Subnet mask:
how a /n prefix turns into dotted decimal

What a subnet mask is for

An IPv4 address is a 32-bit number written as four decimal bytes. The subnet mask splits it into two parts: the leading bits that identify the network and the remaining bits that identify a host on that network. A device uses the mask to decide whether a destination is on its own network, in which case it sends directly, or elsewhere, in which case it sends to the gateway.

The mask is written in two ways. Dotted decimal such as 255.255.255.0 is the older form. CIDR notation puts a slash and the number of network bits after the address, so 192.168.1.10/24 carries the same information as the address with mask 255.255.255.0.

Both forms describe a block of ones followed by a block of zeros. A mask like 255.0.255.0 is not valid, because ones must be contiguous from the left.

Private ranges such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are reserved for internal networks, and a home or office usually carves a small /24 out of one of them. Public addresses given by an internet provider come with a mask of their own, often much smaller than /24, so the same arithmetic applies at every scale.

Converting a prefix to a mask, one byte at a time

Write n ones followed by 32 − n zeros, split into four groups of eight bits, and convert each group to decimal. A full byte of eight ones is 255, and a partial byte takes one of a few values.

For a prefix that is not a multiple of eight, such as /26, the last byte holds only two ones, so it is 11000000, which is 192. The mask is 255.255.255.192.

A faster mental shortcut for the interesting byte is to subtract from 256. The mask value of 192 leaves a gap of 64, 224 leaves 32, 240 leaves 16, and 248 leaves 8. That gap is the block size, and it is the number you will keep using when you list subnets or check whether two addresses are neighbours.

Going the other way, from a dotted mask to a prefix, count the one-bits. The mask 255.255.240.0 has 8 + 8 + 4 + 0 = 20 ones, so it is /20. A valid mask can have only one boundary where the ones turn to zeros, which is also how you can spot a typo in a mask someone has typed into a configuration file.

Host counts and the network boundary

Point-to-point links are the exception: a /31 uses both of its two addresses as hosts, and a /32 names a single host. Those are special cases and are not covered by the subtract-two rule.

When you are given a requirement such as "about 500 devices", the reserved-address rule explains why the answer is a /23 rather than a /24. A /24 holds 254 hosts and falls short, whereas a /23 holds 510 and fits with a little room. Reading the table from the bottom upward, each step one bit shorter doubles the usable space, so going from /24 to /23 takes you from 254 to 510 rather than to 508.

The mask also shows how large a broadcast domain can get. Very large subnets are easy to configure but noisy, since every device hears every broadcast, so networks are usually divided into several moderate subnets rather than one enormous block.

Finding the network and broadcast for an address

The network address is the address ANDed with the mask. In decimal, take the byte that contains the boundary, work out the block size, and round the address down to a multiple of it.

The same trick works for any prefix. The block size is always 256 minus the interesting octet of the mask, and the network starts at the largest multiple of the block size that does not exceed your address.

Splitting one block into several subnets

Subnetting borrows bits from the host part and gives them to the network part. Every bit you borrow doubles the number of subnets and halves the size of each.

This also works backwards for summarising. Four contiguous /26 blocks starting at a multiple of 256 combine into a single /24, which keeps routing tables short.

Choosing the prefix for a number of devices

When the requirement is a count of devices, find the smallest power of two that fits the devices plus the two reserved addresses and any growth.

Leave room for infrastructure: gateways, printers, access points and virtual appliances are easy to forget but they all consume addresses.

Mistakes that cause subtle network faults

• Setting the mask on a host to /24 while the router is /26, so the host believes addresses are local when the router does not.
• Assigning the network or broadcast address to a device in an ordinary subnet.
• Choosing a subnet that is too tight, leaving no room for growth, gateways or virtual machines.
• Confusing a wildcard mask, as used in some router access lists, with a subnet mask. They are bit-for-bit inverses.
• Forgetting that cloud providers often reserve several additional addresses in every subnet, so the usable count is smaller than the textbook figure.