Subnet masks in five minutes

A subnet mask answers one question: which other addresses can this machine reach directly, and which does it have to send through the router? Get that question right and the rest of subnetting is bookkeeping.

The split

An IPv4 address is 32 bits. The mask divides them into two parts:

• the network part, which every machine on the same network shares, and
• the host part, which identifies one machine within it.

192.168.1.20 with the mask 255.255.255.0 means the first 24 bits (192.168.1) are the network and the last 8 bits (20) are the host. The short way to write the same thing is 192.168.1.20/24 — the number after the slash is how many bits are network.

The sizes you will actually meet

Each step down halves the size. /24 is the home network; /30 and /31 are the two ends of a link between routers; /32 is a single host, common in firewall rules.

Why two addresses are missing

In most subnets the first and last addresses are reserved. The first (host bits all zero) names the network itself; the last (host bits all one) is the broadcast address that reaches every machine on it. So a /24 has 256 addresses and 254 hosts.

The exception is /31, which has no room for either and is defined for point-to-point links where both addresses are usable.

The one piece of arithmetic

For any mask, take the last octet that is not 255 and subtract it from 256. That is the block size, and every subnet of that size starts on a multiple of it.

A /26 has the mask 255.255.255.192. 256 − 192 = 64, so the subnets are .0, .64, .128 and .192. The address 192.168.1.100/26 is therefore in the .64 block: network 192.168.1.64, broadcast 192.168.1.127, hosts .65 to .126.

That is the whole trick.

Are two addresses on the same network?

Only if their network bits match. 192.168.1.10/24 and 192.168.1.200/24 are on the same network. 192.168.1.10/26 and 192.168.1.200/26 are not: one is in the .0 block and the other in the .192 block, so traffic between them goes through a router.

Why a wrong mask is so confusing

A machine uses its mask to decide, for every packet, whether the destination is local or remote. A wrong mask makes that decision wrong in one direction or the other:

• Too large (say /16 where the network is a /24): the machine thinks a remote address is local, asks for it directly on the LAN, gets no answer, and never tries the router.
• Too small (say /28 on a /24): the machine thinks a neighbour is remote and sends traffic to the router, which may or may not send it back. Some things work and some do not, depending on who is talking to whom.

Both produce the most frustrating kind of fault — partial. If some local devices are reachable and others are not, compare masks before anything else.

The subnet calculator does all of this for any address and prefix, and the CIDR calculator answers “is this address inside that range” directly.