Subnet Mask Explained: What 255.255.255.0 and /24 Mean

A subnet mask tells a device which part of an IP address identifies the network and which part identifies the individual device. The common mask 255.255.255.0, also written /24, means the first three numbers are the network (for example 192.168.1) and the last number, 1 to 254, is the device.

To see yours, run ipconfig on Windows (look for Subnet Mask) or ip -4 address on Linux, which shows the same thing as a / suffix after the address.

What a subnet mask actually does

Every time a device sends a packet, it has to decide: is the destination on my local network, so I can deliver it directly, or somewhere else, so I hand it to the router (the default gateway)? The subnet mask is how it decides. RFC 950, which standardised subnetting in 1985, describes the test: apply the mask to your own address and to the destination; if the results match, the destination is local, otherwise send it to a gateway.

"Apply the mask" means a bitwise AND. Write everything in binary, and each 1 in the mask keeps the address bit while each 0 clears it:

Address  192.168.1.130   11000000.10101000.00000001.10000010
Mask     255.255.255.0   11111111.11111111.11111111.00000000
AND      192.168.1.0     11000000.10101000.00000001.00000000   (network address)

Any other address that ANDs to 192.168.1.0 with this mask, from 192.168.1.1 to 192.168.1.254, is on the same network. 192.168.2.10 ANDs to 192.168.2.0, so it's elsewhere and the packet goes to the router.

A valid mask is always a run of 1s followed by a run of 0s. That's why only certain numbers ever appear in a mask octet: 0, 128, 192, 224, 240, 248, 252, 254 and 255.

What /24 means (CIDR notation)

Because the mask is just "N ones, then zeros", it can be written as the count N. RFC 4632 (CIDR) defines this notation: an address, a slash, and a number from 0 to 32 that gives "the number of significant bits". So:

• 192.168.1.0/24 = network 192.168.1.0 with mask 255.255.255.0 (24 ones)
• 10.0.0.0/8 = mask 255.0.0.0
• 172.16.0.0/12 = mask 255.240.0.0

Windows shows both forms depending on where you look. ipconfig prints the dotted mask, while PowerShell's Get-NetIPAddress prints the prefix length (real output, trimmed to one adapter):

PS> Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias Wi-Fi | Select-Object IPAddress, PrefixLength

IPAddress     PrefixLength
---------     ------------
192.168.1.42            24

Subnet mask cheat sheet

Each step to a longer prefix halves the size of the network. "Usable hosts" subtracts two addresses that normally can't be assigned to a device (explained below).

The formula: a /N network has 2^(32−N) addresses. For /26 that's 2⁶ = 64. All values above were computed with Python's ipaddress module, which you can use to check any network yourself:

python -c "import ipaddress as i; n=i.ip_network('192.168.1.128/26'); print(n.netmask, n.num_addresses, n.broadcast_address)"

Output: 255.255.255.192 64 192.168.1.191.

Network address, broadcast address and usable range

In each subnet, two addresses are traditionally reserved:

• The network address, with all host bits 0: identifies the subnet itself (192.168.1.0 in a /24).
• The broadcast address, with all host bits 1: a packet sent to it goes to every device on the subnet (192.168.1.255 in a /24).

Everything between is usable for devices. The exception is /31: RFC 3021 lets point-to-point links between two routers use both addresses as hosts, because a link with exactly two ends doesn't need a broadcast address.

Worked example: which subnet is 192.168.1.130/26 in?

A /26 mask is 255.255.255.192. The last octet has 2 network bits and 6 host bits, so the /24 splits into four blocks of 64:

130 falls in the third block. The quick method without binary: subtract the mask octet from 256 to get the block size (256 − 192 = 64), then find the largest multiple of 64 that's not above 130. That's 128, the network address. The broadcast address is the next block's start minus one: 191.

Consequence: 192.168.1.130/26 and 192.168.1.70/26 look like neighbours, but they're on different subnets and can only talk through a router.

Where subnet masks cause real problems

• Static IP with the wrong mask. If you set a device to 192.168.1.50 with mask 255.255.0.0 while everything else uses /24, it believes all of 192.168.x.x is local and tries to reach those addresses directly instead of through the router. Copy the mask the router hands out.
• Two networks that overlap. A VPN or virtual machine network that uses the same range as your home network (both 192.168.1.0/24, say) makes addresses ambiguous, and traffic goes to the wrong one. Pick a different private range for one of them.
• Addresses starting with 169.254. If ipconfig shows a 169.254.x.x address with mask 255.255.0.0, the device has no routable address and assigned itself a link-local one from the 169.254.0.0/16 range defined in RFC 3927. On a network that should have DHCP, that usually means the request to the router failed. The mask is a symptom; fix the connection.

Subnet masks apply to any IPv4 network, but the ranges you'll see at home and work are the private ones covered in public vs private IP addresses.

Frequently asked questions

What is the subnet mask for a /24 network?

255.255.255.0. A /24 prefix means the first 24 bits of the address identify the network, and 24 one-bits written as four decimal octets are 255.255.255.0. That leaves 8 bits for hosts: 256 addresses, of which 254 can be assigned to devices.

What subnet mask should I use for my home network?

Leave the router's default, which is almost always 255.255.255.0 (/24). That gives 254 usable addresses, more than a home network needs. The mask must match on every device in the network, which happens automatically when they get their settings from the router by DHCP.

What happens if the subnet mask is wrong?

The device miscalculates which addresses are local. Too narrow a mask makes it send traffic for local devices to the router, or fail to reach them; too wide a mask makes it try to reach remote addresses directly instead of through the gateway. Either way, some connections fail while others work, which makes the problem confusing to diagnose.

Does IPv6 use subnet masks?

IPv6 doesn't use dotted masks; it always writes the prefix length, such as 2001:db8::/64. The idea is identical: the prefix length says how many leading bits identify the network.

Sources

• RFC 950: Internet Standard Subnetting Procedure
• RFC 4632: Classless Inter-domain Routing (CIDR)
• RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links
• RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses
• Microsoft Learn: ipconfig
• Linux man-pages: ip-address(8)