What Is a Subnet Mask? A Practical Guide to Subnetting.

Every IPv4 address has two parts: which network it belongs to and which device it is on that network. The subnet mask is what draws the line between them. Once you can read a mask, firewall rules, routing tables and cloud network settings stop looking like magic.

Key takeaways

• A subnet mask marks which bits of an address identify the network and which identify the host.
• CIDR notation writes the mask as a prefix length: 255.255.255.0 is /24.
• A /24 has 256 addresses and 254 usable hosts; each extra prefix bit halves the size.
• The first address is the network address and the last is the broadcast address.
• Two devices talk directly only if they are in the same subnet; otherwise traffic goes through a router.

Addresses are just 32 bits

An IPv4 address like 192.168.10.37 is four 8-bit numbers (octets):

192      .168      .10       .37
11000000 .10101000 .00001010 .00100101

A subnet mask is another 32-bit number made of ones followed by zeros. The ones cover the network part, the zeros the host part:

255      .255      .255      .0
11111111 .11111111 .11111111 .00000000

CIDR notation

Counting the ones gives the prefix length. 255.255.255.0 has 24 ones, so 192.168.10.37/24 means "this address, with a 24-bit network part". CIDR (Classless Inter-Domain Routing) notation is what you will see in cloud consoles, firewalls and routing tables.

Network, broadcast and usable hosts

For 192.168.10.37/24:

The formula for usable hosts is 2^(32 - prefix) - 2. The two subtracted addresses are the network and broadcast addresses.

Common masks

A worked example: splitting a /24

You have 10.20.30.0/24 and need four equal subnets. Borrow two host bits (2^2 = 4), giving /26 subnets of 64 addresses each:

The subnet calculator does this arithmetic for any address and prefix.

How devices use the mask

When a computer sends a packet, it applies its mask to its own address and to the destination:

• Same network? It delivers the packet directly on the local network.
• Different network? It sends the packet to its default gateway (a router).

A wrong mask therefore causes strange half-working networks: a host might reach some neighbours directly and route others through the gateway, or not reach them at all.

Private address ranges

These ranges are reserved for internal networks and are not routed on the internet:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Monitoring services that check from the internet can't reach these addresses. To monitor internal systems, run checks from inside the network - for example with a private location.

Frequently asked questions

• What does /24 mean?

  +

  The first 24 bits of the address identify the network. A /24 network has 256 addresses, of which 254 can be assigned to devices.

• Why are two addresses unusable?

  +

  The all-zeros host address names the network itself and the all-ones address is the broadcast address used to reach every host on it.

• Is a subnet mask used in IPv6?

  +

  IPv6 uses the same prefix idea but only in CIDR form, such as /64. The dotted mask format is IPv4 only.