A subnet mask tells which bits of an IPv4 address are the network and which are the host. The mask 255.255.255.0 means the first 24 bits are the network — the same as /24 in CIDR notation.
A mask is just bits
Written in binary, a subnet mask is a run of ones followed by zeros:
255.255.255.0 = 11111111.11111111.11111111.00000000 (/24)
255.255.255.192 = 11111111.11111111.11111111.11000000 (/26)
255.255.0.0 = 11111111.11111111.00000000.00000000 (/16)
The number of ones is the prefix length. That’s why a valid mask can only contain the numbers 0, 128, 192, 224, 240, 248, 252, 254 and 255, with the ones first.
Finding the network address
A computer finds the network with a bitwise AND of the address and the mask:
Address 192.168.1.130
Mask 255.255.255.192
Network 192.168.1.128 (/26)
Two devices are on the same local network when their network parts match. If they don’t, traffic goes to the default gateway (the router).
Common masks
| Mask | Prefix | Usable hosts |
|---|---|---|
| 255.255.255.252 | /30 | 2 |
| 255.255.255.248 | /29 | 6 |
| 255.255.255.0 | /24 | 254 |
| 255.255.254.0 | /23 | 510 |
| 255.255.0.0 | /16 | 65,534 |
Wildcard masks
Some router configurations (Cisco ACLs and OSPF, for example) use a wildcard mask: the subnet mask inverted. For a /24 it is 0.0.0.255. The CIDR calculator shows both.
And IPv6?
IPv6 doesn’t write masks as addresses, only prefix lengths (/64). The principle is the same; see CIDR and subnets.
Typical mistakes
- A wrong mask on one device: it believes a neighbour is on another network, and traffic goes via the router or nowhere.
- An invalid mask such as
255.255.255.100: the ones aren’t contiguous. The validator and calculator reject it.