What is a subnet mask?
Next to every IP address in your network settings sits a second number, usually 255.255.255.0. It is not an address at all; it is a ruler that tells your device where its own network ends.
In this guide
A subnet mask is a 32-bit number that splits an IP address into a network part and a host part. The ones in the mask cover the network bits, the zeros cover the host bits. 255.255.255.0, written /24 in CIDR notation, means the first three numbers identify the network and the last number identifies the device, giving 256 addresses with 254 usable for hosts.
What a subnet mask does
An IPv4 address such as 192.168.1.20 carries two pieces of information in one number: which network the device is on, and which device it is within that network. Nothing in the address itself says where the boundary falls. The subnet mask supplies it. Where the mask has a one, the matching bit of the address belongs to the network; where it has a zero, the bit belongs to the host.
Your device uses that boundary for one decision, made for every packet it sends: is the destination on my own network, or not? It applies the mask to its own address and to the destination. If the network parts match, the destination is local and the device talks to it directly. If they differ, the packet goes to the default gateway instead. A wrong mask breaks exactly this decision, which is why a typo in it produces a device that can reach some neighbors but not others.
The mask is always a run of ones followed by a run of zeros, never mixed. That is why only certain decimal values ever appear in a mask: 255, 254, 252, 248, 240, 224, 192, 128 and 0.
The binary walkthrough
Write the address and the mask as 32 bits each, grouped into four octets:
With 255.255.255.0 the first 24 bits are ones, so the network part of 192.168.1.20 is 192.168.1 and the host part is 20. Change the mask to 255.255.0.0 and the boundary moves: now 192.168 is the network and 1.20 is the host, which means 192.168.1.20 and 192.168.7.200 are on the same network and can talk without a router.
Two addresses in every subnet are reserved. The one with all host bits zero (192.168.1.0) is the network address, used to name the subnet. The one with all host bits one (192.168.1.255) is the broadcast address, which reaches every device at once. That is why a /24 holds 256 addresses but only 254 hosts.
Masks that do not fall on an octet boundary work the same way, just with a less tidy decimal form. 255.255.255.192 is 26 ones: the last octet 11000000 keeps two bits for the network and leaves six for hosts, so the /24 is cut into four blocks of 64 addresses, .0 to .63, .64 to .127, and so on.
CIDR notation: /24 and the cheat sheet
Writing 255.255.255.0 every time is tedious, so since 1993 the same mask has been written as a slash and the number of one-bits: /24. This is CIDR notation (Classless Inter-Domain Routing), and 192.168.1.0/24 means the network whose first 24 bits are those of 192.168.1.0. Every prefix length from /0 to /32 is valid; these are the ones you will meet:
| Prefix | Subnet mask | Addresses | Usable hosts | Notes |
|---|---|---|---|---|
/8 | 255.0.0.0 | 16,777,216 | 16,777,214 | The old Class A size; 10.0.0.0/8 is the largest private range |
/9 | 255.128.0.0 | 8,388,608 | 8,388,606 | |
/10 | 255.192.0.0 | 4,194,304 | 4,194,302 | |
/11 | 255.224.0.0 | 2,097,152 | 2,097,150 | |
/12 | 255.240.0.0 | 1,048,576 | 1,048,574 | 172.16.0.0/12 private range |
/13 | 255.248.0.0 | 524,288 | 524,286 | |
/14 | 255.252.0.0 | 262,144 | 262,142 | |
/15 | 255.254.0.0 | 131,072 | 131,070 | |
/16 | 255.255.0.0 | 65,536 | 65,534 | The old Class B size; 192.168.0.0/16 private range |
/17 | 255.255.128.0 | 32,768 | 32,766 | |
/18 | 255.255.192.0 | 16,384 | 16,382 | |
/19 | 255.255.224.0 | 8,192 | 8,190 | |
/20 | 255.255.240.0 | 4,096 | 4,094 | |
/21 | 255.255.248.0 | 2,048 | 2,046 | |
/22 | 255.255.252.0 | 1,024 | 1,022 | |
/23 | 255.255.254.0 | 512 | 510 | |
/24 | 255.255.255.0 | 256 | 254 | The old Class C size; the usual home network |
/25 | 255.255.255.128 | 128 | 126 | |
/26 | 255.255.255.192 | 64 | 62 | |
/27 | 255.255.255.224 | 32 | 30 | |
/28 | 255.255.255.240 | 16 | 14 | |
/29 | 255.255.255.248 | 8 | 6 | |
/30 | 255.255.255.252 | 4 | 2 | Classic size for a link between two routers |
/31 | 255.255.255.254 | 2 | 2 (point-to-point links, RFC 3021) | |
/32 | 255.255.255.255 | 1 | 1 (single host) |
Each step shorter in the prefix doubles the addresses; each step longer halves them. The CIDR notation guide goes deeper, and the IP address classes guide explains the fixed /8, /16 and /24 system that CIDR replaced.
