Subnet Mask
The bitmask that splits an IP address into network and host portions — the arithmetic beneath every CIDR block, subnet, and routing decision.
What is a subnet mask?
A subnet mask marks which bits of an IP address identify the network and which identify the host. 255.255.255.0 (the dotted-decimal form) or /24 (the CIDR form) both say “the first 24 bits are network, the last 8 are host” — leaving 256 addresses in that block. It’s the same information CIDR notation carries, written differently, and it’s the arithmetic underneath every subnet, route table decision, and firewall rule.
The bitwise logic that actually runs
Routers and hosts use the mask by bitwise AND: AND an address with its mask to get the network address, and two addresses are on the same subnet if their network addresses match. This is literally how a device decides “is this destination local (send directly) or remote (send to the gateway)?” — mask the destination, compare to the local network, route accordingly. Understanding this dissolves a lot of networking mystery: longest-prefix-match routing, why /24 and /25 behave differently, and why a mis-set mask makes a host think its neighbor is on a different network (and route local traffic out the gateway, or fail entirely). Every mask bit is one power of two of address space: /24 = 256, /25 = 128, /23 = 512.
Mask, CIDR, and the reserved addresses
Modern practice speaks CIDR (/24) over dotted-decimal masks, but they’re interchangeable and you’ll meet both — legacy gear, some vendor UIs, and exam questions still use 255.255.255.0. Two practical reminders: the network address (all host bits 0) and broadcast address (all host bits 1) are reserved, so a /24 gives 254 usable hosts, not 256 — and AWS reserves five per subnet on top. Getting the mask wrong is a classic connectivity bug: hosts that can reach some destinations and not others, because the mask miscategorizes local vs remote.
What people get wrong
- Off-by-one host counts — forgetting the reserved network and broadcast addresses when sizing.
- Mismatched masks on the same segment: two hosts with different masks disagree about who’s local — asymmetric, maddening connectivity failures.
- Fear of the arithmetic — it’s just bit boundaries and powers of two; internalizing the AND operation makes subnetting mechanical.
Primary source: RFC 950 — Internet Subnetting Procedure
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.