What is a subnet mask? Net masks, CIDR notation and wildcard masks

02How a subnet mask works: the binary AND, step by step

To find its network, a host performs a bitwise AND of its address and the mask: each output bit is 1 only where both input bits are 1. Take 192.168.10.77 with the mask 255.255.255.192. The first three octets pass through unchanged, because the mask is 255 there. Only the last octet needs work: 77 is 01001101 and 192 is 11000000, so the result is 01000000, which is 64.

The network is therefore 192.168.10.64. The six host bits the mask left at 0 give 2^6 = 64 addresses, from 192.168.10.64 to 192.168.10.127. The first is the network address and the last, with every host bit set to 1, is the broadcast address, so hosts use .65 to .126: 62 of them.

• Write the address and the mask in binary, octet by octet
• AND them bit by bit: the result is the network address
• Set every host bit of the network address to 1: that is the broadcast address
• Everything between the two is the usable host range

address    192.168.10.77    11000000.10101000.00001010.01001101
mask       255.255.255.192  11111111.11111111.11111111.11000000
AND        192.168.10.64    11000000.10101000.00001010.01000000   network
host bits  set to 1         11000000.10101000.00001010.01111111   broadcast 192.168.10.127

$ python3 -c "import ipaddress as i; n = i.ip_interface('192.168.10.77/26'); print(n.network, n.netmask, n.hostmask, n.network.broadcast_address)"
192.168.10.64/26 255.255.255.192 0.0.0.63 192.168.10.127

03Subnet mask to CIDR notation

CIDR notation writes the mask as the number of one-bits after a slash: 255.255.255.0 is /24 and 255.255.255.192 is /26. Classless Inter-Domain Routing arrived with RFC 1519 in 1993 and is now specified in RFC 4632. It replaced fixed class sizes with prefixes of any length, and it is how routers, firewalls and cloud consoles describe networks today.

Converting by hand needs only the nine values a mask octet can take, because RFC 4632 requires the ones to be contiguous. Add 8 for every 255, then the one-bits of the last non-zero octet: 255.255.240.0 is 8 + 8 + 4 = /20. The block size in that octet, 256 minus its value, is the step between consecutive networks, so with 255.255.255.224 a new network starts every 32 addresses.

04Subnet mask cheat sheet: every prefix from /0 to /32

The table lists all 33 IPv4 masks with where each size usually turns up. Usable hosts subtract the network and broadcast addresses, except for /31, which RFC 3021 lets point-to-point links use in full, and /32, a single address. Prefixes shorter than /8 describe route summaries and reserved blocks rather than networks anyone numbers hosts in. To work out a specific network, use the subnet calculator.

05/25, /26 and /27 subnet masks: dividing a network into equal parts

Each extra network bit halves the subnet. A /25 (255.255.255.128) cuts a /24 into two halves of 128 addresses. A /26 subnet mask, 255.255.255.192, leaves 6 host bits: 64 addresses and 62 usable hosts, four networks per /24. A /27 subnet mask, 255.255.255.224, leaves 5: 32 addresses and 30 usable hosts, eight per /24.

A network of a given size must start on a multiple of its block size. 10.20.30.64/26 is a valid network; 10.20.30.96 cannot start a /26, because 96 is not a multiple of 64, and with that mask it is simply a host inside 10.20.30.64/26. Every /26 holds exactly two /27s, so the two sizes nest without gaps.

06What is a wildcard mask?

A wildcard mask is the inverse of a subnet mask: a 0 bit must match, a 1 bit is ignored. Subtract each octet of the subnet mask from 255 to get it, so 255.255.255.192 becomes 0.0.0.63. Cisco IOS access lists and OSPF network statements use wildcard masks, and Cisco's documentation also calls them inverse masks.

In a Cisco access list, 192.168.10.64 0.0.0.63 therefore matches the same 64 addresses as 192.168.10.64/26. Most other systems, including Linux firewalls and cloud security groups, expect prefixes or ordinary masks, so convert before copying a rule from one to the other.

07Classful addressing: class A, B and C networks

Before CIDR, the first bits of an address fixed the size of its network. RFC 791 (1981) defined classes A, B and C; RFC 1112 (1989), the IP multicast standard, uses class D for multicast and reserves class E. A class B network IP address starts with the bits 10, so it lies between 128.0.0.0 and 191.255.255.255, carries an implied 255.255.0.0 mask and holds 65,536 addresses; there were 16,384 such networks.

Classes wasted space. An organisation needing 2,000 addresses had to take a class B of 65,536, or juggle several class C networks that each needed its own route. CIDR removed the classes in 1993, so today a class is only a label: 172.16.0.0/12 is private space spanning 16 old class B networks, and 10.0.0.0/8 is one old class A.

08Wrong subnet mask: symptoms, causes and fixes

Mask errors rarely break everything. They break some destinations, which makes them easy to mistake for firewall or DNS problems. The cause sits on the host, the router's LAN interface or the DHCP scope, not at the remote site, so compare the prefix with ip -brief address show on Linux or ipconfig on Windows first. To see how the same addresses look from outside, the IP lookup shows the public prefix your network is announced in, and BGP explains how those prefixes are routed.