Understanding how subnet masks work at the bit level, from /24 to /32
I've been configuring networks for over a decade, and if I had to explain subnet masks in one sentence, it would be this: a subnet mask is a 32-bit binary divider that tells your device which part of an IP address belongs to the network and which part belongs to the host. In decimal, a subnet mask looks like 255.255.255.0. But in binary — where it actually does its work — it looks like 11111111.11111111.11111111.00000000. Every bit set to 1 means "this bit in the IP address identifies the network." Every bit set to 0 means "this bit identifies a specific device on that network."
One thing I've noticed with many of my junior colleagues is that they treat subnet masks as magic numbers they have to type into a config panel. Once I showed them the binary form, everything clicked. The mask is just a binary fence — a contiguous block of ones followed by contiguous zeros. That is all it has ever been.
In my years of networking, I have probably used these three masks for 95% of all configurations I have ever set up. Here they are in both decimal and binary:
11111111.00000000.00000000.00000000 — The first 8 bits are the network. Used by Class A networks. A single /8 network can hold 16,777,214 hosts. Large ISPs and massive enterprises use these.11111111.11111111.00000000.00000000 — The first 16 bits are the network. Class B size. 65,534 usable hosts. Common in medium to large organizations.11111111.11111111.11111111.00000000 — The first 24 bits are the network. The most common mask you will encounter in home and small office networks. 254 usable hosts.I always tell people to memorize the binary pattern first, then derive the decimal from it. If you know that /24 means 24 consecutive ones, you can write the binary mask without thinking, and then convert each octet to decimal using the place values 128, 64, 32, 16, 8, 4, 2, 1.
When your computer needs to determine whether a destination IP is on the same local network or somewhere out on the internet, it performs a bitwise AND between its own IP address and its subnet mask. Let me show you with a concrete example I use in all my training sessions:
IP: 192.168.1.100 = 11000000.10101000.00000001.01100100
Mask: 255.255.255.0 = 11111111.11111111.11111111.00000000
AND result (network address): 11000000.10101000.00000001.00000000 = 192.168.1.0
In a bitwise AND, the result is 1 only if both bits are 1. Since the mask has 24 ones followed by 8 zeros, the first 24 bits of the IP pass through unchanged while the last 8 bits are forced to 0. That is how the computer knows "I am on the 192.168.1.0/24 network." I have used this exact logic to debug routing tables more times than I can count.
CIDR (Classless Inter-Domain Routing) notation — the /24 you see everywhere — is just a shorthand for "how many consecutive 1 bits are in the subnet mask." This is one of my favorite things to teach because it makes the whole system feel elegant. A /24 mask has 24 leading ones. A /16 has 16. A /32 has 32 — which means the entire address is the network, leaving zero bits for hosts. A /32 is used for a single device (like a loopback interface). Here is a quick reference table of common CIDR values and their binary masks:
11111111.11111111.11111111.11111111 (255.255.255.255) — Single host11111111.11111111.11111111.11111100 (255.255.255.252) — 2 usable hosts, used for point-to-point links11111111.11111111.11111111.11111000 (255.255.255.248) — 6 usable hosts11111111.11111111.11111111.11110000 (255.255.255.240) — 14 usable hosts11111111.11111111.11111111.11100000 (255.255.255.224) — 30 usable hosts11111111.11111111.11111111.11000000 (255.255.255.192) — 62 usable hosts11111111.11111111.11111111.10000000 (255.255.255.128) — 126 usable hosts11111111.11111111.11111111.00000000 (255.255.255.0) — 254 usable hostsI have this table memorized from years of subnet planning. The trick is to count the zeros in the last octet: 2number_of_zeros minus 2 gives you the usable host count.
In binary, the boundary between network bits and host bits is always at the point where the mask switches from 1 to 0. For a /24 mask, the boundary is between the 24th and 25th bit. Everything to the left belongs to the network identifier; everything to the right belongs to the host. This boundary is critical for understanding subnets, VLANs, and routing.
One scenario I encounter frequently is when someone asks, "Can 192.168.1.5 talk to 192.168.2.10 without a router?" The answer depends entirely on the subnet mask. If both use /24, they are on different networks (192.168.1.0 vs 192.168.2.0) and need a router. But if they use /16, both are in the same network (192.168.0.0) and can communicate directly. The mask determines everything.
Subnetting is the process of borrowing host bits to create additional network bits. When you borrow one bit from the host portion, you split the network in half. In binary, this means the subnet mask gets one more leading 1. For example, if you take a /24 network and extend it to /25, you create two subnets: 192.168.1.0/25 (hosts 1-126) and 192.168.1.128/25 (hosts 129-254). In binary, the 25th bit — the one you borrowed — determines which subnet a host belongs to. If the 25th bit is 0, it is on the first subnet. If it is 1, it is on the second.
I've planned subnets for office buildings with hundreds of employees, and I always start by writing out the binary to visualize where the bit boundaries fall. It is far more reliable than using online calculators when you are dealing with non-standard subnet sizes.
Pro Tip: Subnet masks are always a contiguous block of 1s followed by contiguous 0s. There is never a pattern like 11110011 or 10101010 in a valid mask. If you see a non-contiguous mask like 255.255.0.255, it is almost certainly a typo — and many networking stacks will reject it outright.
A wildcard mask (used in ACLs and OSPF) is simply the bitwise inverse of a subnet mask. Where the subnet mask has 1, the wildcard has 0, and vice versa. For a /24 subnet mask 11111111.11111111.11111111.00000000, the wildcard mask is 00000000.00000000.00000000.11111111, which is 0.0.0.255 in decimal. I've seen many network engineers get tripped up by this, but if you think in binary it is trivial — just flip every bit.
Open the Binary Code Decoder in a new tab and enter some binary patterns to see the results instantly. All conversions happen in your browser — no data is sent to any server.