Subnet Masks Explained

What Is a Subnet Mask?

A subnet mask is a 32-bit number that separates the network portion of an IP address from the host portion. Like an IP address, it's written in dotted decimal notation:

IP Address:  192.168.1.100
Subnet Mask: 255.255.255.0

Binary Representation

The key to understanding subnet masks is looking at them in binary. A mask is a series of 1s followed by 0s:

255.255.255.0 in binary:
11111111.11111111.11111111.00000000
└── network bits (24) ──┘└ host (8)┘

The 1-bits mark the network portion. The 0-bits mark the host portion. A /24 mask has 24 ones.

Bitwise AND Operation

To find the network address, perform a bitwise AND between the IP address and the subnet mask:

IP:     192.168.1.100  = 11000000.10101000.00000001.01100100
Mask:   255.255.255.0  = 11111111.11111111.11111111.00000000
AND:    192.168.1.0    = 11000000.10101000.00000001.00000000
                         └────────── network address ──────────┘

Any IP address that produces the same network address after ANDing belongs to the same subnet.

Common Subnet Masks

Wildcard Masks

A wildcard mask is the inverse of a subnet mask. Used in router ACLs and OSPF configurations:

Subnet mask:  255.255.255.0   (match the network)
Wildcard mask: 0.0.0.255      (ignore the host portion)

Wildcard = 255.255.255.255 - Subnet Mask

Practice Example

Given 10.20.30.40/20, find the network address:

1. /20 mask = 255.255.240.0 = 11111111.11111111.11110000.00000000
2. AND with 10.20.30.40:
3. Third octet: 30 AND 240 = 00011110 AND 11110000 = 00010000 = 16
4. Network address: 10.20.16.0/20