Subnet Mask

What Is a Subnet Mask?

A subnet mask is the number that decides which devices a computer treats as neighbors. Every IPv4 address comes with one, and it's always 32 bits.

On screen it looks a lot like an IP address, four numbers with dots in between. Each number is an octet, which means 8 bits.

Line the mask up under the address, and every 1 marks a network bit. The 0-bits belong to hosts.

Here's an example from a branch office. The laptop in the manager's office uses 192.168.10.25 with a 255.255.255.0 mask. With three octets covered by the mask, the branch is 192.168.10 and the laptop is number 25. The printer and file server also have addresses starting 192.168.10, and the laptop reaches them without involving the router. Anything else leaves through the router.

Every server and laptop has a mask. So does any router or switch port with an IP, and you'll see masks inside firewall rules and cloud subnets as well. Most people never type one in. The DHCP server takes care of it, sending the mask along with each address it gives out.

How Does a Subnet Mask Work?

A subnet mask works by comparing itself with an IP address, one bit at a time. Networking people call this a bitwise AND. If you did it by hand, you'd write both numbers in binary and keep a 1 only where the address and the mask both have one. Whatever's left over is the network address.

Using the same laptop: 192.168.10 passes straight through, because the mask's first three octets are all 1s. The last octet is where it changes. There, 25 (00011001 in binary) meets a row of zeros and becomes 0, giving 192.168.10.0 as the network address.

The laptop repeats the sum for each destination. Run it for the printer at 192.168.10.40 and you get 192.168.10.0 again. Same network, and the packet goes straight across. Try it for a cloud server at 203.0.113.8 and the answer changes; now the packet has to go to the default gateway, the router that links the branch to everything else.

This is a Layer 3 decision in the OSI model, made on IP addresses alone.

One rule applies to every mask. The 1s have to come first, side by side, with the 0s after them. Type 255.0.255.0 into a network settings screen and it will be rejected.

What Does a Subnet Mask of 255.255.255.0 Mean?

A subnet mask of 255.255.255.0 sets the first 24 bits aside for the network. The other 8 are for hosts, and the short way to write it is /24.

Those 8 bits give you 256 addresses, but you can't hand out two of them. The first one, all zeros, is the network's own address. The last one, all ones, is the broadcast address, used to reach every device on the network at once. Devices get the other 254.

A config entry of 192.168.1.1/24 is that same 255.255.255.0 mask, written the short way. Hosts get .1 to .254, and .255 is the broadcast.

Any subnet size can be worked out the same way, and that's most of the math behind subnetting. Raise 2 to the number of host bits and subtract 2; the two you lose are the network and broadcast addresses.

What Is the Default Subnet Mask?

A default subnet mask is the mask an IPv4 address gets automatically under classful addressing. In that scheme, the first octet on its own decides how big a network is.

• Class A: First octet between 1 and 126, mask 255.0.0.0 (/8). 127 is left out; it's the loopback range a device uses to reach itself

• Class B: A first octet from 128 to 191 gets 255.255.0.0, or /16

• Class C: A first octet from 192 to 223 gets 255.255.255.0, the /24 still used on most home networks

Class D is for multicast and Class E is experimental. Neither one has a default mask. Most home routers still arrive with 255.255.255.0 already filled in. Plenty of people have never come across any other mask.

How Is a Subnet Mask Related to CIDR Notation?

A subnet mask and CIDR notation are two ways to write the same network size. CIDR notation (Classless Inter-Domain Routing) is the shorter one: a slash followed by the number of network bits. Count the 1s in 255.255.255.192 and there are 26. In CIDR, that's /26.

With CIDR, networks can be divided at any bit. That's why a routing table today shows /26 or /29 as often as /8, /16 or /24.

Subnetting Cheat Sheet and Subnet Table

A subnetting cheat sheet saves you doing the binary math every time. Find your prefix in the left column, then read across for the mask, the host count and where that size usually gets used. It starts at /16, since /8 and /12 show up mostly as private address ranges and rarely as subnets.

