What is a subnet mask?

What the mask actually does

An IPv4 address is 32 bits. On its own it does not say where the network ends and the host begins. The subnet mask supplies that boundary. Every bit set to 1 in the mask marks a network bit; every 0 marks a host bit. Line the mask up against the address and you can read off the network.

Because the 1 bits are always contiguous and on the left, a mask can be summarised by a single number: how many 1s it has. That count is the prefix length. So 255.255.255.0 is the same as /24, and 255.255.255.192 is /26.

Reading a mask octet by octet

Each octet of a mask is one of a fixed set of values: 0, 128, 192, 224, 240, 248, 252, 254, or 255. Those are the only bytes you can build from a run of leading 1s. If you see any other value, such as 255.255.255.100, it is not a valid contiguous mask.

255 means all eight bits are network bits. 0 means all eight are host bits. Values in between split an octet: 192 (11000000) uses the top two bits for the network and leaves the rest for hosts. The subnet mask calculator on this site converts any prefix to its mask and back.

Every valid subnet mask, and only those

There are exactly 33 valid IPv4 subnet masks, one per prefix length from /0 to /32. That is not a convention, it follows from the definition: the mask is a run of 1 bits followed by a run of 0 bits, so the only freedom is where the run ends. Anything else is not a mask.

This is the whole set. Anything not in this table is invalid, however plausible it looks.

Usable hosts is total addresses minus two, except a /31 (two, under RFC 3021) and a /32 (one). Those two rows are where most calculators go wrong.

Why 255.255.255.100 is not a valid subnet mask

This is the single most common mask question, and the answer is a bit-level one. Write 100 in binary and you get 01100100. Line that up as the fourth octet of a mask and the bits read 0, 1, 1, 0, 0, 1, 0, 0: the run of 1s is not at the front, and it is interrupted twice.

A mask has to be contiguous because of what it is used for. The router takes the address, applies the mask with a bitwise AND, and the result is the network address. That only produces a sensible, comparable network number if the 1 bits form one unbroken run from the left. A gapped mask would scatter the network identity across non-adjacent bits, and longest-prefix-match routing, which compares how many leading bits agree, would have nothing to compare.

If a device or a form accepted 255.255.255.100, what you almost certainly wanted was one of its neighbours. 255.255.255.128 is a /25 with 126 hosts, 255.255.255.192 is a /26 with 62 hosts. The calculator on this site rejects the invalid value and names the nearest valid mask rather than silently rounding.

Any octet of a valid mask is one of these nine values. 100, 127, 200 and everything else are impossible, because they are not a run of leading 1s.

How to find your subnet mask

On Windows, run ipconfig and read the Subnet Mask line. On macOS or Linux, run ifconfig or ip addr; the mask appears as a prefix like /24 or as a dotted value. Your router's admin page also shows the LAN subnet mask, usually 255.255.255.0 for a home network.

Whatever form you find it in, you can paste it into the calculator to convert between the dotted mask and the prefix, and to see the host count it allows.

Sources

Everything technical on this page is checkable against the documents below. Where a document and common practice disagree, the guide says so rather than picking one quietly.

• RFC 950: Internet Standard Subnetting Procedure, section 2.1 on the mask
• RFC 1878: Variable Length Subnet Table for IPv4, the canonical mask table
• RFC 4632: Classless Inter-domain Routing (CIDR)

Spotted something wrong? Tell us and it gets corrected. How the data is maintained is described on the about page.