VMware ESXi and vSphere Cluster Management

Subnet Masks Explained: Network and Host Portions of an IPv4 Address

Learn how IPv4 subnet masks separate network and host bits, how binary AND produces a network address, and how 10.0.0.1/8 maps to its address range.

What Is a Subnet Mask?

A subnet mask is a 32-bit IPv4 value used alongside an IPv4 address. It separates the address into two logical sections: the network portion and the host portion.

The network portion identifies which network an address belongs to. The host portion identifies a particular position or device within that network. Devices use this separation to decide whether a destination is on the local network or whether traffic should be sent to a router.

The mask is not a second address for a device. Instead, it tells the device how to interpret the bits in the IP address.

IPv4 Addresses, Masks, Bits, and Octets

An IPv4 address contains 32 bits. It is commonly written in dotted-decimal notation as four decimal values separated by periods, such as 10.0.0.1.

Each group is an octet, which is eight bits. Four octets multiplied by eight bits gives 32 bits:

IPv4 address:  10       . 0        . 0        . 1
Octets:        8 bits   . 8 bits   . 8 bits   . 8 bits
Total:         32 bits

Traditional IPv4 subnet masks also contain 32 bits and use the same four-octet format. For example, 255.0.0.0 is a subnet mask written in decimal. Address calculations are performed at the bit level, so converting the decimal octets to binary makes the network boundary visible.

How Mask Bits Identify Network and Host Portions

Each bit in a subnet mask corresponds to the bit in the same position in the IPv4 address:

A valid conventional IPv4 subnet mask has contiguous leading 1 bits followed by contiguous 0 bits. The 1s cannot stop and then appear again later. For example, this is valid:

11111111.00000000.00000000.00000000

A pattern such as 11111111.00001111.00000000.00000000 is not a valid conventional subnet mask because 1 bits appear after 0 bits.

Classful Default Masks and CIDR Prefix Lengths

The historical default mask for a Class A IPv4 network is 255.0.0.0. In binary, it is:

255.0.0.0 = 11111111.00000000.00000000.00000000

This mask contains 8 network bits and 24 host bits. The number of leading 1 bits is represented in modern notation as a CIDR prefix length. Therefore:

255.0.0.0 = /8

Classful defaults are useful foundational terminology, but modern networks commonly use explicit prefix lengths and CIDR (Classless Inter-Domain Routing). A prefix such as /8 directly states that the first 8 bits are the network portion, regardless of older address classes.

Bitwise AND: Finding the Network Address

A network address is found by applying a bitwise AND operation between an IP address and its subnet mask. Bitwise AND compares corresponding bits. The result is 1 only when both input bits are 1:

In short, a mask bit of 1 preserves the corresponding IP bit, while a mask bit of 0 changes the result to 0. The operation is performed across all 32 bits, aligning each IP octet with the mask octet in the same position.

Worked Example: Calculate the Network Address of 10.0.0.1/8

Use this IP address and mask:

IP address:   10.0.0.1
Subnet mask:  255.0.0.0
Prefix:       /8

Convert both values to binary. Each octet is shown as exactly eight bits:

IP address:   00001010.00000000.00000000.00000001
Subnet mask:  11111111.00000000.00000000.00000000

Now apply AND to corresponding bits in each octet:

The first octet is unchanged because every mask bit in that octet is 1. The remaining three octets become all zeroes because their mask bits are 0:

00001010 AND 11111111 = 00001010
00000000 AND 00000000 = 00000000
00000000 AND 00000000 = 00000000
00000001 AND 00000000 = 00000000

Network address: 10.0.0.0

For this /8 mask, the first octet is the network portion, and the remaining three octets contain the 24 host bits.

Address Range for the 10.0.0.0/8 Network

All addresses with the same first 8 network bits belong to the same 10.0.0.0/8 network. The complete address span is:

10.0.0.0 through 10.255.255.255

The network address, 10.0.0.0, is one specific address produced by the AND calculation. The network span, 10.0.0.0 through 10.255.255.255, describes all addresses whose network bits match the /8 network. Do not confuse the single network address with the entire range implied by the mask.

Common Subnet Mask Mistakes

Assuming the Entire IP Address Is the Network Identifier

An IPv4 address contains both network and host information. The mask defines where the boundary lies. The same address bits can produce a different network address when used with a different valid mask.

Reading 255.0.0.0 as Four Unrelated Decimal Numbers

Convert the mask to binary to see its meaning:

255.0.0.0 = 11111111.00000000.00000000.00000000

This reveals eight leading network bits followed by 24 host bits.

Using a Mask with Separated 1 Bits

Valid conventional subnet masks contain an uninterrupted sequence of leading 1s followed only by 0s. A mask with 1s appearing after 0s does not represent a valid ordinary IPv4 subnet boundary.

How Subnet Masks Lead to Subnetting

Subnetting means creating smaller networks by borrowing bits from the host portion and extending the network portion. For example, a network that starts with 24 host bits can use some of those bits as additional network bits to create multiple smaller networks.

Understanding how mask bits select network and host portions is the prerequisite for creating subnets. Before calculating subnet sizes, usable ranges, or broadcast addresses, first identify the prefix length and the location of the network boundary.

Next, practice reading CIDR prefix lengths and creating smaller networks from a larger address block. You can revisit the core mask concepts in this subnet mask guide while working through prefix-length and subnet-creation exercises.