Subnet masks and CIDR explained

A subnet mask tells a device which part of an IP address names the network and which part names the device on it.

Why a mask is needed

When your laptop wants to send data to another address, it must decide: "is this address on my own network, so that I can deliver directly, or is it elsewhere, so that I must hand it to the router?" The subnet mask answers that. It marks how many of the leading bits of an address are the network part. If those bits match the laptop's own, the other address is a neighbour.

Reading a mask

An IPv4 address is 32 bits, written as four numbers of 8 bits each. A mask is 32 bits too: a row of ones followed by a row of zeros. The ones cover the network part.

CIDR notation is the short way to write the same thing: a slash and the count of ones. 192.168.1.0/24 means "the network whose first 24 bits are 192.168.1". So /24 and 255.255.255.0 are two spellings of one fact. Our CIDR table lists every size.

Working out a network by hand

Take the address 192.168.1.77 with mask 255.255.255.0 (/24).

1. Network address: keep the network part, set the device part to zeros: 192.168.1.0.
2. Broadcast address: keep the network part, set the device part to ones: 192.168.1.255. Data sent here goes to every device on the network.
3. Usable addresses: everything in between, 192.168.1.1 to 192.168.1.254.
4. How many: the device part has 8 bits, so 2 to the power 8 = 256 addresses, less the two special ones = 254 devices.

The general rule: with a prefix of /n, the block holds 2^(32 − n) addresses, and two fewer are usable.

A harder example: /26

192.168.1.77/26 leaves 6 bits for devices, so blocks of 64 addresses: 0 to 63, 64 to 127, 128 to 191 and 192 to 255. The address .77 falls in the second block, so the network is 192.168.1.64, the broadcast address is 192.168.1.127 and the usable range is .65 to .126: 62 devices. The subnet calculator shows this working for any address.

Why split a network at all?

• Order: an office gives each floor or department its own block.
• Safety: guests and cameras can be kept on a separate network from staff computers.
• Less noise: broadcast messages stay inside the smaller network.
• Saving addresses: a link between two routers needs only two addresses, so it gets a /30 or /31, not a whole /24.

What you need at home

Almost nothing. Home routers use /24: mask 255.255.255.0, 254 addresses, more than a household needs. You meet the mask only when setting an address by hand, where the fields are "IP address", "subnet mask" (or "prefix length", type 24) and "gateway". Copy the mask from another device on the same network.

The old classes

Before CIDR, addresses came in fixed sizes: class A (/8), class B (/16) and class C (/24), told apart by the first number. That scheme wasted huge blocks and was replaced in 1993, but the words survive, and people still say "a class C" to mean a /24.