Subnet Mask
A subnet mask is like a zip code system for networks. Just as a zip code tells the postal service which neighborhood a house belongs to, a subnet mask tells a computer which part of an IP address is the “neighborhood” (network) and which part is the specific “house” (device). Two devices with the same network portion can talk directly; if the network portions differ, traffic must go through a router.
A subnet mask is a 32-bit value (IPv4) that partitions an IP address into a network prefix and a host identifier. In binary, a subnet mask is a contiguous sequence of 1-bits (network) followed by 0-bits (host). It is never valid to have a 0-bit followed by a 1-bit in a subnet mask.
CIDR notation (Classless Inter-Domain Routing, RFC 4632) expresses the mask as a prefix length: /24 means 24 network bits, equivalent to 255.255.255.0.
The device performs a bitwise AND between the IP address and the subnet mask to determine the network address:
IP: 192.168.1.100 = 11000000.10101000.00000001.01100100
Mask: 255.255.255.0 = 11111111.11111111.11111111.00000000
Result: 192.168.1.0 = 11000000.10101000.00000001.00000000Common subnet masks and their host capacity:
| CIDR | Mask | Hosts | Typical Use |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,214 | Class A, large ISP blocks |
| /16 | 255.255.0.0 | 65,534 | Class B, campus networks |
| /24 | 255.255.255.0 | 254 | Class C, standard LAN |
| /25 | 255.255.255.128 | 126 | Split a /24 in half |
| /30 | 255.255.255.252 | 2 | Point-to-point links |
| /32 | 255.255.255.255 | 1 | Host route, loopback |
Two addresses in every subnet are reserved: the network address (all host bits 0) and the broadcast address (all host bits 1).
Variable Length Subnet Masking (VLSM) allows different subnets within the same address space to use different mask lengths, enabling efficient address allocation.
Subnet calculation with ipcalc
$ ipcalc 192.168.1.0/24
Address: 192.168.1.0 11000000.10101000.00000001. 00000000
Netmask: 255.255.255.0 = 24 11111111.11111111.11111111. 00000000
Wildcard: 0.0.0.255 00000000.00000000.00000000. 11111111
=>
Network: 192.168.1.0/24 11000000.10101000.00000001. 00000000
HostMin: 192.168.1.1 11000000.10101000.00000001. 00000001
HostMax: 192.168.1.254 11000000.10101000.00000001. 11111110
Broadcast: 192.168.1.255 11000000.10101000.00000001. 11111111
Hosts/Net: 254 Class C, Private InternetSubnetting is the foundation of network design. Every firewall rule, VLAN configuration, routing table entry, and access control list references subnet masks. In cloud environments (AWS VPCs, Azure VNets), you define subnets when creating networks, and the mask determines how many instances can live in each subnet. A /28 gives you 14 usable IPs, which is common for small management subnets, while a /20 gives you 4,094 hosts for larger application tiers. Misconfigured subnet masks are a frequent cause of “I can ping some hosts but not others” problems, because the device thinks a remote host is local (or vice versa) and routes traffic incorrectly.