A subnet mask is a 32-bit value that marks which part of an IPv4 address identifies the network and which part identifies the individual host. In networking and address configuration, it is one of the three parameters every IPv4 interface needs, alongside the address itself and the default gateway, and it decides whether a destination is on the local segment or must be sent to a router.
A mask is written either in dotted-decimal notation, such as 255.255.255.0, or as a CIDR prefix length, such as /24. Both forms express the same thing: a run of consecutive one bits for the network portion followed by zero bits for the host portion. The mask is usually delivered automatically by DHCP, but it is also set manually on servers, routers and devices with static addresses.
How a subnet mask divides an address
A subnet mask divides an address through a bitwise AND operation: combining the address with the mask keeps the network bits and clears the host bits, which yields the network address. Two hosts belong to the same subnet exactly when this operation gives the same result for both of them.
Take the address 192.168.10.37 with the mask 255.255.255.0. The first three octets are covered by ones, so the network is 192.168.10.0 and the host part is 37. Setting all host bits to one gives the broadcast address, 192.168.10.255, and the usable host range lies between these two values.
When a host sends a packet, it applies its own mask to the destination. If the destination falls inside the local subnet, the host resolves the MAC address with ARP and delivers the frame directly; otherwise it sends the packet to its default gateway. This single decision is why a wrong mask produces such confusing symptoms.
Common subnet mask values
The most widely used masks fall on or near octet boundaries, and each additional network bit halves the number of available host addresses. The usable host count is two to the power of the host bits, minus two for the network and broadcast addresses.
| Prefix | Dotted-decimal mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Very large private ranges |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Campus or site summary |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Large client or wireless network |
| /24 | 255.255.255.0 | 256 | 254 | Typical office or home LAN |
| /27 | 255.255.255.224 | 32 | 30 | Small server or device segment |
| /30 | 255.255.255.252 | 4 | 2 | Legacy point-to-point link |
| /31 | 255.255.255.254 | 2 | 2 | Point-to-point link per RFC 3021 |
| /32 | 255.255.255.255 | 1 | 1 | Single host route or loopback |
Only contiguous masks are valid in modern practice. A value such as 255.255.0.255 was technically possible in early specifications, but current equipment rejects it, and every legal octet value is one of 0, 128, 192, 224, 240, 248, 252, 254 or 255.
Subnet mask compared with related notations
The subnet mask is one of several ways to express the same boundary, and different systems prefer different forms. Confusing them is a frequent source of configuration errors, especially with access control lists on routers.
| Notation | Example for a /24 | Where it is used |
|---|---|---|
| Subnet mask | 255.255.255.0 | Host settings, older operating system dialogs |
| CIDR prefix length | /24 | Routing tables, cloud networks, modern tools |
| Wildcard mask | 0.0.0.255 | Router ACLs and OSPF network statements |
| IPv6 prefix length | /64 for a typical LAN | All IPv6 configuration |
The wildcard mask is the bitwise inverse of the subnet mask, so its zero bits must match and its one bits are ignored. IPv6 has no dotted subnet mask at all: it uses only prefix lengths, and a standard LAN uses a /64 because SLAAC builds the host part from the remaining 64 bits.
Choosing a subnet mask in practice
Choosing a mask means balancing address capacity against broadcast scope and administrative clarity. Larger subnets waste fewer addresses on boundaries but put more devices in one broadcast domain, while smaller subnets improve isolation but require more routing and more DHCP scopes.
| Situation | Recommended prefix | Reason |
|---|---|---|
| Office floor with about 150 clients | /24 | Room for growth, easy to read |
| Guest wireless with 600 devices | /22 | Enough leases without excessive broadcasts |
| Server segment with 20 hosts | /27 | Tight scope for firewall rules |
| Router-to-router link | /31 | No address wasted on broadcast |
| Cloud virtual network | /16 split into /24s | Space for future subnets |
Variable-length subnet masking (VLSM) allows different prefix lengths inside one address block, so a site can carve a /24 into a /25 for clients, a /26 for servers and several /30 or /31 links. Planning the largest subnets first avoids overlapping ranges, which routers cannot resolve.
Common subnet mask mistakes
A mismatched mask between hosts on the same segment is the classic error, and it rarely causes a total outage. Instead, some destinations work and others fail, depending on whether each host believes the other is local.
- Mask too large on one host: it treats remote addresses as local, sends ARP requests that nobody answers and never uses the gateway for them.
- Mask too small on one host: it sends traffic for local neighbors through the gateway, which works slowly or is dropped by the firewall.
- Gateway outside the subnet: the host cannot reach its own gateway, so all off-subnet traffic fails.
- Overlapping subnets across a VPN: two sites using the same 192.168.1.0/24 cannot route to each other without address translation.
The reliable remedy is to distribute the mask centrally through DHCP and to document every static assignment. When troubleshooting, comparing the output of the interface configuration on both ends of a failing connection usually reveals the mismatch within minutes.
In simple terms
An IP address works a little like a postal address with a street name and a house number. The subnet mask tells a computer where the street name ends and the house number begins. Everyone on the same street can be visited directly, while any other street requires a trip through the local post office, which in a network is the router.
If a computer gets the mask wrong, it misjudges who lives on its street. It may knock on doors that are actually far away, or send letters through the post office to a neighbor next door. A correct mask keeps local traffic local and sends everything else the right way.
A practical example
A small accounting firm expands from 40 to 90 workstations and adds a separate segment for printers and a network storage device. The administrator keeps the existing 192.168.20.0/24 for workstations and assigns 192.168.21.0/27 to the printers and storage, which gives 30 usable addresses and lets the firewall apply one compact rule to the whole device group.
A week later, two laptops cannot print while all other machines can. Their network settings show a manually entered mask of 255.255.0.0, left over from an earlier test. With that mask, the laptops consider the printer segment local, send ARP requests that never cross the router and receive no answer. Switching both laptops back to DHCP restores the /24 mask, and printing works immediately without any change to the printers.