Subnet Masks Explained

What a Mask Does

A subnet mask partners with a 32-bit IPv4 address to answer one question: which bits identify the network, and which identify the individual host? Think of a postal address — "city and street" tells you the neighborhood (the network), while the "house number" identifies the specific building (the host). Wherever the mask has a 1, that address bit belongs to the network portion; wherever it has a 0, that bit belongs to the host portion. So for 192.168.10.50 with mask 255.255.255.0, the first three octets (192.168.10) are the network and the final octet (50) is the host.

Figure 4.1: How the mask splits an address into network and host portions

A valid mask must be contiguous: a solid run of 1-bits followed by a solid run of 0-bits, ones first, then zeros, with no interleaving. Because the 1s all come first, the boundary between network and host is a single point in the 32-bit string — a clean tear rather than a shredded strip. The bits must be contiguous, but they are not required to land on octet boundaries; that freedom is what makes masks like /26 (255.255.255.192) legal.

A mask is written just like an IP address — four dotted-decimal octets — but its meaning is clearest in binary. 255.255.255.0 expands to:

11111111.11111111.11111111.00000000

The 24 leading ones say "the first 24 bits are network"; the 8 trailing zeros say "the last 8 bits are host." That is exactly what CIDR captures as /24 — the prefix length is simply the count of 1-bits in the mask. The value 255 recurs because it is an octet with all eight bits set (128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255); a fully "host" octet reads as 0.

Common Subnet Masks

Three masks show up constantly because they fall precisely on octet boundaries:

• 255.0.0.0 (/8) — 11111111.00000000.00000000.00000000. First octet network; last three host.
• 255.255.0.0 (/16) — 11111111.11111111.00000000.00000000. First two octets network; last two host.
• 255.255.255.0 (/24) — 11111111.11111111.11111111.00000000. First three octets network; last octet host — the classic "one office LAN."

Because each octet is either fully 255 or fully 0, you read the split just by looking at which octets are 255 — no binary math needed. But the boundary is allowed to fall inside an octet, and then that octet shows a value other than 0 or 255. As network bits fill from the high (left) end, an octet can only ever take one of nine legal values:

These nine values let you translate quickly between a CIDR prefix and a mask. Worked example — /26: 26 network bits = 24 bits (three octets of 255) + 2 more bits in the fourth octet. Two high-end bits give 11000000 = 192, so /26 = 255.255.255.192. The final octet is neither 0 nor 255, yet the mask is perfectly valid.

The reference table below is one of the most-consulted tools in networking. It maps CIDR prefixes to their dotted-decimal mask, the inverse wildcard mask, the total addresses, and the usable hosts.

The wildcard mask is the bit-for-bit inverse of the subnet mask, found by subtracting each octet from 255. It looks identical on paper but carries the opposite meaning: in a subnet mask a 1 means "part of the network," while in a wildcard mask a 0 means "must match exactly" and a 1 means "don't care." Wildcard masks put their 0s at the beginning, so a larger CIDR prefix produces a smaller wildcard mask. They appear in Cisco ACLs and OSPF/EIGRP network statements — e.g. access-list 10 permit 192.168.1.0 0.0.0.255 matches all of 192.168.1.0/24. Unlike subnet masks, wildcard masks are not required to be contiguous, letting them match patterns like only odd or only even subnets.

Applying the Mask

The mask is applied through a bitwise AND: IP address AND subnet mask yields the network address. The AND truth table is 1&1=1, 1&0=0, 0&1=0, 0&0=0. The hidden pattern: AND-ing any bit with 1 preserves it, while AND-ing with 0 clears it to 0. Because the mask has 1s over the network portion and 0s over the host portion, the operation keeps the network bits exactly as they are and zeroes every host bit.

Worked example — 192.168.10.50 with 255.255.255.0:

IP address :  192.168.10.50   = 11000000.10101000.00001010.00110010
Subnet mask:  255.255.255.0   = 11111111.11111111.11111111.00000000
------------------------------  AND ---------------------------------
Network    :  192.168.10.0    = 11000000.10101000.00001010.00000000

In the first three octets the mask is all 1s, so 192, 168, and 10 pass through unchanged. In the fourth octet the mask is all 0s, so the host value 50 (00110010) is cleared to 0 — giving the network address 192.168.10.0. This is exactly how a router decides local vs. remote: every host that produces the same AND result is on the same subnet.

Figure 4.2: The bitwise AND process for deriving a network address

The leftover bits — everything the mask marked with a 0 — are the host portion. Overlaying the mask on the address makes the split obvious:

Address :  192 . 168 . 10 . 50
Mask    :  255 . 255 . 255 . 0
Role    :  NET   NET   NET   HOST

For non-octet-aligned masks the same overlay works at the bit level — the boundary just lands partway through an octet, splitting one octet into some network and some host bits.

The mask also dictates how many hosts a network can hold. Let n be the number of host bits, where n = 32 − prefix. Then total addresses = 2ⁿ and usable hosts = 2ⁿ − 2. The "minus 2" reserves the all-zeros host address (the network address) and the all-ones host address (the broadcast address).

Figure 4.3: Deriving host capacity from the prefix

Worked example — a /24: n = 32 − 24 = 8 host bits, so 2⁸ = 256 total and 256 − 2 = 254 usable — matching the reference table. The point-to-point case — a /30: n = 32 − 30 = 2 host bits, so 2² = 4 total and only 4 − 2 = 2 usable, exactly what a router-to-router link needs (one address per end). The design lesson: the more network bits you commit, the fewer host bits remain, so choosing a mask is always a trade-off between number of subnets and hosts per subnet — the tension that VLSM later resolves.