Subnet Mask Basics

What is a subnet mask?

A subnet (short for sub-network) is a group of devices that can talk to each other directly, without a router in between. Usually, that means the devices connected to the same switches or the same Wi-Fi network.

A subnet mask is a number that is configured together with every IP address. It tells the device which part of its address identifies the network and which part identifies the host (the device itself). Without the mask, 192.168.10.25 is just four numbers. With the mask 255.255.255.0, it means “device 25 on network 192.168.10”.

💡 In simple terms: take the postal address 25 Oak Street. “Oak Street” is the network part: everyone on that street shares it. “25” is the host part: one house. The mask is the rule that tells you where the street name ends and the house number starts.

Why the mask exists

Every time a device sends something, it has to answer one question first:

“Is the destination on my own subnet, or somewhere else?”
On my subnet → send it straight there. Somewhere else → send it to the router (the default gateway).

The device can only answer this if it knows where its own network part ends. That is the mask's job. The mask also helps routers: instead of storing a route for every single device, a router stores whole networks, such as “192.168.10.0/24 is through this interface”. One route covers 254 devices.

The important parts

Reading a mask: network portion and host portion

A mask looks like an IP address, but it means something different. Line it up under the address and compare them octet by octet:

• 255 in the mask → that octet of the address is network.
• 0 in the mask → that octet of the address is host.

Behind the scenes, a mask is 32 bits: a row of 1s (network) followed by a row of 0s (host). 255 is simply eight 1s in binary (11111111), and 0 is eight 0s. The IP address lesson shows these bits.

Learn more: What Is an IP Address?

Slash notation: what /24 means

Writing 255.255.255.0 every time is slow, so you can count the 1 bits instead and write the number after a slash. This is called the prefix length or CIDR notation (Classless Inter-Domain Routing).

So 192.168.10.25/24 and “192.168.10.25, mask 255.255.255.0” mean exactly the same thing. Windows shows the dotted mask; Linux and many network devices show the slash.

The network address and the broadcast address

Set all the host bits to 0 and you get the network address, which identifies the subnet itself. Set all the host bits to 1 (255 in each host octet) and you get the broadcast address, which reaches every device on the subnet. Neither address can be assigned to a device.

How a device uses the mask, step by step

Here's what a PC does with its mask every time it sends a packet to an address:

Example 1: two addresses with /24

Example 2: the same addresses with /16

Now give the devices a /16 mask. Only the first two octets are compared:

Same two addresses, different answer. Whether two devices are “on the same subnet” is decided by the mask, not by the addresses alone. That is why you must always read an address together with its mask.

Practice table

What the mask does to real traffic

The diagram shows an office with two subnets connected by a router. PC-A uses its mask to decide where each packet goes:

One important detail: the mask is never sent in the packet. The IP header carries the source and destination addresses, but not the mask. Each device uses its own configured mask to make its own decision. That is why a single device with a wrong mask can break its own traffic while every other device works normally.

Real-world examples

Real networks also use masks that split an octet, such as /26 or /30, to make smaller subnets. Working those out is called subnetting. It needs binary and is taught in the CCNA course. You can also let the Subnet Calculator do the maths.

Learn more: Subnetting

What happens with a wrong mask

Assume the correct setting for PC-A is 192.168.10.10/24.

Checking the mask on your computer

C:\> ipconfig
Ethernet adapter Ethernet:

   IPv4 Address. . . . . . . . . . . : 192.168.10.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.10.1

$ ip -4 addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    inet 192.168.10.10/24 brd 192.168.10.255 scope global dynamic eth0
       valid_lft 85100sec preferred_lft 85100sec

$ ip route
default via 192.168.10.1 dev eth0 proto dhcp metric 100
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.10 metric 100

💡 Troubleshooting tip: compare the mask on the broken PC with the mask on a working PC in the same room. They should be identical.

Common mistakes

• Judging “same subnet” by the first three octets every time. That only works for /24. With /16, you compare only the first two octets.
• Forgetting that each device uses its own mask. The mask is not carried in the packet, so a wrong mask on one device only affects that device's decisions.
• Giving a device the network or broadcast address (for example, 192.168.10.0 or 192.168.10.255 on a /24). These addresses identify the subnet and reach all devices, so they cannot be used by one host.
• Guessing the mask from the first octet (“10 means /8”). A 10.x.x.x network is often split into /24 subnets, so always read the configured mask.
• Thinking a bigger prefix number means a bigger network. It's the opposite: more network bits leave fewer host bits, so a /24 is smaller than a /16.

Check yourself

Next, learn about the router address that carries traffic to other subnets.

Learn more: The Default Gateway