N10-009 · Networking Concepts · Updated July 29, 2026
CIDR Notation and Subnet Masks: Converting /24 to 255.255.255.0
CIDR (Classless Inter-Domain Routing) notation writes a subnet mask as a slash followed by the number of network bits: /24 means the leftmost 24 bits of the 32-bit address identify the network, leaving 8 bits for hosts. The dotted-decimal equivalent is simply those same bits written out as four octets — 24 one-bits followed by 8 zero-bits is 255.255.255.0. The two notations carry identical information; CIDR is just shorter, and it is what routers, firewalls, and cloud consoles expect.
The mask is a run of ones, and that is the whole rule
A subnet mask is not an arbitrary number. It is always a contiguous run of 1 bits starting from the left, followed by 0 bits to the end. The 1s mark network position, the 0s mark host position, and there is never a gap between them. That single constraint is why only nine values can ever appear in an octet of a valid mask:
binary decimal
00000000 = 0
10000000 = 128
11000000 = 192
11100000 = 224
11110000 = 240
11111000 = 248
11111100 = 252
11111110 = 254
11111111 = 255If you see 255.255.240.255 on an exam, it is invalid on sight — the run of ones is broken by zeros and then resumes. You do not need to calculate anything to reject it.
Converting a prefix to dotted decimal is then mechanical. Fill whole octets with 255 for every full group of 8 network bits, convert the remainder using the table above, and pad with zeros:
/20→ 16 bits fills two octets (255.255), 4 bits remain →11110000= 240 → 255.255.240.0/27→ 24 bits fills three octets, 3 bits remain →11100000= 224 → 255.255.255.224/13→ 8 bits fills one octet, 5 bits remain →11111000= 248 → 255.248.0.0
Going backwards is the same trick in reverse: count the ones. 255.255.252.0 is 8 + 8 + 6 = 22 ones, so it is a /22.
The reference table worth memorising
Most exam arithmetic collapses to a lookup. The block size column is the one that does real work — it is the spacing between consecutive network addresses in the “interesting” octet, calculated as 256 minus that octet’s mask value, and it is the backbone of the technique in finding network and broadcast addresses.
| Prefix | Subnet mask | Block size | Total addresses | Usable hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 1 (1st octet) | 16,777,216 | 16,777,214 |
| /12 | 255.240.0.0 | 16 (2nd octet) | 1,048,576 | 1,048,574 |
| /16 | 255.255.0.0 | 1 (2nd octet) | 65,536 | 65,534 |
| /20 | 255.255.240.0 | 16 (3rd octet) | 4,096 | 4,094 |
| /22 | 255.255.252.0 | 4 (3rd octet) | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 2 (3rd octet) | 512 | 510 |
| /24 | 255.255.255.0 | 1 (3rd octet) | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 4 | 2 |
Total addresses is always 2^(32 − prefix). Usable hosts is that figure minus two, because the all-zeros host pattern is the network address and the all-ones pattern is the broadcast address — neither can be assigned to an interface.
Why the host count is a power of two minus two
The count follows directly from how many bits are left over once the mask claims its share — the mechanic covered in subnetting explained. Consider 192.168.60.64/27. Five host bits give 2^5 = 32 total addresses, spanning 192.168.60.64 through 192.168.60.95. The first, 192.168.60.64, has all host bits zero and names the subnet itself. The last, 192.168.60.95, has all host bits one and is the broadcast address for that subnet. What remains — 192.168.60.65 through 192.168.60.94 — is 30 assignable addresses.
This is also why moving one bit does not change capacity by one. Each bit you shift doubles or halves the block. Going from /27 (30 usable) to /26 (62 usable) does not add two addresses; it adds thirty-two.
The two prefixes that break the minus-two rule
/31 is the documented exception. On a point-to-point link between two routers there is no need for a broadcast address — a frame sent by one end can only reach the other. RFC 3021 therefore permits a /31 to use both of its two addresses as host addresses. This halves the address consumption of every WAN link compared with the traditional /30, which reserves a network and a broadcast address to deliver the same two usable hosts.
/32 describes a single address with no host bits at all. It appears as a host route in routing tables, as a loopback interface address, and as the way an access control list matches exactly one host.
Watch the phrasing on both. A question that stresses conserving address space on router-to-router links is steering you to /31; one that mentions a single loopback or a host route means /32.
Classful defaults are history, not practice
Before CIDR, the first octet implied the mask: 1–126 was Class A (/8, 255.0.0.0), 128–191 Class B (/16, 255.255.0.0), and 192–223 Class C (/24, 255.255.255.0). CIDR removed that coupling entirely — an address beginning with 10 can carry any mask from /8 to /32, and 10.88.0.0/13 is perfectly valid despite “Class A” implying /8.
The exam still tests the old defaults as recall, because the vocabulary survives in documentation and in phrases like “a Class C sized network” meaning 254 hosts. Know the three defaults; do not let them override an explicitly stated mask.
CIDR also enables supernetting — aggregating contiguous blocks into one shorter prefix. Four consecutive /24s starting on a multiple of four, such as 172.26.140.0/24 through 172.26.143.0/24, summarise exactly to 172.26.140.0/22. The summary must start on a boundary that is a multiple of the block size, which is why 172.26.141.0/22 would be a malformed summary.
How the N10-009 exam tests this
- Straight conversion. You are given /26 and asked for the dotted-decimal mask, or given 255.255.254.0 and asked for the prefix. The distractors are always one bit either side, so counting carefully beats estimating.
- Capacity sizing. A scenario names a host requirement — “at least 500 devices” — and asks for the most efficient mask. Find the smallest block whose usable count clears the requirement: 500 needs 2^9 − 2 = 510, so /23. Picking /22 satisfies the hosts but wastes half the space, and that is the trap answer. Several worked examples of this shape appear in the subnetting practice problems.
- Invalid mask spotting. One option in the list has a broken run of ones. It can be eliminated without arithmetic.
- Summarisation. Several contiguous networks are listed and you must pick the single prefix covering exactly those and nothing more. Count the blocks: four /24s aggregate to a /22, eight to a /21.
Speed matters more than method here — timed N10-009 practice questions are the fastest way to make the lookup automatic.
Quick reference
- CIDR prefix = count of leading 1 bits; the dotted mask is those same bits in four octets.
- Valid mask octets are only 0, 128, 192, 224, 240, 248, 252, 254, 255 — anything else is malformed.
- Total addresses = 2^(32 − prefix); usable = that minus 2.
- Block size = 256 − the interesting octet’s mask value; network addresses land on its multiples.
- /31 gives 2 usable addresses on point-to-point links (RFC 3021); /32 is a single host route.
- Classful defaults — /8, /16, /24 — are recall trivia; an explicit mask always wins.
- Summarising n contiguous blocks shortens the prefix by log2(n), and the summary must start on a multiple of the block size.