Work out any range with the subnet calculator
For anything beyond the /24 you do not want to do by hand, the subnet calculator takes an address and a mask or prefix (10.20.30.40/22, or 10.20.30.40 with 255.255.252.0) and returns the network address, the broadcast address, the first and last usable host, the total and usable host counts, and the mask in every form: dotted decimal, prefix length, binary and the wildcard mask that access lists use. It also splits a block into equal subnets, which is the usual question when carving a /16 into departments or a /24 into VLANs.
Three worked examples you can check against it:
192.168.1.130/25: mask255.255.255.128; network192.168.1.128; broadcast192.168.1.255; hosts.129to.254(126 usable).10.0.5.9/22: mask255.255.252.0; network10.0.4.0; broadcast10.0.7.255; hosts10.0.4.1to10.0.7.254(1,022 usable).172.16.40.77/30: mask255.255.255.252; network172.16.40.76; broadcast172.16.40.79; hosts.77and.78(2 usable).
Subnet mask vs default gateway vs IP address
| Setting | Example | Role |
|---|---|---|
| IP address | 192.168.1.20 | Identifies this device on the network |
| Subnet mask | 255.255.255.0 | Says which other addresses are on the same network |
| Default gateway | 192.168.1.1 | Where traffic for every other network is sent |
The three must agree. The gateway has to be inside the range the mask defines, or the device cannot reach it; a gateway of 192.168.2.1 with the mask above is unreachable from 192.168.1.20, and the connection shows as connected with no internet. On a home network you almost never type any of these: the router hands all three out by DHCP, and the mask it hands out is 255.255.255.0 because 254 hosts is more than any home needs. You meet the mask when setting a static address for a printer or server, when configuring a second router, or when a device shows 255.255.0.0 and refuses to see the rest of the network. The local IP page shows where to read all three values on each operating system.
Questions
What does the CIDR mask 192.168.1.0/24 mean?
It names a network, not a single address. The /24 says the first 24 bits (the first three numbers, 192.168.1) are fixed and identify the network, while the last 8 bits vary and identify devices. The block therefore runs from 192.168.1.0 to 192.168.1.255: 256 addresses, of which 192.168.1.1 through 192.168.1.254 can be assigned to devices. Its subnet mask in dotted form is 255.255.255.0.
What is the subnet mask for a 192.168 network?
Almost always 255.255.255.0, which is /24, giving 254 usable addresses such as 192.168.1.1 to 192.168.1.254. The whole private range 192.168.0.0/16 has the mask 255.255.0.0, but a home or small office uses only one /24 slice of it. Larger networks sometimes use 255.255.254.0 (/23, 510 hosts) or 255.255.252.0 (/22, 1,022 hosts) when one /24 runs out.
What is the difference between a subnet mask and an IP address?
The IP address identifies a device; the subnet mask describes how to read that address. Both are 32-bit numbers written in the same dotted format, which is why they get confused, but a mask is never assigned to anything and never appears as a destination. It only marks which bits of the address are the network part. 192.168.1.20 is an address; 255.255.255.0 is the mask applied to it.
What is a subnet in networking?
A subnet is a range of IP addresses that share the same network part and can communicate directly without passing through a router. A subnet mask or prefix length defines its size. Splitting a larger block into subnets keeps broadcast traffic contained, lets different groups of devices be firewalled from each other, and lets one organization use its addresses efficiently. A home Wi-Fi network is a single subnet.
Why is the subnet mask 255 and not 256?
Because each number in an address is an 8-bit octet, and eight bits can hold values from 0 to 255, which is 256 different values counting zero. A mask octet of 255 is 11111111 in binary: all eight bits set to one. There is no 256 in eight bits. The same limit is why no IPv4 address contains a number above 255.