What Is a Subnet Mask and How Does Subnetting Work?

A subnet mask is a 32-bit mathematical bitmask that splits an IP address into two distinct segments: the network address (identifying which logical network the device belongs to) and the host address (identifying the specific device on that network). By comparing an IP address with its subnet mask using binary AND logic, routers instantly determine whether destination packets should be delivered locally or routed to external gateways.

Without subnetting, every computer connected to an organization would reside in a single colossal broadcast domain. Broadcast packets (such as ARP discovery requests) would flood every network interface simultaneously, consuming valuable switch backplane bandwidth, creating severe network congestion, and exposing private internal communications to passive security eavesdropping across the entire infrastructure.

The Bitmask Foundation: How Routers Perform Binary AND Logic

An IPv4 address consists of 32 contiguous binary bits. A subnet mask functions as a mathematical filter composed of consecutive binary 1s followed by consecutive binary 0s:

• The binary 1s represent the Network Portion (which must match identical bit-for-bit across all local devices).
• The binary 0s represent the Host Portion (identifying individual computers, printers, and phones within that subnet).

Consider the most common subnet mask in home networking: 255.255.255.0. When your computer sends a packet, its operating system executes a hardware bitwise AND operation (where \(1 \text{ AND } 1 = 1\), and any other combination yields \(0\)):

IP Address:  192.168.1.50   = 11000000 . 10101000 . 00000001 . 00110010
Subnet Mask: 255.255.255.0  = 11111111 . 11111111 . 11111111 . 00000000
-------------------------------------------------------------------------
Network ID:  192.168.1.0    = 11000000 . 10101000 . 00000001 . 00000000
Host ID:     .50            =                             . 00110010

Because the first 24 bits are binary 1s, the router determines that any device whose IP address begins with 192.168.1.x is located on the local physical switch. If your computer tries to send a packet to 192.168.1.15, the packet stays local. If it sends a packet to 8.8.8.8, the router immediately knows the destination is external and forwards the packet out through the Default Gateway.

CIDR Notation (Classless Inter-Domain Routing)

In historic networking (pre-1993), IP addresses were rigidly categorized into Class A, Class B, and Class C networks. This architecture wasted millions of addresses because an organization needing 300 hosts was forced to take a Class B block containing 65,536 addresses.

In 1993, the IETF introduced Classless Inter-Domain Routing (CIDR) via RFC 1519 (later updated by RFC 4632). Under CIDR, subnet masks are written as a forward slash followed by the count of consecutive binary 1s. For example, because 255.255.255.0 contains 24 binary ones, it is written cleanly as /24. An address written as 192.168.1.50/24 conveys both the host IP and its subnet boundary in a single compact string.

The Complete CIDR Subnetting Reference Table

The following cheat sheet illustrates the mathematical relationship between CIDR prefixes, subnet masks, total addresses, and usable host capacities across IPv4:

You can verify your subnet calculations and view binary breakdowns using our free IPv4 Subnet Calculator and convert prefixes with our CIDR to Range Converter.

Why Are There Always 2 Fewer Usable Hosts?

Notice that for a /24 subnet with 256 total addresses, only 254 can be assigned to computers or routers. In any IPv4 subnet, two addresses are strictly reserved by protocol definition:

1. The Network Address (All Host Bits = 0): The very first address in the block (e.g., 192.168.1.0). It represents the subnet itself in router forwarding tables and cannot be bound to an individual network adapter.
2. The Broadcast Address (All Host Bits = 1): The very last address in the block (e.g., 192.168.1.255). Packets transmitted to this address are flooded by network switches to every active host on the subnet.

This gives rise to the universal networking formula for calculating usable host capacity: Usable Host Capacity = 2^(Host Bits) - 2. For a /24 prefix, there are 8 host bits remaining (\(32 - 24 = 8\)). Therefore, \(2^8 - 2 = 256 - 2 = 254\) usable hosts.

Step-by-Step Tutorial: How to Subnet a Network in 4 Steps

Suppose you are a network engineer tasked with dividing the private address block 192.168.10.0/24 into 4 equal, isolated departmental subnets (HR, Finance, Operations, and Guest Wi-Fi). Follow this systematic 4-step engineering procedure:

1. Step 1: Calculate the Required Borrowed Bits: You need 4 subnets. Use the formula \(2^n \ge \text{Subnets}\). Since \(2^2 = 4\), you must borrow exactly 2 bits from the host portion.
2. Step 2: Determine the New CIDR Prefix and Subnet Mask: Add the borrowed bits to the original prefix: \(24 + 2 = \mathbf{/26}\). In binary, the last octet is 11000000, which translates to a decimal subnet mask of 255.255.255.192.
3. Step 3: Calculate the Subnet Block Size (Magic Number): Subtract the interesting octet of the subnet mask from 256: \(256 - 192 = \mathbf{64}\). Every subnet advances by intervals of 64 addresses!
4. Step 4: Map Out the Subnet Address Boundaries:
   • Subnet 1 (HR): Network: 192.168.10.0 | Usable Range: 192.168.10.1 – 192.168.10.62 | Broadcast: 192.168.10.63
   • Subnet 2 (Finance): Network: 192.168.10.64 | Usable Range: 192.168.10.65 – 192.168.10.126 | Broadcast: 192.168.10.127
   • Subnet 3 (Operations): Network: 192.168.10.128 | Usable Range: 192.168.10.129 – 192.168.10.190 | Broadcast: 192.168.10.191
   • Subnet 4 (Guest Wi-Fi): Network: 192.168.10.192 | Usable Range: 192.168.10.193 – 192.168.10.254 | Broadcast: 192.168.10.255

You have partitioned your physical LAN into four isolated logical segments, preventing unauthenticated Guest Wi-Fi devices from intercepting confidential packets from your Finance or HR networks.

To learn how private IP ranges connect to the global web, read our guide on Public IP vs Private IP: What's the Difference?.