Subnet masks, prefix length and wildcard masks

Why a mask is needed

An address alone does not say where the network part ends. Is 192.168.10.77 on network 192.168.10.0, or 192.168.0.0, or 192.168.10.64? The subnet mask answers this. A device uses it to decide whether a destination is on its own network (send directly) or on another network (send to the default gateway, the router).

What a mask looks like

A subnet mask is also 32 bits. It is a run of ones followed by a run of zeros, never mixed. The ones cover the network part and the zeros cover the host part. 255.255.255.0 is 24 ones followed by 8 zeros: 11111111.11111111.11111111.00000000.

Because the ones are always together on the left, you can describe a mask by just counting them. That count is the prefix length, written after a slash: 255.255.255.0 is /24. This short form is called CIDR notation. 192.168.10.77/24 means "address 192.168.10.77 with a 24-bit mask".

The only valid mask octet values

Since the ones must be continuous from the left, a mask octet can only take nine values. Learn this table. It is the same as adding the place values from the left: 128, then 128 + 64 = 192, then 192 + 32 = 224, and so on.

Converting prefix to mask and back

1. /26: 26 = 8 + 8 + 8 + 2. Three full octets of 255, then 2 ones = 192. Mask 255.255.255.192.
2. /20: 20 = 8 + 8 + 4. Two full octets, then 4 ones = 240, then 0. Mask 255.255.240.0.
3. /12: 12 = 8 + 4. One full octet, then 240, then 0, 0. Mask 255.240.0.0.
4. 255.255.248.0 back to a prefix: 8 + 8 + 5 (248 has five ones) + 0 = /21.
5. 255.255.255.252: 8 + 8 + 8 + 6 = /30, the classic mask for a link between two routers.

The AND operation

To find the network, a device does a bitwise AND of the address and the mask. AND compares two bits: the result is 1 only if both bits are 1. So where the mask has ones, the address bit is kept; where the mask has zeros, the bit becomes 0. The host part is wiped out and only the network part is left.

With a /24 mask the same address gives 192.168.10.0. Same address, different mask, different network. That is why the mask matters as much as the address.

Wildcard masks

Cisco ACLs (access control lists) and the OSPF network command use a wildcard mask instead of a subnet mask. A wildcard mask is the inverse: a 0 bit means "this bit must match" and a 1 bit means "ignore this bit". To get the wildcard for a normal subnet, subtract each mask octet from 255.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# exit
R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255
R1(config)# router ospf 1
R1(config-router)# network 10.1.0.0 0.0.255.255 area 0

import ipaddress

net = ipaddress.ip_network("192.168.10.64/27")
print(net.netmask)     # 255.255.255.224
print(net.hostmask)    # 0.0.0.31   (the wildcard mask)
print(net.prefixlen)   # 27

Common mistakes

• Invalid octets: 255.255.255.100 or 255.255.250.0 cannot be masks, because 100 and 250 are not in the table of nine values.
• Non-continuous masks like 255.0.255.0 are not valid subnet masks.
• Counting /24 as 24 hosts. The prefix counts network bits; the host bits are 32 minus the prefix.