Subnet Mask Explained: How IP Addressing Really Works

When a computer sends a packet to another IP address, it must first decide whether that address is on the same local network or somewhere else. That decision is made by the subnet mask. If the destination is local, the packet goes straight to it over the local wire. If not, the packet is handed to the router. Getting this decision wrong – or misunderstanding what the mask actually does – is a common source of connectivity failures that look like hardware faults but are really addressing mistakes.

The mask is a 32-bit number that, when combined with an IP address, reveals which bits of the address identify the network and which bits identify a specific host on that network. The bits that are 1 in the mask are the network part; the bits that are 0 are the host part. For example, the familiar mask 255.255.255.0 has 24 ones followed by 8 zeros. In binary it is:

11111111 11111111 11111111 00000000

Any address paired with this mask has its first 24 bits treated as the network identifier and the last 8 bits as the host identifier. The network identifier is the same for every address on that subnet. Two addresses share the same network identifier if and only if they are on the same subnet, meaning they can communicate directly without a router.

What the Mask Does Bit by Bit

To see whether two addresses are on the same subnet, perform a bitwise AND between each address and the mask. The AND operation keeps a bit only if both corresponding bits are 1. For an address like 192.168.1.10 with mask 255.255.255.0:

Address:  11000000 10101000 00000001 00001010
Mask:     11111111 11111111 11111111 00000000
Result:   11000000 10101000 00000001 00000000

The result, 192.168.1.0, is the network address. Any other address that, when ANDed with the same mask, also yields 192.168.1.0 is on the same subnet. For instance, 192.168.1.200 AND 255.255.255.0 gives 192.168.1.0, so it is local. But 192.168.2.10 AND 255.255.255.0 gives 192.168.2.0, which is different, so that address is remote and the packet must go through a router.

The host part is the remainder after the network part is removed. In the example, the host part is the last 8 bits, which can represent values from 0 to 255. However, the all-zeros host (192.168.1.0) is the network address itself and cannot be assigned to a device. The all-ones host (192.168.1.255) is the broadcast address for that subnet. That leaves 254 usable addresses.

Why /24 Is a Convention, Not a Rule

The shorthand /24 refers to the number of 1 bits in the mask. A /24 mask has 24 ones and 8 zeros, which is 255.255.255.0. The /24 is a common choice because it divides an IP address into three octets for the network and one for hosts, which is easy to read and manage. But nothing about the IP protocol requires a /24. Masks can have any number of leading ones from 0 to 32, as long as the ones are contiguous. For example, a /25 mask (255.255.255.128) splits a /24 into two subnets of 128 addresses each. A /16 (255.255.0.0) groups 65,536 addresses into one network. The choice of mask determines how many hosts a subnet can contain and how many subnets you can carve out of a larger block.

Working Out Reachability in Your Head

You can determine whether two addresses are on the same subnet without a calculator by comparing the network bits. Write both addresses in binary, or use the dotted-decimal form and compare the octets that are fully covered by the mask.

For a /24 mask, only the first three octets matter. If they match, the addresses are local. For a /16, only the first two octets matter. For masks that do not align with octet boundaries, such as /25 or /26, you must examine the bits within the boundary octet.

Example: Is 10.20.30.40 on the same subnet as 10.20.30.90 with mask 255.255.255.128 (/25)?

The mask 255.255.255.128 in binary is:

11111111 11111111 11111111 10000000

The first three octets are fully covered, so they must match: both have 10.20.30. The fourth octet is split: the highest bit is part of the network, the lower 7 bits are host. The network bit is 0 for 40 (00101000) and 0 for 90 (01011010) – both have 0 in the 128s place. So they share the same network bit and are on the same subnet. If the second address were 10.20.30.200 (11001000), the network bit would be 1, so they would be on different subnets.

A practical shortcut: for a /25, the subnet boundary is at 128. Addresses from 0 to 127 are in one subnet, and 128 to 255 in another. For a /26 (mask 255.255.255.192), the boundary is at 64, then 128, then 192. The pattern is that the subnet size is 2^(32 - prefix length). A /24 gives 256 addresses, a /25 gives 128, a /26 gives 64, and so on.

