Table of Contents
Understanding Subnet Masks
A subnet mask is a 32 bit number that tells you which part of an IPv4 address is the network portion and which part is the host portion. It works together with the IP address. You will use subnet masks constantly when you do subnetting and IP planning, so understanding them clearly is essential.
In this chapter we stay with the basics of subnet masks as a concept. The detailed process of subnetting itself is covered in later chapters.
The Role of the Subnet Mask
Every IPv4 address is divided into two logical parts. One part identifies the network, the other part identifies the host inside that network. The subnet mask is the tool that marks where the split happens.
The subnet mask has 1 bits on the left for the network part and 0 bits on the right for the host part. The mask itself does not change the IP address. It only describes how to interpret it.
For example, consider:
IP address: 192.168.10.25
Subnet mask: 255.255.255.0
In binary form they look like this:
192.168.10.25
$\quad = 11000000.10101000.00001010.00011001$
255.255.255.0
$\quad = 11111111.11111111.11111111.00000000$
The ones in the mask mark the network bits. The zeros in the mask mark the host bits. In this example the first three octets are network, and the last octet is host.
A subnet mask defines:
- How many bits belong to the network.
- How many bits remain for hosts.
- Which IP addresses are valid host addresses in that network.
Valid Subnet Mask Structure
A valid IPv4 subnet mask always has all the 1 bits on the left side and all the 0 bits on the right side, with no mixing.
This pattern is allowed:
11111111.11111111.11111111.00000000
which is 255.255.255.0
This pattern is not allowed:
11111111.11111111.11110011.00000000
because there are zeros in the middle of the ones. That is not a valid subnet mask.
Each octet of a subnet mask can only be one of a few specific values, because of the left aligned 1 bits rule. In binary and decimal, the allowed octet values are:
| Binary | Decimal |
|---|---|
| 00000000 | 0 |
| 10000000 | 128 |
| 11000000 | 192 |
| 11100000 | 224 |
| 11110000 | 240 |
| 11111000 | 248 |
| 11111100 | 252 |
| 11111110 | 254 |
| 11111111 | 255 |
Any subnet mask octet must be one of these values, and the sequence must move from left to right from large to small or equal, for example 255.255.248.0 is valid, but 255.248.255.0 is not.
Subnet Mask and Network Size
The number of 1 bits in the subnet mask determines how many hosts can exist in the subnet. The more bits you use for the network, the fewer bits remain for hosts.
If a subnet mask has $H$ host bits, then there are $2^H$ total addresses defined by that mask. From those addresses, two have special meanings in traditional IPv4 subnetting: the network address and the broadcast address. That leaves $2^H - 2$ usable host addresses.
For example, for mask 255.255.255.0 there are 8 host bits, so:
$2^8 = 256$ total addresses.
$2^8 - 2 = 254$ usable host addresses.
Host address rule (traditional IPv4)
If a subnet has $H$ host bits:
Total addresses: $2^H$
Usable host addresses: $2^H - 2$
Later topics will explain why two addresses are reserved and how they are used.
Dotted Decimal Masks and CIDR Notation
Subnet masks are often written in dotted decimal format, like 255.255.255.0. There is another very common way to write them, called prefix length or CIDR notation. This uses a slash and a number that tells you how many bits are set to 1 in the mask.
For example:
| Dotted decimal mask | Binary mask bits | CIDR (prefix length) |
|---|---|---|
| 255.0.0.0 | 11111111.00000000.00000000.00000000 | /8 |
| 255.255.0.0 | 11111111.11111111.00000000.00000000 | /16 |
| 255.255.255.0 | 11111111.11111111.11111111.00000000 | /24 |
| 255.255.255.255 | 11111111.11111111.11111111.11111111 | /32 |
If you count the number of 1 bits in the subnet mask, you get the prefix length. For example, 255.255.255.0 has three octets of 255. Each octet has 8 bits set to 1, so $3 \times 8 = 24$. That mask is /24.
