What Is a Subnet Mask and How Does It Work?

What is a subnet mask? It's a 32-bit number that divides an IPv4 address into a network portion and a host portion, allowing devices to distinguish local traffic from traffic destined for other networks.

That separation is what makes it possible to divide one large network into smaller, more manageable subnets, each with its own address range. This improves security, organization, and performance as a network grows.

This guide covers how a subnet mask works, how to read CIDR (Classless Inter-Domain Routing) notation like /24, and how to find and calculate your own subnet mask. It also explains why subnetting is foundational to building secure, organized business networks.

Key Takeaways

• A subnet mask defines which part of an IP address identifies the network and which part identifies the host device.
• It can be written in dotted decimal (255.255.255.0) or CIDR shorthand (/24); both describe the same network-to-host split.
• Subnetting divides one large network into smaller subnets to improve security, performance, and organization.
• You can find your subnet mask in seconds through your operating system's network settings or commands like ipconfig and ifconfig.
• In business networks, subnetting works alongside VLANs to isolate traffic such as guest Wi-Fi, VoIP, and point-of-sale systems.

What Is a Subnet Mask?

A subnet mask is a 32-bit number that pairs with an IPv4 address to separate the network portion from the host portion. It's written in the same dotted-decimal format as an IP address, such as 255.255.255.0, with four numbers separated by periods.

For example, take the IP address 192.168.1.10 with a subnet mask of 255.255.255.0. The subnet mask tells a device that the first three numbers, 192.168.1, identify the network, while the last number, 10, identifies this specific device on that network. Every other device sharing the 192.168.1.x range is on the same local network; anything outside it needs to be reached through a gateway.

It helps to keep the two numbers conceptually separate. An IP address identifies a specific device, while a subnet mask defines the boundary of the network that address belongs to. On its own, the IP address doesn't reveal which portion is network and which is host, and the subnet mask doesn't identify a specific device.

Subnet masks in this dotted-decimal format apply to IPv4 addresses. IPv6 networks use prefix lengths instead, such as /64, to define the network portion of an address. Despite growing IPv6 adoption, most business networks, internal infrastructure, and device management interfaces still rely primarily on IPv4, which is why subnet masks remain a core skill for network administrators.

How Does a Subnet Mask Work?

A subnet mask tells a device which IP addresses belong to its own local network and which addresses require a router or gateway to reach.

When a device wants to send data, it uses its subnet mask to determine whether the destination is on its local network. It does this by applying a bitwise AND operation to its own IP address and the destination address, using the subnet mask to extract the network portion of each. If those network portions match, the destination is local and the device delivers the traffic directly; if they don't match, the traffic is forwarded to a gateway for routing elsewhere.

Network Bits vs. Host Bits

Every subnet mask is made up of 32 bits, each either a 1 or a 0. The 1s mark the portion of the IP address reserved for identifying the network, while the 0s mark the portion available for identifying individual host devices.

The more bits set to 0, the more host addresses are available on that subnet. A mask with 24 network bits and 8 host bits leaves room for far fewer devices than one with 16 network bits and 16 host bits. This tradeoff is central to sizing a subnet for a specific number of devices.

Binary and Decimal: A Worked Example

The subnet mask 255.255.255.0 looks simple in decimal, but its binary form shows exactly why it works. Written out, 255.255.255.0 becomes 11111111.11111111.11111111.00000000, twenty-four 1s followed by eight 0s.

Applied to the IP address 192.168.1.10, those twenty-four 1-bits align with the first three octets of the address, marking 192.168.1 as the network portion. The remaining eight 0-bits align with the final octet, marking the number 10 as the host portion identifying this specific device. Every device on this network shares the same 192.168.1 network portion and is distinguished only by the final octet.

Understanding CIDR Notation and /24

CIDR notation is a shorthand way of writing a subnet mask by stating how many bits are used for the network portion. It's written as a forward slash followed by a number, such as /24. It represents the same information as a dotted-decimal subnet mask in a more compact form, and it's the format most commonly used in modern network documentation and configuration interfaces.

CIDR notation replaced the older system of classful addressing, which assigned networks into fixed classes (A, B, or C) with predetermined sizes. That rigid structure wasted large blocks of address space and couldn't fit networks that fell between class sizes. The Internet Engineering Task Force introduced classless addressing in the early 1990s to solve this.

What Does /24 Mean?

