A subnet mask is a 32-bit number that tells a device which part of an IPv4 address identifies the network and which part identifies the host, and that single split decides whether traffic stays on the local network or gets handed to a router. Every ping you send, every packet your workstation pushes toward a server, starts with that calculation.
Get the mask wrong and the symptoms look nothing like an addressing problem. Two servers on the same switch refuse to talk. DHCP hands out leases that half-work. A route you configured yesterday silently blackholes traffic. At PacketTools, the free browser-based diagnostics we publish for network engineers and sysadmins exist because most “weird network” tickets trace back to boundaries that were drawn incorrectly in the first place.
By the end of this, you will be able to read a mask in either notation, work out the network address, broadcast address, and usable host range by hand, and recognize the specific failure signatures a mismatched mask produces on a live network.
How IPv4 Masks Divide Network and Host Bits
The mask marks every bit of an IPv4 address as either network or host: binary 1s cover the network portion, binary 0s cover the host portion, and the 1s always run contiguously from the left. A /24 mask writes out as 24 ones followed by 8 zeros, which is 255.255.255.0 in decimal notation.
Network Bits, Host Bits, and the Bitwise AND Operation
A device finds the network ID by running a bitwise AND between the IPv4 address and the IPv4 subnet mask. Where the mask bit is 1, the address bit passes through; where it is 0, the result is 0.
Take 192.0.2.130 with 255.255.255.0:
| Binary form | Decimal | |
|---|---|---|
| IP address | 11000000.00000000.00000010.10000010 |
192.0.2.130 |
| Subnet mask | 11111111.11111111.11111111.00000000 |
255.255.255.0 |
| Network prefix | 11000000.00000000.00000010.00000000 |
192.0.2.0 |
| Host identifier | 00000000.00000000.00000000.10000010 |
0.0.0.130 |
The Wikipedia entry on subnetting documents this same AND operation producing the prefix 192.0.2.0, with the host part derived from the address and the ones’ complement of the mask.
Network Address, Host Address, and Broadcast Address
Set every host bit to 0 and you have the network address. Set every host bit to 1 and you have the broadcast address, which reaches every device in the subnet and cannot be assigned to an interface.
Everything between those two is a host address. That is why a /24 holds 256 total addresses but only 254 assignable ones.
Why an IPv4 Mask Is a 32-Bit Number
An IPv4 address is 32 bits, written as four octets of 8 bits each. The mask has to cover the same width bit for bit, so it is also 32 bits long and displayed in the same dotted format.
That symmetry is the whole trick. Because both values are 32 bits, a router or host can compare them with one cheap logical operation at line rate, no lookup table required. If you need a refresher on the address side of this, our IP address basics walkthrough covers the octet structure.
How Masks Drive Local Delivery and Router Decisions
A host uses its own mask to answer one question before sending any packet: is this destination on my network prefix, or somewhere else? That answer decides between direct delivery on the wire and a handoff to the default gateway. Routers run the same math against every entry in their routing tables.
Same-Subnet Traffic vs. the Default Gateway
Your workstation ANDs its own IP with its mask, then ANDs the destination IP with that same mask. Matching results mean the destination is local, so the host resolves the MAC address with ARP and sends the frame directly.
Different results mean remote. The packet goes to the default gateway with the destination IP intact and the gateway’s MAC in the frame header. Note that the destination’s mask never enters into it; the sender only ever uses its own.
How Routers Use Prefixes and Routing Tables
Routers hold prefixes, not individual hosts. A routing table entry pairs a network prefix with a next hop or an outgoing interface, and traffic moves between subnets whenever the routing prefixes of source and destination differ.
This is why a router sits at the logical boundary of every IP network. Add a subnet, add a routing table entry on every router that needs to reach it.
Longest Prefix Match and the 0.0.0.0 Default Route
When several entries match a destination, the router picks the one with the longest prefix. A /28 route beats a /24 route for an address inside both, because the /28 is the more specific statement about where that address lives.
The default route, 0.0.0.0/0, has a prefix length of zero, so it matches everything and loses every tiebreak. It catches whatever nothing else claimed. A point-to-point link between two routers gets a /30 or /31, since only two interfaces need addresses there. When a ping test reaches the gateway but nothing beyond it, a missing or overly specific route is usually the culprit.
CIDR, Dotted Decimal, and Common Prefixes
CIDR notation expresses the same information as a dotted decimal mask by counting the leading 1 bits: /24 and 255.255.255.0 describe an identical boundary. Classless Inter-Domain Routing arrived in 1993 to replace fixed address classes, and prefix length is now the only standards-based way to write an IPv6 subnet.
Translating /24, /25, /26, and /30 Into Decimal Masks
Each additional network bit halves the host space. Keep this table where you can see it:
| CIDR | Subnet mask | Addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Class A network |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Large enterprise |
| /24 | 255.255.255.0 | 256 | 254 | Standard office LAN |
| /25 | 255.255.255.128 | 128 | 126 | Medium LAN |
| /26 | 255.255.255.192 | 64 | 62 | Department subnet |
| /27 | 255.255.255.224 | 32 | 30 | Small department |
| /28 | 255.255.255.240 | 16 | 14 | Small workgroup |
| /29 | 255.255.255.248 | 8 | 6 | Very small segment |
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point WAN links |
The last octet values follow the same binary ladder every time: 128, 192, 224, 240, 248, 252.
