What Is a Subnet Mask and How Does It Work?

A subnet mask is a 32-bit number that accompanies an IPv4 address to separate the network identifier from the host identifier. It tells network devices which portion of an IP address refers to the local network and which portion identifies a specific device on that network. Without this mask, a computer wouldn't know whether another address is reachable directly or needs to be forwarded through a router. Every device on a TCP/IP network, from a smartphone to a cloud server, relies on its subnet mask to make that distinction.

What is a subnet mask?

An IP address alone doesn't carry enough information for a device to know where the network boundary lies. That's where the subnet mask comes in. Written in dotted decimal notation (like 255.255.255.0), the mask uses a contiguous block of 1s followed by 0s in binary. The 1s mark the network bits; the 0s mark the host bits.

If you're unfamiliar with how IP addresses are structured, it helps to review what is an IP address before continuing. The two concepts are inseparable.

In a typical home network, you'll see a subnet mask of 255.255.255.0. In binary, that's twenty-four 1s and eight 0s. This means the first three octets identify the network, and the last octet is available for individual devices. Network administrators call this a /24 network, using CIDR notation. The mask and the CIDR prefix convey the exact same information. One is just more compact. A /24 leaves 254 usable addresses for hosts, since the first address in the range identifies the network itself and the last is reserved for broadcast.

Network engineers sometimes describe the mask as a stencil laid over an IP address. The parts of the address that show through the 1s become the network identifier. The parts behind the 0s identify the specific host. This analogy breaks down slightly with variable length subnet masking, where different masks apply to different parts of the same original network, but the core idea holds.

How does a subnet mask work?

When a device wants to send a packet, it needs to answer one question first: is the destination on my local subnet? It finds out by performing a bitwise AND between its own IP address and its subnet mask. The result is the network address. It performs the same AND operation on the destination IP using the same mask. If the two network addresses match, the destination is local. If they don't match, the packet goes to the default gateway.

Consider a device with IP address 192.168.1.10 and mask 255.255.255.0. A bitwise AND yields the network 192.168.1.0. If it tries to reach 192.168.1.50, the same operation produces an identical network address. The sender can reach the target directly at the data link layer. But if the target is 10.0.0.5, the network portion differs. The sender hands the packet to its router instead.

The AND operation is simple. Each bit in the IP address is compared to the corresponding bit in the mask. Where the mask has a 1, the IP bit passes through unchanged. Where the mask has a 0, the result is forced to 0. This zeroing-out of the host bits isolates the network portion. It's computationally cheap, which is why even embedded devices can perform it millions of times per second without dedicated hardware.

This process happens rapidly in the network stack. Users never see the calculation, yet every Ethernet frame and IP packet depends on it. The mask is what enables the "same subnet?" check. Without it, devices can't decide between direct Layer 2 delivery and routing.

How to read and calculate a subnet mask

You don't need to do binary math by hand to find a subnet mask in practice. Operating systems expose it directly in network configuration output.

On Linux, the ip command shows the mask in CIDR notation:

$ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:1a:2b:3c:4d:5e brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.105/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 86394sec preferred_lft 86394sec

The /24 appended to the IP address is the subnet mask. It means the first 24 bits are the network portion. The broadcast address shown here (192.168.1.255) is derived from that same mask.

On Windows, ipconfig displays the mask in dotted decimal form:

C:\> ipconfig

Windows IP Configuration

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : home.local
   IPv4 Address. . . . . . . . . . . : 192.168.1.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

If you want to calculate the network address manually, you can use a tool like sipcalc or an online subnet calculator. But the principle remains the same: the mask extracts the network bits from any IP address it pairs with. You can also verify the network address with a one-line command:

$ ipcalc -n 192.168.1.10/24
NETWORK=192.168.1.0

Subnet mask notation and CIDR

Before 1993, the internet used classful addressing. Class A networks used a /8 mask, Class B used /16, and Class C used /24. These fixed boundaries wasted huge blocks of addresses. Modern networks use classless inter-domain routing (CIDR), which allows any prefix length. Combined with variable length subnet masking (VLSM), administrators can split a single network into subnets of different sizes. A point-to-point link might use a /30 (leaving just two usable host addresses), while a larger office floor uses a /23.

The dotted decimal format (255.255.255.0) is easy to read, but it becomes unwieldy in routing tables and configuration files. CIDR notation replaces the full mask with a slash and the number of network bits. A /24 mask is exactly equivalent to 255.255.255.0. A /16 is equivalent to 255.255.0.0.

This flexibility is why IPv4 remains viable despite address exhaustion. It's also why understanding masks is essential for anyone configuring cloud virtual private clouds (VPCs) or on-premises routers. Microsoft's documentation on TCP/IP addressing provides additional detail on these calculations.

Why subnet masks matter

Subnet masks do more than enable local delivery. They're the foundation of network segmentation. By dividing a large campus network into smaller subnets, administrators can contain broadcast traffic and apply security policies at router boundaries. A misconfigured mask is a common source of connectivity problems. If two devices on the same physical segment use different masks, one may think the other is remote and try to route through a gateway that isn't necessary. The result is unreachable hosts or asymmetric traffic paths.

Cloud architects face similar decisions when designing VPCs. A /16 provides 65,536 addresses, but if you only need a few dozen, you're reserving a massive block. Breaking that /16 into smaller subnets with tighter masks prevents waste and keeps different environments (production, staging, development) logically separated without needing separate physical switches.

Up to 254 devices can fit comfortably on a single home network. That's why most consumer routers apply a /24 mask automatically, and it's rare that a household needs to change it. In enterprise and cloud environments, engineers choose masks deliberately to balance subnet size against available address space. For IPv6, the concept persists but looks different. IPv6 uses 128-bit addresses and standardizes on /64 subnets for end-user networks. There's no dotted decimal equivalent; only slash notation is used. Portnox offers a clear breakdown of how masks function in modern networks.

Subnet masks in the broader network stack

At the intersection of Layer 2 and Layer 3 sits the subnet mask. It doesn't change the physical wiring, but it shapes the logical topology that protocols like ARP, ICMP, and routing protocols depend on. When you ping another host, your operating system consults the subnet mask first to decide whether to broadcast an ARP request locally or forward the packet to a router.

A subnet mask doesn't hide or encrypt anything. It's a structural guide that tells devices which part of an address is shared and which part is unique.

Once you understand how masks work, routing tables and access control lists become much easier to grasp. If you're troubleshooting connectivity, verifying that all hosts share the same network address (and therefore the same mask) is usually the first step. After that, concepts like DNS and default gateways fall into place more naturally.