A /24 subnet mask means the first 24 bits of the IP address are reserved for the network portion, leaving the remaining 8 bits for host addresses. In dotted decimal, /24 is equivalent to 255.255.255.0.

Those 8 remaining host bits provide 256 possible address combinations, but not all of them are usable for devices. One address is reserved to identify the network itself, and one is reserved as the broadcast address for the subnet, leaving 254 usable host addresses on a /24 network. This is one of the most common subnet sizes in small and mid-sized business networks because it comfortably supports typical department or office segments.

CIDR vs. Dotted Decimal

The two formats describe identical information, just written differently. A /24 network and a 255.255.255.0 subnet mask are the same thing, and most networking tools allow administrators to enter either.

Recognizing both formats matters because documentation, configuration screens, and troubleshooting tools use them interchangeably. A device configured with a /24 prefix and one configured with a 255.255.255.0 subnet mask will behave identically on the network.

Subnet Mask Reference Table (Cheat Sheet)

The table below maps common subnet masks to their CIDR notation and the number of usable host addresses each one supports. It's useful as a quick reference when planning or troubleshooting a subnet.

To use the table, start with the number of devices the subnet needs to support, then find the smallest subnet that comfortably covers that count with room for growth. A subnet that needs to support around 40 networked devices, for example, would need at least a /26 subnet to have enough usable addresses.

How to Find Your Subnet Mask

Your current subnet mask is available directly in your device's network settings or through a command-line tool, and checking it takes only a few seconds. The exact steps vary slightly by operating system, but the information is always in the same general place.

On Windows, macOS, and Linux

On Windows, open Command Prompt and run ipconfig. The output lists the subnet mask alongside the IPv4 address for each configured network adapter.

On macOS, run ifconfig in Terminal. On Linux, run ip addr (recommended on most modern distributions) or ifconfig if it's installed. Depending on the operating system and command used, the subnet mask may be displayed in CIDR notation instead of dotted-decimal format.

Most operating systems also show this information through their graphical network settings, typically under the details or properties view for the active connection. For quick checks, though, the command-line tools are usually faster.

How to Calculate a Subnet Mask

Choose a subnet mask based on how many subnets your network needs and how many host devices each one has to support.

IT teams typically weigh three factors: the number of devices that need addresses today, expected growth over time, and how the network needs to be segmented, whether by department, location, or traffic type. The mask you choose has to leave enough host bits to cover current devices and reasonable growth, without being so large that address space goes to waste.

Consider a business deploying a new office with three departments, each needing its own subnet for up to 50 devices. A /26 mask provides 62 usable host addresses per subnet, comfortably covering each department with room to add devices later. Once that sizing decision is made, the specific mask can be calculated manually or verified with a calculator tool.

Manual Calculation Basics

To calculate a mask manually, find the smallest power of two where the usable host count meets or exceeds the number of required hosts.

Usable hosts formula: 2^h − 2 ≥ required hosts (where h is the number of host bits)

For example, if a subnet needs to support 50 devices, 2^6 equals 64 total addresses. Subtracting 2 for the network and broadcast addresses leaves 62 usable host addresses, which meets the requirement. That means 6 host bits are needed, leaving 26 bits for the network portion of the 32-bit IPv4 address. In CIDR notation, that's a /26 network, which corresponds to the subnet mask 255.255.255.192.

Using Variable Length Subnet Masks (VLSM)

When different parts of a network need different numbers of addresses, variable length subnet masking (VLSM) lets IT teams assign a different-sized subnet mask to each one. For example, a department with 50 devices might use a /26 subnet, while a smaller team with 14 devices could use a /28. This uses the available address space more efficiently than assigning every subnet the same mask. When planning with VLSM, calculate the largest subnet first, followed by progressively smaller ones, to avoid overlapping address ranges.

Using a Subnet Mask Calculator

A subnet mask calculator saves time by automating this math, which helps when working through multiple subnets, planning a VLSM deployment, or double-checking a manual calculation before deploying it. Many calculators need just two inputs: the network address and either the required number of hosts or the desired number of subnets.

The calculator then returns the subnet mask, CIDR notation, usable host range, and broadcast address. This is especially helpful for larger deployments with several differently sized subnets, where manual calculation for each one becomes time-consuming and more error-prone.

Why Subnetting Matters for Business Networks

Subnetting does more than organize IP addresses on paper. Dividing a large network into smaller, purpose-built segments contains traffic, limits the reach of a compromised device, reduces broadcast domain size, and makes ongoing network management more straightforward.