Why CIDR Replaced Classful Addressing
Classful addressing offered three sizes and nothing between them. Class A gave an 8-bit network ID with 16,777,214 hosts, Class B a 16-bit network ID with 65,534, and Class C a 24-bit network ID with 254. Class D was reserved for multicast and Class E for experimental use.
An organization needing 2,000 addresses had to take a Class B and strand 63,000 of them. Wikipedia’s account of CIDR notes that the classful method was found not scalable within a decade of DNS appearing, which pushed the IETF toward variable-length prefixes and away from default subnet masks derived from the first octet.
How IPv6 Uses Prefix Lengths Instead of Dotted Masks
An IPv6 address is 128 bits, and there is no dotted mask form for it at all. You write 2001:db8::/32 and the /32 carries the entire boundary definition.
Convention allocates IPv6 subnets on /64 boundaries, leaving 64 bits for the interface identifier. Smaller subnets are never handed to end users.
Calculating Subnets, Address Ranges, and Capacity
Subnetting borrows high-order bits from the host portion and promotes them to network bits. Each borrowed bit doubles the subnet count and halves the hosts per subnet, and every new subnetwork spends two addresses on its own network ID and broadcast address.
Finding Usable Hosts and Subnet Boundaries
Usable hosts come from 2^h − 2, where h is the number of remaining host bits. Six host bits give 62 usable IP addresses, four give 14.
Subnet boundaries come from the block size, which is 256 minus the interesting octet of the mask. A /27 mask ends in 224, so the block size is 32 and the subnets start at 0, 32, 64, 96, and onward. Working the increment beats converting every octet to binary.
Splitting 192.0.2.0/24 Into Smaller Networks
Borrow two bits from the /24 subnet and you get four /26 networks of 62 usable hosts each:
- 192.0.2.0/26, hosts .1 to .62, broadcast .63
- 192.0.2.64/26, hosts .65 to .126, broadcast .127
- 192.0.2.128/26, hosts .129 to .190, broadcast .191
- 192.0.2.192/26, hosts .193 to .254, broadcast .255
Total usable addresses drop from 254 to 248, because each subnet now reserves its own pair. Our IP subnet calculator checks these boundaries in a second when you are mid-change and do not want to trust mental math.
Using VLSM for Efficient Address Allocation
Variable-length subnet masking lets different subnets inside one address space carry different prefix lengths. A department with 50 devices takes a /26, a 20-device team takes a /27, and the router-to-router link takes a /30.
Size largest first, then work down, so the bigger blocks land on clean boundaries. A GeeksforGeeks worked example of departmental address allocation assigns 32 addresses to a 20-device sales team, 16 to a 10-person HR group, and 64 to 50 IT devices from a single Class C range.
Applying Subnetting to Design and Troubleshooting
Good subnet design matches block size to real device counts plus growth headroom, and keeps each broadcast domain small enough that ARP and DHCP chatter stays quiet. Bad design shows up as mask mismatches, overlapping ranges, and hosts that can reach the internet but not the server two racks over.
Segmenting Enterprise Networks Without Over-Subnetting
Size for the device count you will have in three years, then round up to the next prefix. A 40-device floor takes a /26 with 62 usable addresses, leaving room without wasting a full /24.
Over-subnetting has a real cost. Every locally connected subnet needs a separate routing table entry on each attached router, so splitting an enterprise network into dozens of /29s inflates routing complexity and burns two addresses per segment.
Reducing Broadcast Domains, Congestion, and Lateral Exposure
A subnet boundary is a broadcast domain boundary. ARP requests, DHCP discovers, and other broadcast traffic stop at the router, so a flat /16 with thousands of hosts generates congestion that a set of /24s never sees.
The same boundary is where ACLs and firewall rules apply. Putting IoT cameras, finance workstations, and guest Wi-Fi on separate subnets limits how far an attacker moves after compromising one host.
Diagnosing Mask Mismatches, DHCP Errors, and Routing Failures
Mismatched masks produce a signature worth memorizing: two hosts on the same wire, one configured /24 and one /25, where the /25 host thinks its neighbor is remote and ships traffic to the gateway that fails.
Check the mask on every host in the segment first. Other patterns: a DHCP scope whose mask disagrees with the router interface, overlapping ranges on two sites that leave routers unable to choose a path, and subnets too small for the device count, which drives IP address conflicts. For anything past the local segment, network troubleshooting moves to path analysis, and a traceroute shows exactly which hop drops the packet.
Validate Network Details With PacketTools
PacketTools runs free, browser-based diagnostics with no sign-in, no tracking, and no logging of IPs, queries, or test data. The tools run in real time, which matters when you are verifying a change on a production segment.
Confirm your public address with What Is My IP, test reachability across a new boundary, or check the gateway your host learned. The site is built by A. Renfield, a network and security engineer with over 28 years of hands-on experience across enterprise IT, WAN/LAN environments, and infrastructure architecture, using the same diagnostics run in production networks to verify VPNs and analyze routing.
Subnet Masks Make IP Networks Predictable and Manageable
The subnet mask is the one value that turns a flat pool of IP addresses into a structure your routers and hosts can reason about. Thirty-two bits, ones on the left for the network, zeros on the right for the host, and a single bitwise AND that decides local delivery or a trip to the gateway.
Read masks in both notations, know the block size ladder from 128 down to 252, and size each segment to its device count with room to grow. When routing behaves strangely, compare the mask on every host in the segment against the router interface before touching anything else.
Leave a Reply