You can go the other way as well. If you know a network is /26, that means there are 26 bits of 1 and 6 bits of 0, because $32 - 26 = 6$. The subnet mask is:
First 26 bits set to 1:
11111111.11111111.11111111.11000000
In dotted decimal this is:
255.255.255.192
Subnet Mask and Network, Host, Broadcast
With a subnet mask, a device can find three important addresses:
- The network address.
- The broadcast address.
- The valid range of host addresses.
The calculations use binary AND with the mask to get the network address. The host portion is all zeros for the network address and all ones for the broadcast address. The usable host range lies between them. The exact step by step methods will be practiced in the subnetting chapter, but here is one simple example so you see the role of the mask.
Take:
IP: 192.168.1.130
Mask: 255.255.255.0 (/24)
Network bits are the first 24 bits. Host bits are the last 8 bits. The network address has all 0 host bits:
192.168.1.0
The broadcast address has all 1 host bits:
192.168.1.255
The host range is:
192.168.1.1 to 192.168.1.254
The subnet mask provides the pattern that makes these values possible to calculate.
Relationship Between Subnet Mask and Block Size
Within one octet, the subnet mask also defines the block size, which tells you how far apart network addresses are in that octet. This is useful when you quickly want to know the size of subnets.
In any octet where the mask is not 255 and not 0, you can compute the block size as:
Block size = $256 -$ (mask value in that octet).
For example, consider mask 255.255.255.192.
The fourth octet is 192, so:
Block size = $256 - 192 = 64$.
This tells you network addresses occur every 64 addresses in that octet:
0, 64, 128, 192.
So the subnets in the last octet are:
192.168.1.0
192.168.1.64
192.168.1.128
192.168.1.192
Each of these has 64 total addresses. The specific usable host ranges are covered when you perform full subnetting, but the subnet mask here is what defines these blocks.
Block size rule (within one octet)
If a subnet mask octet is not 255 and not 0:
Block size in that octet: $256 -$ mask octet value.
Common Subnet Masks and Usable Hosts
Some subnet masks appear very frequently in real networks. You should be comfortable with their basic properties. The following table assumes traditional subnetting where the first and last addresses of each subnet are reserved.
| Mask (dotted) | CIDR | Host bits $H$ | Total addresses | Usable hosts ($2^H - 2$) |
|---|---|---|---|---|
| 255.255.255.0 | /24 | 8 | 256 | 254 |
| 255.255.255.128 | /25 | 7 | 128 | 126 |
| 255.255.255.192 | /26 | 6 | 64 | 62 |
| 255.255.255.224 | /27 | 5 | 32 | 30 |
| 255.255.255.240 | /28 | 4 | 16 | 14 |
| 255.255.255.248 | /29 | 3 | 8 | 6 |
| 255.255.255.252 | /30 | 2 | 4 | 2 |
You do not have to memorize all of these at once, but the pattern always comes from the subnet mask and the number of host bits it leaves.
Subnet Masks in Host Configuration
On a real device, such as a PC or a router interface, you usually configure three basic IPv4 settings by hand or by DHCP:
- IP address.
- Subnet mask or prefix length.
- Default gateway.
The subnet mask tells the host which other IP addresses are considered part of the same local network. If the destination IP shares the same network address, the host sends traffic directly. If it does not, the host sends traffic to the default gateway instead.
This behavior depends on calculating the network address from the IP and subnet mask, which shows why the subnet mask is essential in any IPv4 configuration.
Summary
Subnet masks define how much of an IPv4 address is network and how much is host. They are written as dotted decimal values or as a prefix length. Valid masks are always a series of 1 bits followed by 0 bits. The number of 1 bits determines the size of the network and the number of host addresses. Subnet masks also define block sizes within an octet, which helps identify network boundaries.
Later chapters on CIDR and subnetting will build on this foundation and show how to use subnet masks to design networks of many different sizes.