Subnet Mask Explained: Subnetting Made Simple
A subnet mask is a 32-bit value that splits an IP address into two parts: the network portion and the host portion. Written as four numbers like 255.255.255.0 or as a CIDR prefix like /24, it tells every device on the network which addresses are "local" and which need to go through a router. Get the mask wrong and you'll see devices that can't reach each other even though they look like they're on the same network.
If you've ever stared at 192.168.1.10 255.255.255.0 on a router config page and wondered what the second number actually does, this is that explanation — the one I wish someone had given me instead of a chart of binary digits.
What Is a Subnet Mask, Really?
Every IPv4 address is 32 bits. A subnet mask is also 32 bits, and it works like a stencil laid over the address. Wherever the mask has a 1, that bit belongs to the network. Wherever it has a 0, that bit belongs to the host. That's the entire concept — everything else is bookkeeping.
Take 192.168.1.10 with mask 255.255.255.0. In binary:
IP: 11000000.10101000.00000001.00001010
Mask: 11111111.11111111.11111111.00000000
The mask is all 1s for the first three octets and all 0s for the last. That means the first three octets (192.168.1) identify the network, and the last octet (the range 0–255) identifies individual hosts on that network. Any device with an address starting 192.168.1.x is considered local; anything else has to go through the default gateway.
This is why "subnet mask explained" questions almost always come back to one thing: the mask defines the boundary between "can talk directly" and "needs a router."
Dotted Decimal vs. CIDR Notation
You'll see subnet masks written two ways, and they mean exactly the same thing:
- Dotted decimal:
255.255.255.0 - CIDR notation:
/24
CIDR notation just counts the number of leading 1 bits in the mask. /24 means the first 24 bits are network bits — which is exactly what 255.255.255.0 represents (24 ones, 8 zeros). CIDR was formalized in RFC 4632, and it replaced the old class-based (Class A/B/C) addressing scheme from the 1980s, which wasted huge blocks of address space because every network had to be one of exactly three fixed sizes.
In practice, almost nobody configures a mask by typing dotted decimal anymore outside of legacy Windows dialog boxes. Cisco IOS, Linux, and cloud consoles all default to slash notation because it's shorter and less error-prone. I still see people accidentally type 255.255.255.255 instead of 255.255.255.0 in a static IP dialog and then wonder why the host can't see anything else on the LAN — that's a /32, a network of exactly one address.
Common Subnet Mask Cheat Sheet
| CIDR | Subnet Mask | Total Addresses | Usable Hosts | Typical Use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Legacy Class A block |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Large private network (e.g. 172.16.0.0/16) |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Mid-size office |
| /24 | 255.255.255.0 | 256 | 254 | Standard LAN, home router default |
| /25 | 255.255.255.128 | 128 | 126 | Split floor or VLAN |
| /26 | 255.255.255.192 | 64 | 62 | Small office segment |
| /27 | 255.255.255.224 | 32 | 30 | Point-of-sale VLAN, small server group |
| /30 | 255.255.255.252 | 4 | 2 | Router-to-router link |
The "usable hosts" column subtracts two addresses from every subnet except /31 and /32: one for the network address (all host bits zero) and one for the broadcast address (all host bits one). This is spelled out in RFC 950. There's a documented exception — RFC 3021 allows /31 point-to-point links to use both addresses as hosts, which you'll see on router interconnects to save address space.
Why Does Subnetting Matter in the First Place?
Without subnetting, every device on an internet-connected network would need to know how to reach every other device individually, and routers would need routing table entries for every single host on the planet. Subnetting groups addresses into blocks so a router only needs to know "everything starting with this prefix goes that direction" instead of memorizing individual hosts.
On a practical, day-to-day level, subnetting also does three things for you:
- Contains broadcast traffic. Broadcasts stay inside their subnet. A flat /16 network broadcasts to 65,000+ devices; split it into /24s and each one only floods 254 devices.
- Enforces isolation. Put your printers, IoT devices, and guest Wi-Fi on separate subnets and a compromised device on one can't casually scan the others without going through a router or firewall rule.
- Matches address space to actual need. You don't hand a /24 (254 addresses) to a link that only ever has two routers on it. That's what /30 and /31 are for.
How Do I Calculate a Subnet Mask by Hand?
Here's the method I actually use, no binary math required for the common cases:
- Figure out how many hosts you need, including growth room.
- Find the smallest power of two that covers it, then add 2 for network and broadcast addresses.
- Subtract that block size from 256 to get the mask octet.
Example: you need 50 hosts. The smallest power of two above 50+2 is 64 (2^6). 256 − 64 = 192, so your mask is 255.255.255.192, or /26. That /26 gives you 62 usable hosts — enough headroom without wasting a whole /24 on a 50-device VLAN.
If you want to skip the arithmetic entirely, ipcalc-style tools do this instantly. On Linux:
$ ipcalc 192.168.1.0/26
Address: 192.168.1.0
Netmask: 255.255.255.192 = 26
Network: 192.168.1.0/26
HostMin: 192.168.1.1
HostMax: 192.168.1.62
Broadcast: 192.168.1.63
Hosts/Net: 62
(Exact output formatting varies slightly between ipcalc builds — Debian/Ubuntu's differs a bit from the Red Hat one — but the numbers themselves are always the same.)
What Is a /24 Subnet, Specifically?
A /24 is the mask most home routers and small-office networks use by default — 255.255.255.0. It gives you 256 total addresses (0–255 in the last octet), with 254 usable for hosts after removing the network address (.0) and broadcast address (.255).
