What is a subnet mask?

Subnet mask meaning

An IPv4 address like 192.168.1.37 is four numbers from 0 to 255, each one 8 bits, so 32 bits in all. Part of those bits names the network and the rest names one device on it. The address alone doesn't tell you where the split is. The subnet mask does.

A mask is also 32 bits. It has a 1 for every network bit and a 0 for every host bit, with all the 1s first. Here is 255.255.255.0 in binary:

Mask 255.255.255.0:  11111111.11111111.11111111.00000000
                     |<----- 24 network bits ----->|<8 host>|

With that mask, 192.168.1.37 is device 37 on the network 192.168.1.0. A "subnet" (short for subnetwork) is simply one of these networks: a group of addresses that share the same network part. Subnet masks were set out in RFC 950 in 1985, so that one organisation could split its addresses into several smaller networks.

CIDR notation: /24 means 24 ones

Writing out 255.255.255.0 is long, so masks are often given as a slash and the number of 1s instead. This is CIDR notation (classless inter-domain routing, RFC 4632). 192.168.1.37/24 means the address 192.168.1.37 with a mask of 24 ones, which is 255.255.255.0. The number after the slash is called the prefix length.

What does a subnet mask do?

Every time your device sends data, it asks one question: is the other device on my network? It answers by comparing network parts, using the mask.

• Same network part: the other device is local, so your device sends the data to it directly, finding its MAC address on the local network.
• Different network part: the other device is somewhere else, so your device sends the data to the router (the default gateway) to pass on.

With a /24 mask, a laptop at 192.168.1.37 sends straight to a printer at 192.168.1.200, because both network parts are 192.168.1. A website at 93.184.215.14 has a different network part, so that traffic goes to the router. A wrong mask breaks this: a device may try to reach local devices through the router, or hunt for distant ones on the local network and never find them.

How to use a subnet mask: the AND method

To find the network address, AND the IP address with the mask, bit by bit. AND gives 1 only when both bits are 1, so network bits pass through unchanged and every host bit becomes 0. You can try AND on our Logic Gate Simulator.

With masks like /8, /16 and /24, you don't even need binary: an octet of 255 keeps the address number and an octet of 0 turns it into 0. So 192.168.1.37 AND 255.255.255.0 gives 192.168.1.0.

Subnet mask example: a mask that splits an octet

The interesting case is a mask whose split falls inside an octet. Take 192.168.10.77/26. The mask is 26 ones: three octets of 255, then 2 more ones, which makes the last octet 11000000, or 192. So the mask is 255.255.255.192. The first three octets pass straight through. For the last one, AND 77 with 192 in binary:

77 (address)   01001101
192 (mask)     11000000
AND            01000000  = 64

So the network address is 192.168.10.64. Check the conversions with our Number Base Converter. The host part is the last 6 bits, so this subnet holds 2⁶ = 64 addresses, from 192.168.10.64 to 192.168.10.127.

Try one: this question gives you an address and a mask and asks for the network address.

Network address, broadcast address and usable hosts

Two addresses in every normal subnet are reserved, so they can't go to a device:

• The network address: all host bits 0. It names the subnet itself, like 192.168.10.64.
• The broadcast address: all host bits 1. Data sent to it reaches every device on the subnet, like 192.168.10.127.

Everything between is the usable host range. For 192.168.10.77/26 that is 192.168.10.65 to 192.168.10.126. With h host bits, the number of usable hosts is:

For /26, h = 32 − 26 = 6, so 2⁶ − 2 = 62 devices. For /24, h = 8, so 2⁸ − 2 = 254. To size a subnet the other way round, find the smallest h that gives enough hosts. An office needing 50 addresses needs h = 6 (62 hosts), because h = 5 gives only 30, so its prefix is /26.

Subnet mask cheat sheet

Every IPv4 prefix you are likely to meet, with its mask and size. The usable hosts column is the total minus 2, except for /31 and /32 (see below).

Three patterns make the table easy to rebuild. Each extra bit on the prefix halves the size of the subnet. Within an octet, the mask number can only be 0, 128, 192, 224, 240, 248, 252, 254 or 255. And the total for any prefix is 2 to the power of (32 − prefix).

The common ones

• /24 subnet mask (255.255.255.0): the usual home network. 254 devices is plenty for a house.
• /23 subnet mask (255.255.254.0): two /24s joined, 510 hosts. The third octet of the network address is always even, so 10.0.4.0/23 runs from 10.0.4.0 to 10.0.5.255.
• /26 to /28: small office and server subnets of 62, 30 and 14 hosts.
• /29 subnet mask (255.255.255.248): 6 usable hosts. Internet providers often give a small business a block this size of public addresses.
• /30 subnet mask (255.255.255.252): exactly 2 usable hosts, the classic choice for a link between two routers.
• /31 and /32: RFC 3021 allows a /31 on point to point links, using both addresses for the two ends with no network or broadcast address. A /32 is one exact address, often used in routing tables and firewall rules.

Default subnet mask: the old classes

Before 1993, the first number of an address decided its mask. These are the "default subnet masks" you still see in older textbooks and in some device settings that fill in a mask for you.

Classes wasted addresses: a company that needed 300 addresses was too big for a class C and had to take a class B of 65,534. CIDR, brought in by RFC 1519 in 1993 and updated by RFC 4632, dropped the classes so a network can have any prefix length. That is why you'll see 10.0.0.0/24 or 172.16.0.0/22 today, even though the old class rules would give those addresses different masks. The private ranges that home routers use (RFC 1918) are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

What is my subnet mask?

Your router hands out the mask automatically with your IP address, using DHCP. To see it:

On almost every home network the answer is 255.255.255.0. You rarely need to change it. If you set a static IP address by hand, copy the mask the router already gives other devices.

Common mistakes

• Treating the mask as an address. 255.255.255.0 isn't a device; it only marks where the split is.
• Forgetting the 2 reserved addresses. A /24 has 256 addresses but 254 usable hosts.
• Using 2^h for usable hosts. Subtract 2, except for /31 and /32.
• Writing an impossible mask. The 1s must all come first. 255.255.0.255 and 255.255.255.100 aren't valid masks.
• Mixing up the prefix and the host bits. /26 means 26 network bits, so 6 host bits, not 26.
• Reading the class rules as current. Since CIDR, any address can have any prefix.

Read next

Computer Science · CoursesIP addressing course: subnets, ports, NAT, DHCP and DNSAn interactive IP addressing course in 25 short sections: octets and bits, subnet masks and CIDR, host counts, ports, TCP and UDP, NAT, DHCP, DNS and IPv6.