How to Convert CIDR Notation to a Subnet Mask

How to Convert CIDR Notation to a Subnet Mask

Converting CIDR to a subnet mask takes one binary step. Count the bits, fill in ones, convert to decimal.

CIDR notation and dotted-decimal subnet masks express the same information in different formats. Older hardware, Cisco IOS, and some DHCP servers require dotted-decimal masks. Modern cloud consoles and firewall GUIs accept CIDR notation directly. Knowing how to move between formats lets you configure any device regardless of which format it expects.

Binary conversion method

Converting a CIDR prefix to a subnet mask requires filling a 32-bit binary string with n ones followed by (32 minus n) zeros, then grouping into four 8-bit octets and converting each to decimal. For /25: write 25 ones then 7 zeros, giving 11111111.11111111.11111111.10000000. Grouping gives four octets: 255, 255, 255, 128. Consequently, /25 = 255.255.255.128. For /22: write 22 ones then 10 zeros, giving 11111111.11111111.11111100.00000000. The third octet 11111100 = 252. Result: 255.255.252.0.¹ Building on this, the pattern repeats for any prefix. Only the boundary octet (where the ones end) requires binary conversion; preceding octets are always 255 and following octets are always 0.

Common CIDR to mask equivalents

For the most common prefixes, the fourth octet conversions are: /25 → 128 (10000000), /26 → 192 (11000000), /27 → 224 (11100000), /28 → 240 (11110000), /29 → 248 (11111000), /30 → 252 (11111100). Prefixes landing in the third octet: /17 → 255.255.128.0, /18 → 255.255.192.0, /19 → 255.255.224.0, /20 → 255.255.240.0, /21 → 255.255.248.0, /22 → 255.255.252.0, /23 → 255.255.254.0. Building on this, prefixes at exact octet boundaries are trivial: /8 = 255.0.0.0, /16 = 255.255.0.0, /24 = 255.255.255.0. Memorizing the fourth-octet values (128, 192, 224, 240, 248, 252) handles all /25 through /30 conversions without binary arithmetic.¹

Practical application in firewall and router configuration

Cisco IOS requires dotted-decimal subnet masks for interface address commands but uses wildcard masks for ACL rules.² When moving from CIDR documentation to IOS config, convert the prefix to a mask for interface configuration, then invert it for ACL entries. For example, /25 maps to mask 255.255.255.128 for the interface, and you invert that to 0.0.0.127 for the ACL permit statement. Building on this, iptables on Linux accepts both CIDR notation (192.168.1.0/25) and dotted-decimal mask (192.168.1.0/255.255.255.128) for -s and -d arguments. CIDR is simpler to write in iptables, so use the mask form only when interfacing with legacy tools that require it.

Subnet masks in Windows and Linux network configuration

Windows network adapters still accept subnet masks in dotted-decimal format through the GUI at Network Connections > Properties > IPv4, even though PowerShell's New-NetIPAddress accepts CIDR with the -PrefixLength parameter.³ Linux ip addr add 192.168.1.10/24 dev eth0 uses CIDR exclusively, but the legacy ifconfig command requires dotted-decimal masks: ifconfig eth0 netmask 255.255.255.0. Recognizing that 255.255.255.128 is /25 tells you immediately that the subnet holds 126 usable hosts, which is faster than converting mentally each time you encounter an unfamiliar mask in documentation.

Windows GUI versus PowerShell

The Windows GUI masks field at IPv4 adapter properties accepts only dotted-decimal, while PowerShell's New-NetIPAddress and Set-NetIPAddress accept the -PrefixLength parameter directly. When you script adapter configuration in PowerShell, you can pass -PrefixLength 24 instead of -SubnetMask 255.255.255.0, but the GUI still requires the dotted-decimal form. This split means most network engineers keep a small reference table of common masks open when working across both interfaces on the same machine.

Practically, this means a single misconfiguration can slip through when someone copies a -PrefixLength value into the GUI mask box expecting it to mean the same thing. It does not: the GUI field wants 255.255.255.0, not the number 24, so entering 24 there produces an invalid mask that Windows rejects at apply time. Keeping both a CIDR prefix and its dotted-decimal equivalent visible, whether in the calculator or a sticky note, removes the translation step that causes these errors during routine adapter changes.

Linux ip versus ifconfig

The modern ip command uses CIDR exclusively (ip addr add 192.168.1.10/24 dev eth0), while the legacy ifconfig command requires dotted-decimal masks. Most Linux distributions ship ip as the default and deprecate ifconfig, but older scripts and documentation still reference the ifconfig form. When you encounter ifconfig netmask 255.255.255.0 in a script, converting it to /24 lets you migrate the command to the ip tooling that current distributions support.

How DHCP delivers subnet masks to clients

DHCP option 1 delivers the subnet mask alongside the assigned IP address.⁴ RFC 2132 defines the option as a 32-bit value in network byte order, identical to the dotted-decimal representation: 255.255.255.0 for a /24. A DHCP server configured with scope 192.168.10.0/24 automatically sends 255.255.255.0 as option 1 to every client that leases an address in that scope.

How an incorrect DHCP mask breaks routing

An incorrect DHCP mask (sending /16 when the subnet is /24) causes clients to treat the entire 192.168.x.x range as local, bypassing the gateway for addresses beyond the actual subnet. Verifying the mask in DHCP server configuration prevents this class of routing failure, and the CapyToolkit subnet calculator shows the mask alongside the CIDR prefix so you can set both values correctly when configuring DHCP scopes.

Mask-to-prefix conversions in security contexts

Security appliances and firewall platforms sometimes display rules using subnet masks, not CIDR prefixes. FortiOS accepts both formats, but its API returns masks as dotted-decimal strings.⁵ Palo Alto Networks uses CIDR slash notation for IP Netmask address objects (for example, 192.168.80.0/24) and reserves dotted-decimal format for wildcard masks, which have inverted bit semantics.⁶ When exporting firewall rules from one platform to another, converting between mask and prefix notation preserves the intended scope. Building on this, the subnet calculator shows what subnet mask a /22 uses as 255.255.252.0, and a rule permitting 10.0.0.0/255.255.255.0 is functionally identical to 10.0.0.0/24, but some platforms parse the mask differently in handling edge cases around /31 and /32, so always verify after conversion.

Masks beyond /24 and their operational patterns

Prefixes shorter than /24 (masks like 255.255.252.0) are routine in datacenter networks where VLANs span hundreds of hosts. Prefixes longer than /24 (masks above 255.255.255.0) dominate in microsegmentation: /28 (255.255.255.240) for database clusters, /30 (255.255.255.252) for point-to-point links between switches. Network engineers who work primarily with cloud consoles may rarely see dotted-decimal masks in daily work, but exam scenarios (CCNA, CompTIA Network+) and legacy device configurations keep the conversion skill essential.

When to use this

Convert CIDR to a subnet mask when configuring a device that requires dotted-decimal format, such as older Cisco IOS versions, some DHCP server software, and legacy firewall appliances.

Examples

interface GigabitEthernet0/0
 ip address 192.168.1.128 /25

interface GigabitEthernet0/0
 ip address 192.168.1.128 255.255.255.128

iptables -A INPUT -s 10.0.0.0/22 -j ACCEPT

iptables -A INPUT -s 10.0.0.0/255.255.252.0 -j ACCEPT