If your router hands out addresses like 192.168.1.1 through 192.168.1.254, that's a /24 in action. It's popular because it maps cleanly to a single octet — no binary math needed to see where the boundary falls — and 254 hosts is plenty for a home or small office without wasting address space the way a /16 would.
How Do I Check My Subnet Mask?
On Windows, open Command Prompt and run:
C:\>ipconfig
Ethernet adapter Ethernet:
IPv4 Address. . . . . . . . . . . : 192.168.1.42
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
On Linux, use ip (the modern replacement for the deprecated ifconfig):
$ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP
inet 192.168.1.42/24 brd 192.168.1.255 scope global dynamic eth0
Notice Linux shows the mask directly as CIDR (/24) rather than dotted decimal — one more reason CIDR notation has mostly won out.
On macOS:
$ ifconfig en0 | grep netmask
inet 192.168.1.42 netmask 0xffffff00 broadcast 192.168.1.255
That's the one gotcha worth knowing — macOS's ifconfig prints the mask in hex (0xffffff00), not dotted decimal. 0xff per octet equals 255, so 0xffffff00 is 255.255.255.0. If you're scripting against this output, convert it or use networksetup -getinfo Wi-Fi instead, which prints dotted decimal directly.
Subnet Mask vs. Default Gateway — What's the Difference?
People mix these up constantly, so it's worth being explicit:
- Subnet mask defines which addresses are considered "on this network" versus "somewhere else."
- Default gateway is the specific device (usually a router) that traffic gets sent to when the destination isn't on this network.
The mask answers "is this local?" The gateway answers "if it's not local, who do I hand this packet to?" A misconfigured mask can make a genuinely local device look remote (so traffic gets routed unnecessarily) or make a remote device look local (so the packet never leaves and just times out).
Private IP Ranges You'll See Paired With These Masks
Per RFC 1918, three blocks are reserved for private networks and never routed on the public internet:
| Range | Default Mask | Common Use |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 255.0.0.0 (/8) | Large corporate/enterprise networks |
| 172.16.0.0 – 172.31.255.255 | 255.255.0.0 (/16, often subdivided) | Docker default bridge, mid-size networks |
| 192.168.0.0 – 192.168.255.255 | 255.255.255.0 (/24) | Home routers, small office |
The mask in the router's factory default doesn't have to match the "traditional" one for that range — a 10.x.x.x address doesn't have to run a /8 mask, and most enterprises subdivide it into /16s or /24s. The range just tells you the address block is private; the mask is a separate, independent choice made by whoever designed that particular network.
Common Mistakes I've Actually Run Into
A few patterns that show up over and over in real troubleshooting:
Two devices on the same physical switch, same VLAN, but one is configured with a /24 mask and the other with a /23. They can sometimes reach each other and sometimes not, depending on which addresses are involved — because they disagree about where the subnet boundary is. This is a nightmare to spot from symptoms alone; check the mask on both ends first.
Other repeat offenders:
- Overlapping subnets after a VPN merge. Two offices both used
192.168.1.0/24internally, and now that they're connected over a site-to-site VPN, routing breaks because the same address range exists on both ends. Fixing this after the fact means renumbering one site — plan your address space before you connect networks, not after. - Typo'd mask on a static IP.
255.255.0.0instead of255.255.255.0on a device that's supposed to be isolated to one floor. The device now thinks a /16's worth of addresses are local, ARPs for things it shouldn't, and occasionally causes broadcast storms on flat networks. - Forgetting the network and broadcast addresses aren't assignable. Assigning
.0or.255as a host address on a /24 causes weird, inconsistent connectivity depending on the OS and switch — some stacks will silently drop it, others complain loudly, and older equipment sometimes just breaks.
Frequently Asked Questions
What is subnetting in simple terms?
Subnetting is dividing one larger network into smaller, self-contained pieces, each with its own range of addresses. It's done by extending the subnet mask — taking bits that used to be part of the host portion and reassigning them to the network portion.
Is /24 the same as 255.255.255.0?
Yes. They're two notations for the same 32-bit mask — /24 means 24 leading 1 bits, and 24 ones followed by 8 zeros is exactly what 255.255.255.0 represents in binary.
How many hosts does a subnet mask allow?
Take the number of host bits (32 minus the CIDR number), raise 2 to that power, then subtract 2 for the network and broadcast addresses. A /24 has 8 host bits: 2^8 = 256, minus 2 = 254 usable hosts.
Can two devices with different subnet masks talk to each other directly?
Only if both masks agree the two addresses are on the same network. If they disagree, at least one device will try to route through a gateway to reach the other, which usually fails unless the gateway is configured to handle it.
Why do IPv6 addresses use prefix length instead of subnet masks?
IPv6 dropped dotted-decimal subnet masks entirely and uses prefix length (like /64) exclusively. IPv6 addresses are 128 bits, and writing out a 128-bit mask in any dotted format would be unreadable, so CIDR-style notation was built in from the start rather than bolted on later like it was with IPv4.
The Short Version
A subnet mask marks the line between "this device is on my network" and "route it elsewhere." /24 and 255.255.255.0 are the same thing. CIDR notation is the modern default because it's shorter and less error-prone than dotted decimal. And most of the real-world pain — VPN overlaps, mismatched masks between devices, mistyped static IPs — comes from not checking the mask first when something that should be simple isn't working.