In practice, business networks use subnetting to separate employee devices, guest Wi-Fi, VoIP phones, security cameras, point-of-sale systems, and servers into distinct segments.

When this separation spans multiple locations, each site should use unique, non-overlapping subnet ranges. Otherwise, duplicate ranges can create routing conflicts, particularly over site-to-site VPN connections. If subnets already overlap, IT teams will typically need to readdress one of them and update the related DHCP, routing, firewall, and VPN configurations.

Subnetting works alongside VLANs and Layer 3 routing to accomplish this. VLANs group traffic logically at the switch level, while subnets define the addressing for each group. Layer 3 routing then moves traffic between them according to the network's access rules.

Segmentation and Security

Assigning each traffic type its own subnet and VLAN creates separate network segments. This makes it easier to limit what a compromised or unauthorized device can reach through routing and security policies. Guest Wi-Fi traffic on its own subnet, for example, can be isolated from the subnet handling point-of-sale transactions or internal file servers. That way, a security issue on one segment doesn't automatically expose the others.

This approach also supports more granular access control, since firewall and access control list (ACL) rules can apply at the subnet or VLAN boundary rather than to individual devices. Setting this up typically starts with configuring VLANs on an Omada network. For environments with a mix of managed and personal devices, Omada SDN's approach to BYOD security extends the same segmentation model to personally owned devices.

Performance and Scalability

Smaller subnets mean smaller broadcast domains, reducing the broadcast traffic every device on a segment has to process. In a flat, unsegmented network, broadcast traffic from hundreds of devices competes for the same bandwidth. Splitting that population into subnets keeps each segment's broadcast traffic proportional to its own device count.

Layer 3 switching handles routing between these subnets at the network's core, moving traffic between segments without a separate router for every hop. Not every switch handles this the same way. Choosing between Layer 3 and Layer 2+ Omada switches depends on whether routing needs to happen at the switch itself or can be handled elsewhere in the network.

As a network grows across more subnets, sites, or device types, routing capacity and uplink bandwidth become more important. Omada managed switches — including Layer 3-capable models — and multi-gig switching options help meet those growing networking demands.

Planning Your Network Segmentation Strategy

A subnet mask splits an IP address into a network portion and a host portion, and that split is what makes subnetting possible. It shapes how devices communicate, how traffic moves, and how efficiently a network uses its available addresses. Getting that structure right from the start can make a network easier to scale, manage, and troubleshoot as its needs grow.

Subnetting becomes especially valuable once a network needs to separate traffic types or scale across more devices and locations. Omada managed switches and gateways support subnetting and VLAN assignment, with Layer 3-capable switch models and gateways handling inter-subnet routing. This gives IT teams the tools to design segmented networks without piecing together separate systems.

If you're planning a segmented network, explore the Omada managed switch lineup to find the right hardware, or follow this guide to configuring VLANs on an Omada network to put subnetting into action.

Frequently Asked Questions

What is a subnet mask in simple terms?

A subnet mask is a number that tells a device which part of its IP address identifies the network it belongs to and which part identifies the device itself. It works alongside an IP address to determine whether traffic should stay on the local network or be routed elsewhere.

What is the most common subnet mask?

255.255.255.0, also written as /24, is the most common subnet mask for small business and office networks. It supports up to 254 usable host addresses, which fits typical department or single-office deployments.

Is 255.255.255.0 the same as /24?

Yes. 255.255.255.0 and /24 both describe a subnet mask with 24 network bits and 8 host bits. They're two different formats for writing the same information, and most networking tools accept either one.

How do I find my subnet mask?

On Windows, run ipconfig in Command Prompt. On macOS, run ifconfig in Terminal. On Linux, run ip addr, which is recommended on most modern distributions, or ifconfig if it's still installed. All of these show the subnet mask alongside the device's IP address for its active network connection.

What happens if the subnet mask is set incorrectly?

An incorrect subnet mask can cause a device to misidentify which addresses are on its local network, leading to failed connections, unreachable devices, or incorrectly routed traffic. Devices may appear to be on the same network when they aren't, or be unable to reach devices that are actually local.

What is the difference between a subnet and a subnet mask?

A subnet is a segmented portion of a network with its own defined address range. A subnet mask is the number that defines the boundary between the network and host portions of an IP address. The subnet mask defines the subnet's address range and allows devices to determine which IP addresses belong to it.