What Is a Subnet Mask?

A subnet mask is a 32-bit value that separates an IP address into a network portion and a host portion, defining which devices belong to the same subnet. A subnet mask such as 255.255.255.0 works alongside an IPv4 address to tell a device which part of the address identifies the network and which part identifies the individual host. This article defines the subnet mask, explains how a mask such as 255.255.255.0 divides an address, describes CIDR notation such as /24, distinguishes network bits from host bits, explains why subnetting is used for segmentation, efficiency, and security, shows how to calculate the number of hosts per subnet, and explains the relationship between the subnet mask and the default gateway.

What Is a Subnet Mask?

A subnet mask is a 32-bit number that divides an IPv4 address into a network part and a host part by marking which bits identify the network. The mask uses consecutive 1 bits for the network portion and consecutive 0 bits for the host portion, so a device can read the boundary between the two:

• Network bits (the 1s): the leftmost bits set to 1 identify the subnet, and every device on that subnet shares them.
• Host bits (the 0s): the remaining bits set to 0 vary per device and give each one a unique address inside the subnet.
• Local configuration only: the mask is stored on each device and never travels across the network inside a packet.

A device compares its own address and mask against a destination address to decide whether the destination sits on the same local network or requires a router. A common subnet mask is 255.255.255.0, which reserves the first three octets for the network and the last octet for hosts. The mask pairs with an IP address on every configured device, and it sits at the boundary the wider TCP/IP stack relies on for routing.

How Do You Read a Subnet Mask and Find the Network and Host Bits?

You read a subnet mask by converting it to binary, counting the consecutive 1 bits as network bits, and treating the rest as host bits. A device extracts the network address with a bitwise AND between the mask and the address:

• Convert each octet to binary. The value 255 becomes 11111111 (all eight bits are network bits) and 0 becomes 00000000 (all eight bits are host bits), so 255.255.255.0 is 24 ones then 8 zeros.
• Count the 1 bits. The number of leading 1s is the network-bit count and the CIDR prefix, so 24 ones means /24.
• Write the address in binary too. For example, 192.168.1.20 lines up bit for bit against the mask.
• Apply a bitwise AND. Keep each bit where the mask shows 1 and zero the rest, which yields the network address 192.168.1.0 shared by every host in the subnet.
• Compare destinations. Run the same AND on a destination address; a matching network address means the destination is local, a different one means it is remote.

The destination is local when its network address matches the source network address, so the device sends the frame directly. The destination is remote when the network addresses differ, so the device hands the packet to the default gateway instead. This local-versus-remote test is the single job the mask exists to perform.

What Is the Difference Between Network Bits and Host Bits?

Network bits identify the subnet a device belongs to, while host bits identify the individual device within that subnet. The subnet mask sets the boundary between the two groups, and two host values are reserved rather than assigned:

• Network bits stay the same across a subnet. Every device in a /24 subnet shares the same first 24 bits, which form the network address.
• Host bits change for each device. The remaining bits give each device a unique value within the subnet.
• The all-zero host value names the network. An address with every host bit set to 0, such as 192.168.1.0, is the network address and is not assigned to a device.
• The all-one host value is the broadcast. An address with every host bit set to 1, such as 192.168.1.255, is the broadcast address for the subnet.

What Is CIDR Notation?

CIDR notation writes a subnet mask as a slash followed by the number of network bits, such as /24 in place of 255.255.255.0. CIDR stands for Classless Inter-Domain Routing, and the prefix is simply the count of 1 bits in the mask.

The table below maps each common CIDR prefix to its dotted-decimal mask, its split of network and host bits, and its usable host count:

The IETF introduced CIDR in 1993 (RFC 1519, later updated by RFC 4632) to replace the older fixed Class A, B, and C system. CIDR allows any prefix length, so a network can be sized to the exact number of hosts it needs rather than rounded up to a class boundary.

How Do You Calculate Hosts Per Subnet?

The number of usable hosts per subnet equals 2 raised to the number of host bits, minus 2 for the network and broadcast addresses. The formula applies to any IPv4 subnet:

1. Count the host bits by subtracting the CIDR prefix from 32, so a /24 leaves 8 host bits.
2. Raise 2 to the number of host bits, so 2 to the power of 8 equals 256 total addresses.
3. Subtract 2 to remove the network address and the broadcast address, leaving 254 usable hosts.
4. Apply the same steps to any prefix, so a /26 with 6 host bits gives 62 usable hosts.
5. Use the result to confirm a subnet holds enough addresses for every device on the segment.

Why Is Subnetting Used?