Three common uses:

• Sizing a segment: A new branch needs 50 addresses. A /27 stops at 30 hosts. Step up one size to /26 and you have 62, with some left for growth

• Working out boundaries: Take the last mask number that isn't 255, subtract it from 256, and that's how far apart the subnets are. With a /26, that number is 192, a gap of 64. Subnets then begin at .0, .64, .128 and .192

• Matching size to purpose: For a link between two routers, /30 or /31 is enough. Servers and management gear usually get somewhere between /26 and /28. A single device, like a loopback, a host route or one IP in an access control list, gets /32

How Is a Subnet Mask Different from an IP Address or Default Gateway?

A subnet mask is how the laptop knows who else is on its network. The laptop's IP address belongs to it alone, and the gateway is the router that gets everything else. All three go into every IPv4 interface.

• IP address: The .25 at the end is the laptop's, and no other device can use it

• Subnet mask: The same 255.255.255.0 from earlier. With it, the laptop knows .1 to .254 are on its own network

• Default gateway: Address .1 on the same network. That's the branch router, and it takes traffic bound for other networks

• Subnet: 192.168.10.0/24, covering every address from .0 to .255

On one subnet, the masks have to match, router included. One printer with the wrong mask is enough to lose part of its traffic or send it somewhere it shouldn't go.

Why Is a Subnet Mask Important?

A subnet mask is important because devices use it to find the edge of their own network. Get that wrong and routing goes first; broadcasts, security rules and address plans go with it.

• Routing accuracy: Local traffic goes straight to the printer and the rest goes to the router when the mask is right. A wrong mask sends packets down the wrong path

• Broadcast control: Broadcasts never leave the subnet they start in. Split one large flat network into smaller subnets and you'll see less network congestion on a busy site

• Segmentation and security: Guest Wi-Fi, finance and the security cameras each get their own subnet, usually with a VLAN to match, and the firewall decides what's allowed to cross

• Address planning: A mask sized to fit doesn't waste IPv4 addresses, and you still have room for new devices

What Happens When a Subnet Mask Is Misconfigured?

A misconfigured subnet mask causes some of the most confusing network faults. Some connections work and some don't. In other cases, requests go out and the replies never come back.

The IP address looks fine. Because of that, the mask tends to be the last thing anyone looks at.

• Mask mismatch: Someone types /16 into a printer on a /24 floor. The printer then decides the 192.168.20 network next door is local and stops sending that traffic to the gateway. Users on the next floor can't print

• Overlapping subnets: Two offices were both built on 192.168.1.0/24. Connect them over a VPN and routing between them fails at random

• Wrong gateway mask: Someone set the router port for one range while the hosts behind it use another. Replies go the wrong way

A switch port patched into the wrong VLAN looks no different to the user. The help desk usually starts network troubleshooting by reading the address, mask and gateway off both machines.

How Do Subnet Masks Support Network Observability?

Subnet masks support network observability by giving a monitoring platform its scan ranges. Hand it the branch's /24 and it turns up the laptop, the printer, the file server and the router. It then keeps pulling metrics, flow records and configuration from each one, and observability is built on that data.

• Discovery scope: A network discovery scan covers the subnet or CIDR range you enter and nothing outside it. Get the mask wrong and devices go missing from the inventory

• Grouping and topology: With devices grouped by subnet, a dashboard or topology map (a diagram of how devices connect) shows each branch as one block

• Traffic attribution: A flow record logs which two devices talk and how much data moves. Roll them up by subnet and you can see which segment is using the bandwidth

• Change tracking: Configuration history reveals when an interface mask was edited, often explaining a sudden reachability drop

How Do You Find Your Subnet Mask?

A device's subnet mask is shown in its network settings. There's also a one-line command for each operating system.

• Windows: Type ipconfig in Command Prompt. The mask is on the Subnet Mask line

• macOS: Go to System Settings, choose Network, open Details for your connection and check TCP/IP

• Linux: The ip addr command shows it as a CIDR suffix, for example /24, in place of the dotted form

Do IPv6 Networks Use Subnet Masks?

IPv6 networks use a prefix length in place of a dotted mask. It's written after a slash, as in 2001:db8:10::/64.

/64 is the standard subnet on IPv6 networks and leaves 64 bits for hosts. That's so much space that hosts are rarely counted the way they are in IPv4, and planning is mostly about keeping the address hierarchy tidy.