Subnet mask: quantity example
Take the address 192.168.1.130 with the mask 255.255.255.192. In binary, the mask has 26 ones followed by 6 zeros, the same as /26; a bitwise AND of the address and the mask gives the network address, 192.168.1.128; the last 6 bits are the host part, so the block spans 64 addresses, 192.168.1.128 through 192.168.1.191. The first is the network address and the last is the broadcast address, leaving .129 to .190 for devices.
Two devices can talk directly only if they share the same network address under the mask. Otherwise traffic goes through a router.
A common misunderstanding
Assuming two devices are on the same network just because their IP addresses look similar. Two addresses that differ only in the last octet can still sit on different networks if the mask splits them apart.
Related measurements
A subnet mask is the dotted form of what CIDR notation writes as a slash. 255.255.255.0 and /24 are the same thing; it is not an IP address, though it looks like one, and it is not a gateway, which is the address of the router. Wildcard masks used in some router rules are the inverse of a subnet mask.
IPv6 uses prefix lengths and does not use dotted masks, and the mask defines the boundary between network and host bits, and both parts are needed to interpret an address.
Limits of the definition
Non-contiguous masks are not valid in modern networking; a wrong mask causes devices to fail to reach each other or to send traffic the wrong way. Reserved addresses reduce usable hosts. Overlapping subnets cause conflicts.
Document your addressing plan, and test changes on production networks.
Understanding Subnet mask
The mask is what turns a single IP address into a defined range: the same address paired with two different masks describes two entirely different networks, which is why a mask has to travel with an address for the address to mean anything on its own.
Using Subnet mask
Network administrators set masks when configuring devices, routers and DHCP servers. They plan address space by choosing masks that give enough hosts per subnet. Home users see 255.255.255.0 in their router settings.
Firewalls and access rules rely on them to define which addresses are included. Tools convert a mask to a prefix, count hosts and list the range for a given address and mask.
Subnet mask: follow the example through
Assumed example: Take the address 192.168.1.130 with the mask 255.255.255.192. In binary, the mask has 26 ones followed by 6 zeros, the same as /26; a bitwise AND of the address and the mask gives the network address, 192.168.1.128; the last 6 bits are the host part, so the block spans 64 addresses, 192.168.1.128 through 192.168.1.191. The first is the network address and the last is the broadcast address, leaving .129 to .190 for devices.
Two devices can talk directly only if they share the same network address under the mask. Otherwise traffic goes through a router.
Subnet mask: calculation reference
Network = IP AND subnet mask; broadcast = network OR wildcard mask; usable hosts = 2^(32−prefix) − 2 (RFC 4632 CIDR)
| Quantity | Entered or calculated amount | Meaning |
|---|---|---|
| CIDR prefix length | 26 | The number after the slash, e.g. the 24 in 192.168.1.0/24. 0-32. |
| IP address, first octet | 192 | Explicit example input. |
| IP address, second octet | 168 | Explicit example input. |
| IP address, third octet | 1 | Explicit example input. |
| IP address, fourth octet | 130 | Explicit example input. |
| Usable host addresses | 62 | Result under the listed assumptions. |
| Network address | 192.168.1.128 | Result under the listed assumptions. |
| Broadcast address | 192.168.1.191 | Result under the listed assumptions. |
Subnet Calculator: change the inputs and compare the resulting cases
How do I convert 255.255.255.0 to CIDR?
Count the ones in binary. Three full octets of ones are 24 bits, so the mask is /24.
What is a default gateway?
The router address a device uses to reach other networks. It must sit inside the same subnet as the device.
Why can't two devices in different subnets talk directly?
They must send traffic through a router, because their network addresses differ under the mask.
What is a wildcard mask?
The inverse of a subnet mask, used in some router and firewall rules. For 255.255.255.0, the wildcard is 0.0.0.255.
Verify a device's configured mask matches the network it's meant to be part of before troubleshooting why it can't reach a gateway or another device.