Subnetting is used to divide a large network into smaller subnets for segmentation, efficient address use, and improved security. Four measurable benefits drive the practice:

• Segmentation reduces broadcast traffic. A broadcast stays within its subnet, so dividing a network limits the number of devices that receive each broadcast frame.
• Efficient addressing prevents waste. A correctly sized subnet assigns only the addresses a segment needs rather than reserving an entire address class.
• Security improves through isolation. Separate subnets let an administrator apply firewall rules between segments, such as keeping guest devices away from internal servers.
• Performance rises with smaller domains. A smaller broadcast domain reduces the load each device processes from network-wide broadcast traffic.

Devices on the same subnet talk directly within one computer network segment, while traffic between subnets crosses a router. That router is also where private addresses are mapped to a public one through NAT before reaching the internet.

How Does the Subnet Mask Relate to the Default Gateway?

The subnet mask tells a device whether a destination is local, and the default gateway is the router a device uses to reach destinations outside the local subnet. The two values work together on every device.

A device compares the network address of a destination against its own network address using the subnet mask. The device sends the packet directly when the destination is on the same subnet. The device sends the packet to the default gateway when the destination sits on a different subnet, because only a router can forward between subnets.

A wrong subnet mask makes a device treat a remote address as local, so the packet never reaches the gateway. Assigning a fixed address and the matching mask is covered in the guide to set up a static IP.

How Do Subnet Masks Work With IPv6?

IPv6 replaces the dotted-decimal subnet mask with a prefix length in CIDR notation, such as /64, because IPv6 addresses are 128 bits long. IPv6 abandons the older mask format entirely.

A standard IPv6 subnet uses a /64 prefix, which reserves the first 64 bits for the network and the last 64 bits for the host portion. The vast address space of IPv6 removes the need to conserve host addresses through small subnets, so subnetting in IPv6 focuses on hierarchy rather than efficiency. The differences between the two protocols, including address length and notation, appear in the comparison of IPv4 versus IPv6.

What Were the Default Subnet Mask Classes?

The original IPv4 system defined three default subnet masks tied to address classes A, B, and C before CIDR replaced the fixed scheme. Each class set a default boundary between network and host bits:

• Class A uses 255.0.0.0. A Class A address reserves the first 8 bits for the network and 24 bits for hosts, covering addresses from 1 to 126 in the first octet.
• Class B uses 255.255.0.0. A Class B address reserves 16 bits for the network and 16 bits for hosts, covering the first octet range 128 to 191.
• Class C uses 255.255.255.0. A Class C address reserves 24 bits for the network and 8 bits for hosts, covering the first octet range 192 to 223.
• Classes D and E serve special roles. Class D carries multicast traffic, and Class E is reserved for experimental use, so neither holds a host subnet mask.

The classful system wasted addresses, because a network slightly larger than a Class C had to take a full Class B. CIDR replaced the fixed classes in 1993 to allow any prefix length and reduce that waste, and classful addressing is deprecated in modern routing.

What Are Private IP Address Ranges?

Three IPv4 ranges are reserved for private networks, and each pairs with a default subnet mask for internal use. The IETF reserved these ranges in RFC 1918:

• The 10.0.0.0/8 range serves large networks. The single Class A private block provides over 16 million host addresses for one organization.
• The 172.16.0.0/12 range serves medium networks. The block spans 172.16.0.0 through 172.31.255.255 for mid-sized deployments.
• The 192.168.0.0/16 range serves small networks. Home routers commonly use a 192.168.1.0/24 subnet from this block for local devices.
• Private addresses require translation. A device on a private range reaches the internet only through Network Address Translation on the router.

Last Thoughts on Subnet Masks

A subnet mask is the 32-bit value that divides an IPv4 address into a network portion and a host portion so a device knows which destinations sit on its local network. The mask uses 1 bits for the network and 0 bits for hosts, CIDR notation such as /24 records the count of network bits, and the formula of 2 raised to the host bits minus 2 gives the usable hosts per subnet. Read the mask in binary, count the leading ones, and the rest follows.

The subnet mask works with the default gateway to route remote traffic, and IPv6 replaces the mask with a prefix length. The address the mask divides is explained in the overview of an IP address, and the broader structure of segments, routers, and gateways is set out on the hub for what a computer network is.

Key Takeaways:

• A subnet mask is a 32-bit value that separates the network portion from the host portion of an IPv4 address.
• Consecutive 1 bits mark the network and consecutive 0 bits mark the host, so 255.255.255.0 equals /24 in CIDR notation.
• Network bits stay fixed across a subnet while host bits vary, giving each device a unique address.
• Usable hosts equal 2 raised to the host bits, minus 2 for the reserved network and broadcast addresses.
• The mask decides local versus remote, sending remote traffic to the default gateway.
• CIDR replaced the fixed Class A, B, and C masks in 1993 so any prefix length can be used.

Frequently Asked Questions (FAQs)