What Is a Subnet Mask? Binary, Subnetting and Cheat Sheet

A subnet mask is a 32-bit number that splits an IPv4 address into a network part and a host part. Bits set to 1 mark the network, bits set to 0 mark the host. The most common mask, 255.255.255.0, starts with 24 ones, so it is also written /24 and leaves 254 usable host addresses.

Try it free: IPv4 subnet calculator Free to use, no account needed.

So what is a subnet mask used for in practice? Every device compares its own address with a destination through the mask to decide whether the destination is on the local network or must be reached through the router. This guide shows the binary behind it, how to calculate a mask, a subnetting example, wildcard masks and a full cheat sheet. To check any example as you read, type it into the free Subnet Calculator.

What is a subnet mask in binary?

An IPv4 address is four 8-bit numbers (octets), and so is a subnet mask. Written in binary, 255.255.255.0 is:

11111111.11111111.11111111.00000000

The ones always come first and are contiguous: a valid mask is a run of ones followed by a run of zeros, never a mix. That is why a mask can be described by a single number, the count of ones. This short form is the prefix length used in CIDR notation: 192.168.1.10/24 means the address 192.168.1.10 with the mask 255.255.255.0. For a deeper look at CIDR blocks, see how to calculate a CIDR block.

Only eight values can appear in an octet of a valid mask:

A zero octet (0) is the ninth option; any other number, such as 255.255.255.100, makes the mask invalid.

How the mask finds the network: a worked AND example

A device finds the network address by combining the IP address and the mask with a bitwise AND: each result bit is 1 only when both input bits are 1. Take 192.168.10.37/26. A /26 mask has 26 ones, which is 255.255.255.192:

IP address   192.168.10.37    11000000.10101000.00001010.00100101
Subnet mask  255.255.255.192  11111111.11111111.11111111.11000000
AND result   192.168.10.0     11000000.10101000.00001010.00000000

The first three octets pass through unchanged. In the last octet, 37 is 00100101 and the mask is 11000000, so only the top two bits survive and both are 0. The network address is 192.168.10.0.

The broadcast address is the network address with every host bit set to 1: 00111111 in the last octet, which is 63. That gives the full picture:

A device at 192.168.10.37/26 sends traffic for 192.168.10.50 directly, because that address is inside the same /26. Traffic for 192.168.10.70 goes to the default gateway, because .70 belongs to the next block.

How to calculate a subnet mask

You usually start from a prefix length or from a host count.

From a prefix length

Write the prefix as that many ones, pad with zeros to 32 bits, and convert each octet to decimal. For /20:

11111111.11111111.11110000.00000000  =  255.255.240.0

The third octet holds four ones, and the table above gives 240 for four ones. A shortcut: the prefix tells you how many full 255 octets there are (20 ÷ 8 = 2, remainder 4), and the remainder picks the value of the next octet.

From the number of hosts you need

Each subnet loses two addresses, the network address and the broadcast address, so the rule is:

usable hosts = 2^h − 2, where h is the number of host bits (zeros in the mask).

Find the smallest h for which 2^h − 2 is at least the number of hosts you need, then take prefix = 32 − h.

• 50 hosts: 2^5 − 2 = 30 is too small, and 2^6 − 2 = 62 is enough. So h = 6, the prefix is /26 and the mask is 255.255.255.192.
• 500 hosts: 2^8 − 2 = 254 is too small, and 2^9 − 2 = 510 is enough. So h = 9, the prefix is /23 and the mask is 255.255.254.0.

Leave some room for growth. You can confirm the result in the subnet mask calculator by entering, for example, 10.0.0.0/23 and reading the first and last address.

What is subnetting? Splitting a /24 into four /26 networks

Subnetting means dividing one network into smaller ones by moving the boundary between network and host bits to the right. Each bit you borrow from the host part doubles the number of subnets and halves their size.

Suppose you have 192.168.10.0/24 (256 addresses) and need four separate networks, for example for staff, guests, servers and cameras. Four subnets need 2 borrowed bits (2^2 = 4), so the prefix grows from /24 to /26 and the mask becomes 255.255.255.192. Each subnet has 2^6 = 64 addresses, 62 of them usable:

The network addresses go up in steps of 64, which is the block size. A quick way to find the block size is 256 minus the interesting octet of the mask: 256 − 192 = 64. The four subnets together offer 248 usable hosts instead of 254, because each one spends two addresses on its own network and broadcast addresses.

