How it works
A valid CIDR mask is a run of one bits followed by a run of zero bits. Count the leading ones to obtain the prefix. Reject a one bit that appears after a zero.
Worked example
255.255.254.0 contains 8 + 8 + 7 leading ones, so it is /23. Two adjacent /24 address blocks fit inside an aligned /23.
Inputs, edge cases & common mistakes
255.0.255.0 is not a contiguous subnet mask. Do not paste an ACL wildcard here: 0.0.0.255 is a wildcard for /24, not its subnet mask.
Technical references
Reviewed 9 September 2026. Found an issue? Send a correction with a reproducible example.