A Guide to Subnet Masks

Subnet masks are one of the fundamentals of networking, and they’re the thing that decides which part of an IP address identifies the network and which part identifies an individual device on it. Get comfortable with them and a lot of networking stops feeling like guesswork. This guide explains what subnet masks are, how they work, and how to read and calculate them.

What is a Subnet Mask?

A subnet mask is a 32-bit pattern that sits alongside an IP address and splits it into a network portion and a host portion. It’s usually written in dotted-decimal form, like 255.255.255.0, which is easier to read than the raw binary.

Its job is to let a device work out whether another IP address is on the same local network or somewhere else. In doing that, it also sets the size of the network, by defining how many bits are given to the network and how many are left for hosts.

How Subnet Masks Work

A subnet mask is made up of network bits and host bits. The network bits identify the network itself, and the host bits identify the individual devices on it. Take 255.255.255.0 as an example:

• The leftmost 24 bits are network bits
• The rightmost 8 bits are host bits

Those 8 host bits give 2^8, or 256, possible addresses. Two of those are always reserved, one for the network address and one for the broadcast address, which leaves 254 usable addresses for actual devices.

Notation and CIDR

Subnet masks are commonly written in dotted-decimal notation like 255.255.255.0, but they can also be written as a prefix length using CIDR (Classless Inter-Domain Routing). In CIDR, you just state how many bits are network bits, so /24 is exactly the same as 255.255.255.0. CIDR is more compact and is what you’ll see most often in modern network configuration.

Common Subnet Masks

A handful of subnet sizes cover most situations you’ll run into:

• /32: a single host address, for example 192.168.1.1
• /24: a small local network, for example 192.168.1.0/24, giving 254 usable addresses
• /16: a medium-sized network, for example 192.168.0.0/16
• /8: a large network, for example 10.0.0.0/8

Subnetting

Subnetting is the practice of splitting a larger network into smaller, more manageable pieces. CIDR makes this straightforward, since you can dial the network size up or down simply by changing the prefix length, borrowing bits from the host portion to create more, smaller subnets.

How to Calculate a Subnet Mask

To work out a subnet mask for a given network, the process is:

1. Decide how many subnets you need, and how many hosts per subnet
2. Work out how many bits each of those requires
3. Convert that into binary
4. Build the mask by setting the network bits to 1 and the host bits to 0

The thing to remember is that every host bit you take for the network halves the number of hosts per subnet while doubling the number of subnets, so it’s always a trade-off between how many networks you want and how big each one needs to be.

A Few Best Practices

• Size your subnets to the network so you’re not wasting large ranges of addresses
• Document your subnetting scheme, since it saves a lot of pain when troubleshooting later
• Use CIDR notation for consistency across your network design
• Leave room to grow, so you’re not re-addressing the whole network the moment it expands

Once subnet masks click, the rest of IP addressing gets a lot easier, since almost everything else, from routing to firewall rules, builds on knowing which addresses share a network and which don’t.

Related guides

• Setting Up a Static IP on Rocky Linux
• Setting Up Passwordless SSH Login between a Client and Two Servers