Subnet maskHow a mask splits network from host

What a subnet mask does

An IPv4 address such as 192.168.1.37 is really a 32-bit number. On its own it does not say how big the local network is. The subnet mask supplies that information: every bit set to 1 in the mask marks a network bit, every 0 marks a host bit.

Address   192.168.1.37      11000000.10101000.00000001.00100101
Mask      255.255.255.0     11111111.11111111.11111111.00000000
Network   192.168.1.0       11000000.10101000.00000001.00000000

A device ANDs its own address with the mask to find its network, and does the same with any destination address. If the results match, the destination is local and can be reached directly (after an ARP lookup). If they differ, the packet goes to the default gateway.

Mask and prefix length are the same information

CIDR notation writes the number of 1 bits after a slash. Both forms appear in configuration screens and command output:

See the CIDR notation record for the prefix side of this.

Working out a subnet by hand

For 10.20.30.77/27:

1. /27 leaves 5 host bits, so each subnet has 2^5 = 32 addresses.
2. Subnets start at multiples of 32 in the last octet: 0, 32, 64, 96…
3. 77 falls in the 64–95 block.
4. Network 10.20.30.64, broadcast 10.20.30.95, usable 10.20.30.65–10.20.30.94.

The Subnet Calculator shows the same steps with the binary highlighted.

Common mistakes

• Non-contiguous masks such as 255.255.0.255 are invalid; the ones must be a solid run from the left.
• Mask mismatch between two devices on the same wire is a classic fault: each thinks the other is on a different network and sends via the gateway, or cannot reach it at all.
• Confusing the mask with the gateway. The mask defines the local network's size; the gateway is a specific address inside it.

Where you see it on Windows

ipconfig shows Subnet Mask . . . : 255.255.255.0 under each adapter. route print shows the same information as a Netmask column in the routing table. See ipconfig and route.