Cisco inverse subnet masks

Leeched from http://www.cyberflunk.com/~nikm/cisco/masks.html (without permission)

Cisco Netmasks, CIDR sizes, and Inverse Masks

The address/netmask syntax of 172.16.35.0/255.255.255.0 should be familiar to anyone with some experience with IP routing, and is fairly easy to figure out address ranges given a calculator and a piece of scrap paper.
There are other forms of addressing which are used interchangeably which start to get confusing even to experienced routing folks – occasionally people call me experienced and I have a little slip of paper next to my monitor with all the translations on it.
That same network may be addressed as 172.16.35.0/24 or even 172.16.35.0 0.0.0.255 in Cisco access-lists.

Let’s take the address 172.16.35.42.

This address is represented as:

10101100 00010000 00100011 00101010         (172.16.35.42)

to the computer. Now for routing to work, the computer needs to know which addresses are local to the subnet (ie: it can send packets directly to that
computer) or if it needs to use a gateway (‘router’) to get there.
The netmask is used for this. The address and netmask are:

10101100 00010000 00100011 00101010         (172.16.35.42)
11111111 11111111 11111111 00000000         (255.255.255.0)

now say the computer is trying to get to the address 172.16.35.109 we use the AND logical function to see if the networks are the same:

10101100 00010000 00100011 00101010         (172.16.35.42 - my address)
11111111 11111111 11111111 00000000         (255.255.255.0 - my netmask)

10101100 00010000 00100011 00000000         (my address AND netmask = network)

10101100 00010000 00100011 01101101         (172.16.35.109 - remote address)
11111111 11111111 11111111 00000000         (255.255.255.0 - my netmask)

10101100 00010000 00100011 00000000         (remote address AND netmask = network)

See how these are both the same. This means that the source computer can simply send packets directly to the remote computer.

Let’s look at a different example.
Say we wanted to go to 192.48.96.9.

Let’s take a look at the numbers:

10101100 00010000 00100011 00101010         (172.16.35.42 - my address)
11111111 11111111 11111111 00000000         (255.255.255.0 - my netmask)

10101100 00010000 00100011 00000000         (my address AND netmask = network)

11000000 00110000 01100000 00001001         (192.48.96.9 - remote address)
11111111 11111111 11111111 00000000         (255.255.255.0 - my netmask)

11000000 00110000 01100000 00000000         (remote address AND netmask)

A quick comparison shows that these address/netmask comparisons are not the same hence a gateway must be used to get to this address.
The CIDR syntax is simply the number of ones in the netmask and the inverse netmask is just that, the inverse of the netmask.

Looking at 255.255.255.0 you see:

11111111 11111111 11111111 00000000    (255.255.255.0 netmask)
-------- -------- --------             (there are 24 ones, hence this is a /24)
00000000 00000000 00000000 11111111    (0.0.0.255 inverse netmask)

This is one of the simpler cases, things get interesting when you move away from the classical Class A/B/C boundaries.
Below is a translation table of netmask to inverse to CIDR.