Wildcard masks: the inverse of a subnet mask

A wildcard mask flips every bit of the subnet mask: zeros mark bits that must match, ones mark bits that may vary. You can compute it by subtracting each octet from 255, so 255.255.255.192 becomes 0.0.0.63.

Cisco routers use wildcard masks in access control lists (ACLs) and in OSPF network statements:

access-list 10 permit 192.168.10.0 0.0.0.63
router ospf 1
 network 192.168.10.0 0.0.0.63 area 0

Both lines refer to the same /26 as the worked example. Unlike subnet masks, wildcard masks in ACLs don't have to be contiguous, but for plain subnets they are simply the inverse.

Classful networks and default subnet masks

Before 1993, IPv4 used fixed classes, and the first octet of an address decided its mask:

Class D (224–239) is reserved for multicast and class E (240–255) for experimental use, and 127 is kept for loopback. Because organizations could only receive blocks of 256, 65,536 or 16,777,216 addresses, the system wasted space. Classless Inter-Domain Routing (CIDR) replaced it with prefixes of any length, and its current specification is RFC 4632. Today the class of an address has no technical meaning.

Private address ranges and their masks

RFC 1918 reserves three blocks for private networks that are not routed on the public internet:

You rarely use a whole block as one network. A typical home router, for example, carves out a single 192.168.1.0/24 or 192.168.0.0/24 with the 255.255.255.0 subnet mask.

Subnet masks in IPv6

IPv6 has no dotted subnet masks. Networks are written only with a prefix length, as in 2001:db8:1234:5678::/64, and /64 is the standard size for a single LAN segment because stateless address autoconfiguration (SLAAC) needs a 64-bit interface identifier. IPv6 also has no broadcast address, so the "minus two" rule doesn't apply.

Common subnet mask mistakes

• Non-contiguous masks. 255.0.255.0 or 255.255.255.100 are not valid subnet masks, because the ones must form one unbroken run.
• Forgetting the network and broadcast addresses. A /24 has 256 addresses but only 254 usable hosts. Assigning .0 or .255 to a device in a /24 causes problems.
• Mismatched masks on one network. If one device uses /24 and another /25 on the same segment, they can disagree about which addresses are local, and some traffic is sent to the gateway or dropped.
• Mixing up the subnet mask and the wildcard mask. 0.0.0.255 in a subnet mask field, or 255.255.255.0 in an ACL, gives a completely different result.

Subnet mask cheat sheet: /8 to /32

This subnet mask chart lists every prefix from /8 to /32. Usable hosts are 2^(32 − prefix) − 2, with two exceptions: a /31 has 2 usable addresses on a point-to-point link (RFC 3021), and a /32 is a single host.

Check your work with the Subnet Calculator

The free Subnet Calculator runs entirely in your browser. Type an address with a prefix, such as 192.168.10.37/26, or with a dotted mask after the slash, such as 10.0.0.0/255.255.0.0, and it shows:

• the network address, subnet mask, the mask in binary, CIDR notation and wildcard mask;
• the network size (all addresses in the block, including network and broadcast);
• the first and last usable address and the broadcast address;
• the historical IP class of the address.

For a /31 it shows both addresses as usable and no broadcast, and an address without a mask is treated as a single host (/32). The Previous block and Next block buttons jump to the adjacent subnet of the same size, for example through the four /26 networks above. The tool covers IPv4 only, rejects non-contiguous masks, doesn't accept a mask separated by a space, and doesn't work out a prefix from a host count, so use the formula above for that step.

FAQ

What does the 255.255.255.0 subnet mask mean?

It is the /24 mask: the first three octets identify the network and the last octet identifies the host. A /24 network has 256 addresses, of which 254 can be assigned to devices, for example 192.168.1.1 to 192.168.1.254 in 192.168.1.0/24.

How do I find my computer's subnet mask?

On Windows, run ipconfig and look for the Subnet Mask line. On Linux, ip addr shows the address with its prefix, such as 192.168.1.20/24. On macOS, ipconfig getoption en0 subnet_mask prints the mask of the interface en0, and the network settings show it as well.

Why does a /31 have two usable addresses?

After removing the network and broadcast addresses, a two-address block would have no hosts left. RFC 3021 allows /31 networks on point-to-point links, where no broadcast is needed, so both addresses can be used by the two ends of the link.

Is a subnet mask the same as a default gateway?

No. The subnet mask defines which addresses are on the local network, while the default gateway is the address of the router that handles everything else. A device uses the mask first to decide whether a destination is local, and only sends the traffic to the gateway when it isn't.

Try it free: IPv4 subnet calculator Free to use, no account needed.