Common Misconceptions

A frequent mistake is to assume that any two addresses with the same first three octets are on the same subnet. That is true only for a /24 mask. If the mask is /25 or /26, two addresses can share the first three octets yet be on different subnets. For example, 192.168.1.10 and 192.168.1.200 are both in 192.168.1.x, but with a /25 mask they are on different subnets because the boundary falls inside the fourth octet. This is a natural error because most home networks use /24, and the pattern is so familiar that it feels universal.

Another misconception is that the subnet mask must be 255.255.255.0 or that a /24 is the only valid mask. In reality, any contiguous prefix length is valid, and networks with different masks can coexist. The mask is not a property of the IP address itself; it is a configuration parameter on each interface. Two devices on the same physical wire can be on different subnets if their masks differ, and they will not be able to communicate directly.

How to Verify Your Own Subnet

On a Windows machine, the ipconfig command shows the IPv4 address and subnet mask for each adapter. On Linux or macOS, ifconfig or ip addr shows the same. To see the network address, you can use ipcalc on Linux, or do the AND operation manually. The output of ipconfig looks like:

IPv4 Address. . . . . . . . . . . : 192.168.1.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1

The default gateway is the router’s address on your subnet. If you change the subnet mask, you must also ensure that the gateway is on the same subnet, or you will lose internet access.

Comparison of Common Masks

Practical Calculation Steps

To determine if two addresses are on the same subnet without a router:

1. Write down the subnet mask in binary.
2. Write down both IP addresses in binary.
3. Compare the bits that are 1 in the mask. If they are identical for both addresses, they are on the same subnet.

For a quick mental check, convert the mask to its prefix length and compute the subnet size. The subnet size is 2^(32 - prefix). The network address is the largest multiple of that size that is less than or equal to the IP address. For example, with a /25 and address 192.168.1.200, the subnet size is 128. The multiples of 128 are 0 and 128. The network address is 192.168.1.128. Any address from 128 to 255 is in that subnet.

Why This Matters in Practice

If two devices have IP addresses that are not on the same subnet, they will not communicate even if they are connected to the same switch. The sending device will see that the destination is not local and will try to send the packet to its default gateway. If no gateway is configured, the packet is dropped. This is a common cause of “can’t ping the other computer” problems that are not fixed by checking cables or rebooting. Understanding the mask lets you diagnose such issues by calculating the subnets yourself.

What People Get Wrong

The most common error is to think of the subnet mask as a fixed part of the IP address. It is not. The mask is a separate setting, and it can be different on different devices. Two devices on the same wire can have different masks and therefore different subnets. Another error is to assume that a /24 is the only option and that all addresses in a 192.168.x.x range are automatically on the same subnet. That is only true if the mask is /24. If you change the mask to /25, you split that range into two separate subnets, and devices on opposite sides cannot talk to each other without a router.

This mistake is natural because most home routers use /24 by default, and the first three octets are so visually prominent. The human eye focuses on the dotted decimal form, where the boundary between network and host is not obvious. The mask is the missing piece that defines the boundary, and it is easy to overlook.

Working with CIDR Notation

CIDR (Classless Inter-Domain Routing) notation writes the prefix length directly after the IP address, such as 192.168.1.0/24. The number after the slash is the number of 1 bits in the mask. This notation is used in routing tables and network configuration. To convert from CIDR to a dotted mask, write that many ones followed by zeros and group into octets. For example, /18 means 18 ones, which gives 255.255.192.0. The subnet size for /18 is 2^(32-18) = 16,384 addresses.

When you see an address like 10.0.0.5/8, the mask is 255.0.0.0, and the network is 10.0.0.0. The host part is the last 24 bits, allowing over 16 million hosts. This is why large organizations use /8 or /16 blocks.

Summary of Key Points

• The subnet mask is a 32-bit number that separates the network and host parts of an IP address.
• Two addresses are on the same subnet if their network bits match.
• The /24 mask is common but not mandatory; any prefix length is valid.
• To check reachability, compare the bits that are 1 in the mask.
• The mask is a configuration setting, not a property of the address itself.