Subnet Mask

What is a subnet mask?

A subnet mask marks which bits of an IP address identify the network and which identify the host. 255.255.255.0 (the dotted-decimal form) or /24 (the CIDR form) both say “the first 24 bits are network, the last 8 are host” — leaving 256 addresses in that block. It’s the same information CIDR notation carries, written differently, and it’s the arithmetic underneath every subnet, route table decision, and firewall rule.

The bitwise logic that actually runs

Routers and hosts use the mask by bitwise AND: AND an address with its mask to get the network address, and two addresses are on the same subnet if their network addresses match. This is literally how a device decides “is this destination local (send directly) or remote (send to the gateway)?” — mask the destination, compare to the local network, route accordingly. Understanding this dissolves a lot of networking mystery: longest-prefix-match routing, why /24 and /25 behave differently, and why a mis-set mask makes a host think its neighbor is on a different network (and route local traffic out the gateway, or fail entirely). Every mask bit is one power of two of address space: /24 = 256, /25 = 128, /23 = 512.

Mask, CIDR, and the reserved addresses

Modern practice speaks CIDR (/24) over dotted-decimal masks, but they’re interchangeable and you’ll meet both — legacy gear, some vendor UIs, and exam questions still use 255.255.255.0. Two practical reminders: the network address (all host bits 0) and broadcast address (all host bits 1) are reserved, so a /24 gives 254 usable hosts, not 256 — and AWS reserves five per subnet on top. Getting the mask wrong is a classic connectivity bug: hosts that can reach some destinations and not others, because the mask miscategorizes local vs remote.

What people get wrong

• Off-by-one host counts — forgetting the reserved network and broadcast addresses when sizing.
• Mismatched masks on the same segment: two hosts with different masks disagree about who’s local — asymmetric, maddening connectivity failures.
• Fear of the arithmetic — it’s just bit boundaries and powers of two; internalizing the AND operation makes subnetting mechanical.

Primary source: RFC 950 — Internet Subnetting Procedure

Subnet Masks in Dotted-Decimal vs. CIDR Notation

Subnet masks are sometimes expressed in traditional dotted-decimal form (like 255.255.255.0) rather than CIDR slash notation (/24), though the two represent exactly the same underlying concept — a bit pattern marking which bits of an IP address are fixed (network portion) versus variable (host portion). A 255.255.255.0 mask and a /24 CIDR suffix both indicate that the first 24 bits are the network portion, leaving 8 bits for host addresses within that subnet. While CIDR notation has become the more common convention in modern cloud networking documentation and configuration, understanding the dotted-decimal equivalent remains useful for working with older networking equipment, some enterprise firewall configurations, and troubleshooting tools that still default to that format.