Explainer · networking

What is a subnet mask? Subnetting and CIDR notation explained

A subnet mask is the piece of configuration that tells a device which part of an IP address identifies the network and which part identifies the host. Once you can read that split in binary, subnetting, CIDR notation, and the whole 255.255.255.0 business stop being mysterious. Here is the plain version, with every number worked out.

What a subnet mask actually is

Every IPv4 address is 32 bits long, usually written as four decimal numbers separated by dots — for example 192.168.1.42. But an address on its own does not tell a device where the boundary between “my local network” and “everywhere else” sits. That boundary is exactly what the subnet mask supplies.

A subnet mask is also 32 bits. Read left to right, it is a run of 1 bits followed by a run of 0 bits — always in that order, never mixed. The 1 bits mark the network portion of the address; the 0 bits mark the host portion. Two devices are on the same subnet — and can talk directly without a router — when the network portion of their addresses is identical.

When your computer wants to send a packet, it lines the destination address up against its own address and mask. If the network portions match, it delivers the packet directly on the local link. If they differ, it hands the packet to the default gateway (your router) to forward onward. That single comparison is the entire job of the mask.

The binary intuition: why 255.255.255.0 = /24

The reason 255.255.255.0 is the most common mask you will ever see is that 255 is what you get when all eight bits of a byte are 1 (11111111 in binary is 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255), and 0 is all eight bits off. So this mask is:

255.255.255.0
11111111.11111111.11111111.00000000
└────────── 24 ones ──────────┘└ 8 zeros ┘

Twenty-four 1 bits, then eight 0 bits. Counting the leading 1 bits is exactly what CIDR notation does: it writes the mask as a slash followed by the number of network bits. Twenty-four network bits is /24. So 255.255.255.0 and /24 are two ways of writing the same thing.

Every byte in a mask is one of just nine values, because the 1 bits have to be contiguous from the left: 0 (00000000), 128 (10000000), 192 (11000000), 224 (11100000), 240 (11110000), 248 (11111000), 252 (11111100), 254 (11111110), and 255 (11111111). If you ever see a mask byte that is not on this list — say 255.255.100.0 — it is malformed.

A few masks you will meet constantly: /8 is 255.0.0.0, /16 is 255.255.0.0, /24 is 255.255.255.0, and /25 is 255.255.255.128 (the fourth byte is 10000000 = 128).

CIDR notation and prefix lengths

CIDR stands for Classless Inter-Domain Routing. Before CIDR, IPv4 was carved into rigid “classes” (A, B, C) with fixed 8-, 16-, and 24-bit boundaries, which wasted enormous amounts of address space. CIDR threw that out in favour of a simple idea: the network boundary can sit at any bit position, and you just state where with a prefix length from /0 to /32.

The prefix length is the count of network bits. Everything to its right is host bits. Because IPv4 has 32 bits total, the number of host bits is always 32 − prefix. That single subtraction drives every other number:

The smaller the prefix number, the bigger the network. A /16 holds 65,536 addresses; a /24 holds 256; a /30 holds just 4. Every step of +1 on the prefix halves the block size.

Worked example 1: 192.168.1.0/24

Start with the classic home-network block 192.168.1.0/24. The prefix is 24, so there are 32 − 24 = 8 host bits, and 2^8 = 256 total addresses. To find the key addresses:

This is why a typical home router hands out addresses like 192.168.1.100 and reserves 192.168.1.1 for itself: they all share the 192.168.1 network portion, so every device on the LAN can reach every other device directly.

Worked example 2: 10.0.0.0/22 (a non-/24 block)

A /24 is easy because the boundary lands neatly on a byte. Most of the confusion in subnetting comes from prefixes that split a byte in the middle. Take 10.0.0.0/22. The prefix is 22, so there are 32 − 22 = 10 host bits and 2^10 = 1024 total addresses.

The mask for /22 is 255.255.252.0. The third byte is 11111100 = 252, meaning the first 6 bits of that byte are network and the last 2 are host. Blocks therefore step through the third byte in multiples of 4: 10.0.0.0, 10.0.4.0, 10.0.8.0, and so on.

Notice that 10.0.4.0 is not part of this subnet — it is the network address of the very next /22. Getting the block boundaries right is the whole skill, and it is exactly what a CIDR calculator is for.

Worked example 3: 192.168.1.0/26 (splitting a /24 into four)

Now split a byte the other way. A /26 has 32 − 26 = 6 host bits, so 2^6 = 64 addresses per block, and 64 − 2 = 62 usable hosts. The mask is 255.255.255.192 (the last byte is 11000000 = 192).

Because each block is 64 addresses wide, a single 192.168.1.0/24 divides cleanly into four /26 subnets:

Four subnets of 62 usable hosts each — a common way to hand different departments or VLANs their own slice of a larger block while keeping the numbering tidy.

Why subnetting exists

Splitting one big network into several smaller ones is not busywork — it buys real benefits:

Private ranges recap

The addresses in these examples — 192.168.x.x and 10.x.x.x — are not random. They come from the RFC 1918 private ranges reserved for internal use and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. You can subnet within any of them freely because they are yours to number however you like behind NAT. For the full picture of why these exist and how they differ from routable addresses, see public vs private IP addresses.

A quick note on IPv6 prefixes

IPv6 uses the same prefix-length idea — a /64 means 64 network bits — but the arithmetic feels different because addresses are 128 bits wide instead of 32. The near-universal convention is to give every LAN a /64, which leaves 64 host bits: roughly 1.8 × 1019 addresses per subnet. There is no address scarcity to fight, so you almost never subnet below /64, and there is no network/broadcast pair to subtract — IPv6 dropped broadcast entirely in favour of multicast. If you are comparing the two protocols, the IPv4 vs IPv6 explainer covers the wider differences.

Common mistakes

Try it now

The fastest way to build intuition is to type a block into a calculator and watch the numbers move. Open the CIDR calculator, enter 192.168.1.0/26, and confirm the network, broadcast, and host range match the worked example above. Then try 10.0.0.0/22 and watch the block end at 10.0.3.255. Once the calculator stops surprising you, you have understood subnetting. If you want to see how an address maps to its raw 32-bit integer, the IP to decimal converter makes the binary concrete.

Frequently asked questions

What does 255.255.255.0 mean as a subnet mask?

In binary it is twenty-four 1 bits followed by eight 0 bits. The 1 bits mark the network portion and the 0 bits mark the host portion, so it is identical to the CIDR prefix /24. It leaves 8 host bits, giving 256 addresses per subnet and 254 usable for devices.

How many usable hosts are in a /24 subnet?

A /24 has 8 host bits, so 2^8 = 256 total addresses. Two are reserved — the network address (192.168.1.0) and the broadcast address (192.168.1.255) — leaving 254 usable, from 192.168.1.1 to 192.168.1.254. In general it is 2^(32 − prefix) − 2.

Why are IPv6 prefixes usually /64 instead of small like IPv4?

IPv6 addresses are 128 bits wide, so there is no need to conserve space. Every LAN gets a /64, leaving 64 host bits — about 1.8 × 1019 addresses each. Features like SLAAC assume that 64-bit host portion, so you rarely subnet below /64, and there is no network/broadcast subtraction.

Related reading