IPAM glossary

What is a subnet mask?

A subnet mask is an addressing value that tells a device which bits of an IPv4 address identify the network and which bits identify the host. It is a 32-bit number whose leading one bits mark the network prefix, and devices use it to decide whether a destination is local or must be routed.

Let’s simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A subnet mask is a 32-bit value that separates network bits from host bits in an IPv4 address, enabling devices to determine whether traffic should be delivered locally or routed remotely. Subnet masks are configured on nearly all IPv4 interfaces via DHCP or static configuration and are essential for correct network operation, as misconfigurations cause routing failures, security policy violations, and hard-to-trace connectivity issues. Proper subnet mask management through IPAM systems helps organizations avoid overlapping subnets, plan capacity, and maintain consistent security boundaries across networks.

  • Devices perform a bitwise AND operation between an IPv4 address and its subnet mask to calculate the network address, then compare this result with the destination network address to decide between local delivery and gateway routing.
  • Incorrect subnet masks create distinct failure modes: masks that are too long cause hosts to treat local peers as remote, masks that are too short cause hosts to treat remote addresses as local, and mismatched masks across links produce one-way traffic and routing adjacency failures.
  • Subnet mask notation can be expressed in dotted decimal format (for example 255.255.255.0) or CIDR prefix notation (for example /24), with both methods representing the same network boundary.

Subnet mask at a glance

AttributeValue
Full nameSubnet mask
CategoryAddressing method
Defined inRFC 950 (Internet standard subnetting procedure) and RFC 4632 (classless inter-domain routing)
OSI layerLayer 3 (network layer)
Primary useSeparating the network portion of an IPv4 address from the host portion
Related termsSubnet, CIDR, IP address, Default gateway, IPAM, DHCP

How subnet mask works

A subnet mask works by a bitwise comparison. Each bit set to 1 in the mask marks a bit of the address as part of the network prefix, and each bit set to 0 marks a host bit.

  1. Read the address and mask: A device holds its own IPv4 address and subnet mask, for example 192.168.10.25 with 255.255.255.0. The mask in binary is 24 one bits followed by 8 zero bits.
  2. Calculate the network address: The device applies a bitwise AND between the address and the mask. For the example, the result is 192.168.10.0, which identifies the subnet.
  3. Apply the mask to the destination: The device performs the same AND on the destination address and compares the result with its own network address.
  4. Choose local delivery or routing: If the network addresses match, the destination is on the same subnet and the device delivers the traffic directly. If they differ, the device sends the traffic to its default gateway.

The same mask can be written in CIDR prefix notation, where 255.255.255.0 becomes /24. The number of host bits determines how many addresses a subnet holds, and in IPv4 the first address (network) and last address (broadcast) are normally not assigned to hosts. IPv6 uses a prefix length instead of a dotted mask.

Why subnet mask matters in enterprise networks

Every IPv4 interface needs a correct subnet mask, so the value is set on a very large number of devices, often through DHCP or static configuration. Early IPv4 subnetting was standardized in RFC 950, and classless addressing with variable-length prefixes was later described in RFC 4632. Variable-length masks let teams size subnets to actual demand instead of fixed class boundaries, which conserves addresses.

A wrong mask causes problems that are hard to trace. If a host mask is too long, the host treats some local peers as remote and sends their traffic to the gateway, which may fail or add latency. If the mask is too short, the host assumes remote addresses are local, tries to reach them directly, and gets no response. Overlapping subnets across sites cause ambiguous routing and block connectivity between networks.

Subnet masks also shape security and operations. Subnet boundaries are the units that firewalls, access control lists and segmentation policies commonly use, so inconsistent masks can leave systems in the wrong zone. Recording each subnet and its mask in an IP address management system helps teams find overlaps and plan capacity before addresses run out.

Subnet mask vs CIDR

A subnet mask is a 32-bit value applied to an address to separate network bits from host bits, while CIDR is the classless addressing scheme that expresses the same boundary as a prefix length such as /24. What is CIDR?

AttributeSubnet maskCIDR
What it isA 32-bit value applied to an IPv4 addressAn addressing and aggregation scheme using variable-length prefixes
NotationDotted decimal, such as 255.255.255.0Prefix length, such as /24
Primary useHost and router configuration to decide local versus remote deliveryAllocation and route aggregation without class boundaries
Address familyIPv4 onlyNotation also used for IPv6 prefixes

Common subnet mask issues

A host with a mask longer than its neighbors treats some local peers as remote and sends their traffic to the default gateway. Symptoms include intermittent reachability, where only some hosts on the same VLAN respond.

A host with a mask shorter than the real subnet believes distant addresses are on-link and sends ARP requests instead of using the gateway. Those destinations time out, and the problem often appears for only one address range.

Two routers or hosts on the same link configured with different masks disagree on the subnet boundary. This can cause one-way traffic and routing adjacency failures that look like a cabling or firewall fault.

A DHCP scope that hands out the wrong subnet mask spreads the error to every client that leases from it. Fixing the scope does not correct existing leases until they renew.

Typing a value with non-contiguous one bits, such as 255.0.255.0, is rejected by many systems or gives unpredictable results on others. Valid masks are a run of ones followed by zeros.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

Subnet mask FAQ

Related terms

Article

CIDR (Classless Inter-Domain Routing)

A method for allocating IP addresses and IP routing introduced by the ITEF 1993 to replace classful networks.

Learn more
Article

IPv4 (Internet Protocol version 4)

The fourth version of Internet Protocol that uses 32-bit addresses to route most of today’s internet traffic; the global supply of IPv4 addresses is exhausted. Learn More

Learn more
Article

Classful networks

A previous network addressing architecture that divided the IP address space for IPv4 into five address classes based on the leading four address bits.

Learn more
Article

RFC 1918 networks

Ranges of IP addresses set aside for private use on TCP/IP networks.

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

The standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

Internet Protocol Address (IP Address)

A numerical label assigned to each device connected to a network that uses IP for communication.

Learn more
Article

IPAM (IP address management)

A method for planning, tracking, and managing IP address space on a network.

Learn more
Article

Static IP address

An IP address that doesn’t change and was manually configured for a device, versus one that was assigned by a DHCP server.

Learn more
Browse the full glossary