What a Subnet Mask Does

A subnet mask tells a device which part of an IP address is the network and which part is the host. It is a 32-bit number paired with every IPv4 address.

Without a mask, an address is ambiguous — the device would not know where the network ends and the host begins.

In a mask, the bits set to 1 mark the network portion and the bits set to 0 mark the host portion. The 1 bits are always contiguous, starting from the left.

For example, 11111111.11111111.11111111.00000000 has 24 ones then 8 zeros, meaning the first three octets are network and the last is host.

Because mask octets are made of contiguous 1s, only certain decimal values appear:

• 255 = 11111111 (all network)
• 0 = 00000000 (all host)
• Partial octets: 128, 192, 224, 240, 248, 252, 254

You will never see a random value like 255.255.123.0, because the 1 bits must stay together.

The position where 1s switch to 0s is the network-host boundary. Everything left of it identifies the network; everything right identifies the host.

Two devices on the same network share identical network bits. The mask is what lets each device compute those network bits from its own address.

A device finds its network address with a bitwise AND of its IP and mask. AND outputs 1 only when both inputs are 1.

Where the mask bit is 1, the IP bit passes through unchanged; where the mask bit is 0, the result becomes 0. The result is the network address with all host bits zeroed.

Take IP 192.168.1.130 and mask 255.255.255.0. AND the last octet: 130 AND 0 = 0. The first three octets keep their values because they are ANDed with 255.

The network address is therefore 192.168.1.0. This is exactly how a host decides which network it belongs to.

A given mask can apply to many different networks. Mask 255.255.255.0 works for 192.168.1.0, 10.5.5.0, and countless others.

The mask only describes the shape of the split (how many network bits), not which specific network. The IP address supplies the actual network identity.

Extend the mask (more 1 bits) and you borrow bits from the host portion, creating more but smaller networks. Shorten it (fewer 1 bits) and you merge into fewer, larger networks.

This deliberate adjustment is the heart of subnetting: reshaping address space to fit your needs.

If two devices on the same physical network have different masks, they may disagree about who is local. One might try to route traffic that the other expects to deliver directly.

Such a mask mismatch causes intermittent or one-way connectivity and is a classic configuration error to check during troubleshooting.

The mask works alongside the default gateway. After ANDing, if a destination is on a different network, the device sends the packet to its gateway.

So the mask does more than describe a network — it directly drives the device’s decision to deliver locally or forward to a router for remote destinations.

Every host needs three settings to communicate beyond its link: an IP address, a subnet mask, and a default gateway. The mask is the piece that gives meaning to the address.

Once you are comfortable reading masks in binary and performing the AND, CIDR notation and host counting follow naturally.

Apply the mask.

You learned what a subnet mask does.

• A mask is a 32-bit number: 1s = network, 0s = host.
• Mask octets only take values like 255, 254, 252, 248, 240, 224, 192, 128, 0.
• A bitwise AND of IP and mask reveals the network address.
• Extending the mask creates more, smaller networks; shortening merges them.
• A mask mismatch causes connectivity faults.