract each octet from 255. 255.255.255.0 → 0.0.0.255. Cisco ACLs use the wildcard, not the mask.

Frequently asked questions

What is 255.255.255.224 in CIDR notation?

255.255.255.224 is /27. Count the one bits: 8 + 8 + 8 + 3, because 224 is 11100000 in binary. A /27 has 32 addresses and 30 usable hosts.

What magic number is used for the subnet mask 255.255.255.224?

The magic number is 32, which is 256 minus 224. Subnets of a /27 start at multiples of 32 in the last octet: .0, .32, .64, .96 and so on.

What is 255.255.252.0 in CIDR?

255.255.252.0 is /22: 8 + 8 + 6, because 252 is 11111100. A /22 has 1,024 addresses and 1,022 usable hosts, and its wildcard mask is 0.0.3.255.

What is the wildcard mask for /28?

The wildcard mask for /28 is 0.0.0.15. The /28 subnet mask is 255.255.255.240, and 255 minus 240 is 15.

How many usable hosts are in a /26?

A /26 has 64 addresses and 62 usable hosts, once the network and broadcast addresses are reserved. Its mask is 255.255.255.192.

Is 255.255.255.100 a valid subnet mask?

No. A mask octet can only be 0, 128, 192, 224, 240, 248, 252, 254 or 255, because a mask is a solid run of ones followed by a solid run of zeros. 100 is 01100100 in binary, which breaks that rule.