What Is a Subnet Mask?
A subnet mask is a 32-bit companion to an IPv4 address that marks where the "network" part of the address ends and the "host" part begins. Reading from the left, every 1 in the mask means "this bit belongs to the network," and every 0 means "this bit identifies an individual host." Together the address and mask answer one question every device asks constantly: is this other machine on my local network, or do I have to send to it through a router?
Part of the Subnetting & IP Addressing learning hub
Think of a full street address. The subnet mask is the rule that says how much of the address is the street name (shared by every house on it) and how much is the house number (unique to one home). Change where you draw that line and you change how many houses fit on the street.
What a Subnet Mask Actually Is
An IPv4 address is 32 bits, usually shown as four decimal numbers (like 192.168.10.25). By itself, that address gives no hint about where the network portion stops and the host portion starts. The subnet mask supplies that missing information.
The mask is also 32 bits, and its 1s are always contiguous and grouped on the left. A mask of 255.255.255.0 is really 11111111.11111111.11111111.00000000 in binary: 24 ones followed by 8 zeros. Those 24 network bits are fixed for everyone on the subnet; the 8 host bits are what make each device unique. The mask never travels as a separate label glued to the address it just tells the local device how to split that address.
Why It Exists: The Problem It Solves
Without a mask, a computer could not decide whether a destination is a neighbor it can reach directly or a stranger it must hand off to its default gateway. The mask is the tool it uses to make that decision.
When your device wants to talk to another IP, it applies its own mask to both its address and the destination address. If the network portions match, the two are on the same subnet and can communicate directly at Layer 2. If they differ, the traffic is "off-subnet" and gets sent to the default gateway the router that owns the default route (0.0.0.0/0) toward the rest of the world. This is also what lets one large address block be carved into many smaller, isolated networks, which keeps broadcast traffic contained and improves security and organization.
Two Ways to Write the Same Thing: Dotted Decimal vs CIDR
The same mask has two common notations. Dotted-decimal spells out all four bytes, such as 255.255.255.0. CIDR (Classless Inter-Domain Routing) notation, also called the prefix length, just counts the network bits and writes them after a slash: /24.
So 192.168.10.25 with mask 255.255.255.0 is identical to 192.168.10.25/24 both say "24 network bits." CIDR is shorter and is what you will see most often in modern documentation, routing tables, and exams. A few worth memorizing: /24 = 255.255.255.0, /16 = 255.255.0.0, /8 = 255.0.0.0, and /26 = 255.255.255.192.
How the Mask Determines Network, Broadcast, and Host Count
Once you know how many bits are host bits, three key facts fall out. The network address is the address with every host bit set to 0 it names the subnet itself. The broadcast address is the address with every host bit set to 1 it reaches every host on that subnet at once.
The number of usable host addresses is 2 raised to the number of host bits, minus 2. You subtract 2 because the network address and the broadcast address are reserved and cannot be assigned to a device. For a /24 there are 8 host bits, so 2^8 - 2 = 254 usable addresses (for example .1 through .254, with .0 as the network and .255 as the broadcast).
Two special cases break the minus-2 rule. A /31 is used on point-to-point links and provides exactly 2 usable addresses (no separate broadcast), and a /32 describes a single host with no host range at all handy for identifying one interface, such as an OSPF loopback advertised as a /32.
The Wildcard Mask: The Mask Turned Inside Out
A wildcard mask is simply the bit-for-bit inverse of a subnet mask: flip every 1 to a 0 and every 0 to a 1. So the subnet mask 255.255.255.0 becomes the wildcard 0.0.0.255, and a /26 mask (255.255.255.192) becomes 0.0.0.63.
The logic is reversed too. In a subnet mask a 1 means "this bit must match" (it is network). In a wildcard a 0 means "must match" and a 1 means "don't care." You will meet wildcard masks when writing access control lists (ACLs) and when defining which interfaces a protocol like OSPF should run on. If you can compute a subnet mask, you already know the wildcard just subtract each octet from 255.
Default Masks Per Class and the Gotchas Beginners Hit
Older "classful" addressing gave each range a built-in default mask: Class A (first octet 1-126) defaulted to /8, Class B (128-191) to /16, and Class C (192-223) to /24. These defaults still shape textbook examples, but real networks are classless the mask is chosen deliberately, and you can subnet a Class A block with a /24 or a Class C block with a /30 whenever it makes sense.
A few common confusions trip up beginners. First, the mask is not part of the packet a router does not read your mask off the wire; it makes forwarding decisions from the prefixes in its own routing table using longest-prefix match. Second, the network and broadcast addresses are not usable, so a /30 (4 total addresses) gives only 2 hosts, which is why it is popular for router-to-router links. Third, a valid mask always has its 1-bits contiguous something like 255.0.255.0 is not a legal subnet mask. When you are ready to apply this on gear, our step-by-step how-to guides walk through the actual interface configuration; this article is just the concept behind it.
Frequently asked questions
What does the /24 in an address like 192.168.1.10/24 mean?
The /24 is CIDR (prefix) notation for the subnet mask. It says the first 24 bits are network bits, which is the same as the dotted-decimal mask 255.255.255.0. That leaves 8 host bits, so this subnet holds 2^8 - 2 = 254 usable host addresses, with .0 as the network address and .255 as the broadcast.
Why do I subtract 2 when counting usable hosts?
Because two addresses in every ordinary subnet are reserved and can't be assigned to a device: the network address (all host bits 0, which names the subnet) and the broadcast address (all host bits 1, which reaches every host at once). So usable hosts = 2^(host bits) - 2. The exceptions are a /31, which gives 2 usable addresses on point-to-point links, and a /32, which is a single host.
Does my subnet mask get sent across the internet with my traffic?
No. The subnet mask is local configuration on your host and its interface it is not carried inside the IPv4 packet header. Your own device uses the mask to decide whether a destination is local or off-subnet, and routers along the way make their own decisions using the prefixes in their routing tables (choosing the most specific match, known as longest-prefix match). The mask never rides along with an individual packet.
Now build it on real Cisco IOS
Concepts stick when you configure them. Try a free graded lab, then grade your own config against the answer key.