subnet masks

Overview

A subnet mask is the companion to an IP address that marks which bits are the network portion and which are the host portion. It is the classic (pre-CIDR-notation) way to express the same idea as a CIDR prefix, and it appears in nearly every device's network settings.

Learning objectives

• Define a subnet mask.
• Convert between subnet masks and CIDR prefixes.
• Explain how a host uses the mask.

Core concept

A subnet mask is a 32-bit value written like an IPv4 address (e.g. 255.255.255.0) where the 1 bits mark the network portion and the 0 bits mark the host portion. In binary, the 1s are all on the left, the 0s all on the right.

Subnet masks correspond directly to CIDR prefixes — they are two notations for the same thing:

How it works

A host combines its IP address with its subnet mask to determine its own network address, and it uses the mask to decide whether a destination is local or remote. Conceptually, wherever the mask has a 1, that bit belongs to the network; wherever it has a 0, that bit identifies the host. This is exactly how a host answers the "same network or send to gateway?" question from the addressing lesson.

Practical example

A device configured with IP 192.168.1.10 and mask 255.255.255.0 (/24) treats 192.168.1 as its network. When it wants to reach 192.168.1.50, the mask shows that address shares the same network → deliver locally. When it wants to reach 192.168.2.50, the mask shows a different network → send to the default gateway. The mask is what makes that decision possible.

Cybersecurity relevance

Correct subnet masks define network boundaries, which underpin segmentation and firewall scoping. A wrong mask can merge networks that should be separate or isolate hosts that should communicate — both with security consequences. Reading masks/prefixes accurately is essential when analyzing configurations or planning segmentation.

Common mistakes

• Mismatched masks between hosts on the same intended network, causing connectivity failures.
• Confusing which bits are network vs host — 1s = network, 0s = host.
• Treating mask and CIDR as unrelated — they express the same split.

Key takeaways

• A subnet mask is a 32-bit value where 1 bits mark the network portion and 0 bits mark the host portion.
• Masks map directly to CIDR prefixes (255.255.255.0 = /24, etc.).
• A host uses its mask to find its own network and to decide if a destination is local or must go via the gateway.

Check your understanding

• What CIDR prefix does the subnet mask 255.255.255.0 correspond to?
• How does a host use its subnet mask to decide whether to send a packet directly or to the gateway?