CCNA online course

Subnet Masks Explained: Network and Host Portions of an IPv4 Address

Learn how IPv4 subnet masks separate network and host bits, use CIDR prefix lengths, and calculate a network address with binary AND.

A subnet mask tells IPv4 devices which bits of an address identify the network and which bits identify a host on that network. This distinction lets a host or router decide whether a destination is local or must be reached through a router.

An IPv4 address by itself is incomplete for subnet identification. The address must be interpreted together with a subnet mask or a CIDR prefix length, such as 255.255.255.0 or /24.

What Is an IPv4 Subnet Mask?

An IPv4 address is a 32-bit logical address written as four decimal octets. A subnet mask is another 32-bit value used with that address. The mask marks the network portion with binary 1 bits and the host portion with binary 0 bits.

The network portion is the prefix shared by every address in the same subnet. The host portion contains the remaining bits used to distinguish individual interfaces within that subnet.

When a host wants to send traffic, it compares its own network portion with the destination's network portion. If the portions match, the destination is considered local and the host can deliver the frame directly on the local network. If they do not match, the host sends the traffic to a configured default gateway. A router then forwards the packet toward the remote network.

IPv4 Address and Mask Structure

IPv4 addresses and subnet masks each contain 32 bits. For readability, the 32 bits are divided into four 8-bit sections called octets. Each octet is normally displayed as a decimal number from 0 through 255, with periods separating the octets.

This format is called dotted-decimal notation. For example:

IPv4 address:  10.0.0.1
Subnet mask:   255.0.0.0

The same values can be written in binary:

IPv4 address:  00001010.00000000.00000000.00000001
Subnet mask:   11111111.00000000.00000000.00000000

In a conventional IPv4 subnet mask, the binary 1 bits must be contiguous from the left. They identify the network bits. The remaining binary 0 bits must follow the ones and identify the host bits.

For example, 255.255.255.0 is valid because its binary form is:

11111111.11111111.11111111.00000000

A pattern with a zero followed later by a one is not a valid conventional subnet mask. For example, a binary pattern such as 11111111.00001111.00000000.00000000 is noncontiguous and cannot be used as an ordinary IPv4 subnet mask.

CIDR Prefix Length Notation

CIDR means Classless Inter-Domain Routing. CIDR is the modern prefix-based approach to IPv4 addressing. A CIDR prefix length is written after an address with a slash. The number after the slash is the number of consecutive one bits in the mask.

For example, /8 means that the first 8 bits are network bits and the remaining 24 bits are host bits:

/8 = 11111111.00000000.00000000.00000000
   = 255.0.0.0

The prefix length works independently of legacy Class A, Class B, and Class C defaults. Modern networks can use many different prefix lengths, including /20, /27, and /30, according to their design requirements.

Calculating a Network Address with Binary AND

A network address is the address produced when all host bits are set to zero. To calculate it, perform a bitwise AND between every bit in the IPv4 address and the corresponding bit in the subnet mask.

Binary AND follows these rules:

Only a pair containing two ones produces a one. Therefore, the mask preserves address bits where the mask contains ones and forces the host bits to zero where the mask contains zeros.

Worked example: 10.0.0.1/8

Calculate the network address for 10.0.0.1 with the mask 255.0.0.0, also written as 10.0.0.1/8.

First, write the address and mask in binary:

Now apply AND to each corresponding bit:

IP address:  00001010.00000000.00000000.00000001
Subnet mask: 11111111.00000000.00000000.00000000
             ----------------------------------- AND
Network:     00001010.00000000.00000000.00000000

Converting the result back to dotted decimal gives 10.0.0.0.

The first octet is preserved because the mask contains eight leading ones. The remaining three octets are host bits because the mask contains zeros there. Those host bits are cleared in the network address.

Network Range and Address Roles

For the subnet 10.0.0.0/8, there are 8 network bits and 24 host bits. The complete address range is:

10.0.0.0 through 10.255.255.255

The address roles in this traditional IPv4 subnet are:

• Network address: 10.0.0.0. All host bits are zero, so this address identifies the subnet itself.
• Example host address: 10.0.0.1. This is inside the subnet and can ordinarily be assigned to an interface.
• Directed broadcast address: 10.255.255.255. All host bits are one, so traffic sent to this address is directed to all hosts on the subnet, subject to device and network policy.
• Traditional usable host range: 10.0.0.1 through 10.255.255.254.

The full subnet range is not the same as the assignable host range. In an ordinary IPv4 subnet, the all-zero host value is reserved for the network address and the all-one host value is reserved for the broadcast address.

Classful Defaults Versus Modern Subnetting

Historically, IPv4 used a classful model. Class A networks had a default mask of 255.0.0.0, or /8. Class B and Class C addresses had different default masks. This model is useful as legacy and exam context, but it is not how modern networks must assign prefixes.

Modern networks use CIDR and often VLSM, or Variable Length Subnet Masking. The configured prefix determines subnet membership. The first octet does not determine the complete subnet by itself.

For example, these are different networks even though they use addresses from the same broad 10.x.x.x address space:

• 10.0.0.0/8 includes addresses from 10.0.0.0 through 10.255.255.255.
• 10.0.0.0/24 includes only addresses from 10.0.0.0 through 10.0.0.255.

The address 10.1.2.3 is not automatically in the same subnet as 10.1.2.4 unless their configured prefixes make their network portions match.

10.0.0.0/8 is also a private IPv4 block intended for private networks. That does not require every network using a 10.x.x.x address to use /8. Administrators can divide the private block into longer prefixes such as /16, /24, or smaller subnets.

Subnetting: Creating Smaller Networks

Subnetting is the process of creating smaller networks by increasing the network prefix length. It does this by borrowing bits from the original host portion and assigning them to the network portion.

Suppose a network starts as 10.0.0.0/8. Its first 8 bits are network bits and its remaining 24 bits are host bits. If the prefix is extended to /16, the first 16 bits become network bits and only 16 bits remain for hosts in each subnet.

Increasing the prefix creates a trade-off:

• More network bits allow more separate subnets.
• Fewer host bits provide fewer addresses per subnet.

For example, dividing a broad address block into /24 networks creates many smaller networks, each with 8 host bits. In an ordinary subnet, that provides 254 traditional usable host addresses per /24, while the network and broadcast addresses retain their special roles.

Subnetting is used to separate departments, locations, VLANs, server groups, point-to-point links, and security zones. The next step is learning how to calculate the number of subnets, the number of host addresses, each network address, each broadcast address, and each valid host range.

Common Subnet-Mask Mistakes

Assuming every 10.x.x.x address is in one network

The 10.0.0.0/8 private block is broad, but it can be divided into many smaller prefixes. Compare the configured prefix before deciding whether two addresses are local to one another.

Treating the mask as a second IP address

A subnet mask uses the same 32-bit format as an IPv4 address, but it has a different purpose. It is a bit pattern that classifies corresponding address bits as network or host bits.

Using a noncontiguous mask

Conventional IPv4 subnet masks must contain leading ones followed only by zeros. A zero followed later by a one is an invalid mask shape.

Assigning network or broadcast addresses to normal hosts

For ordinary IPv4 subnets, do not assign the all-host-bits-zero network address or the all-host-bits-one broadcast address to a normal host interface. Check for special prefix rules when working with /31 or /32.

Confusing the full range with usable hosts

Always identify the network address, broadcast address, full range, and usable host range separately. For 10.0.0.0/8, the full range is 10.0.0.0–10.255.255.255, while the traditional usable range is 10.0.0.1–10.255.255.254.

Subnet Mask Checklist

1. Write the IPv4 address and its prefix length or dotted-decimal mask.
2. Count the network bits from the prefix length.
3. Identify the remaining host bits.
4. Convert the address and mask to binary when necessary.
5. Perform bitwise AND to calculate the network address.
6. Set all host bits to one to identify the traditional broadcast address.
7. Distinguish the full range from the traditional usable host range.
8. Use the configured prefix, not the first octet alone, to determine subnet membership.

For related fundamentals, review the computer network explanation and the distinction between unicast, multicast, and broadcast addresses. Subnet masks are also essential when understanding routing protocols such as OSPF.