What Is a Subnet Mask? 255.255.255.0 Meaning Explained

A subnet mask marks which bits of an IP address are the network portion and which bits are the host portion. That is the whole job. The 255.255.255.0 meaning is exactly that: the first three octets identify the network, and the last octet is left for individual hosts on it. Every other detail on this page follows from that one sentence.

The mask does not travel in the packet. It lives on your device, next to the IP address, and it answers one question every time you send traffic: is this destination on my network, or does it go to the gateway? Most explanations skip that part. It is the part that matters.

What does 255.255.255.0 mean?

It means twenty-four network bits and eight host bits. Write it in binary and the structure is obvious:

255.255.255.0 = 11111111.11111111.11111111.00000000

Twenty-four 1s, then eight 0s. The 1s cover the network portion. The 0s cover the host portion. Because there are twenty-four leading 1s, this mask is written as /24 in what is CIDR notation terms. Same mask, shorter spelling.

So if your address is 192.168.1.47 with a mask of 255.255.255.0, then 192.168.1 is the network and .47 is you. Your neighbour at 192.168.1.99 is on the same network. A host at 192.168.2.10 is not, because the third octet is covered by a 1 bit and it differs.

Why are subnet masks made of 255s?

Because an octet of all 1s equals 255. That is the entire reason. An octet is eight bits, and 11111111 in binary is 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1, which is 255. It is the largest value eight bits can hold.

A mask octet that is fully inside the network portion is all 1s, so it shows up as 255. A mask octet fully inside the host portion is all 0s, so it shows up as 0. The interesting octets are the ones where the boundary falls in the middle, and those produce the "in between" numbers people find strange, like 192 or 248.

Which subnet mask values are actually valid?

Only nine numbers can legally appear in a mask octet:

• 0 (00000000)
• 128 (10000000)
• 192 (11000000)
• 224 (11100000)
• 240 (11110000)
• 248 (11111000)
• 252 (11111100)
• 254 (11111110)
• 255 (11111111)

Anything else is not a valid mask octet. The rule behind the list is simple: the 1s in a subnet mask are always contiguous from the left. You add 1s from the high bit down, never skipping. So 11110000 (240) is fine and 11101000 is not, which is why 232 never appears in a real mask.

This is a genuinely useful thing to memorise. If someone hands you a config with 255.255.255.100 in it, you do not need to think. 100 is not on the list, so it is a typo. Same for 255.255.255.256 or 255.0.255.0. Learning nine numbers catches a surprising share of bad configs before they ever reach a device.

What is the subnet mask actually for?

Here is the centrepiece, and it is the thing most articles never say plainly. Your device uses the mask to make a routing decision on every outbound packet.

The process is a bitwise AND, done twice:

• The device ANDs its own IP with the mask.
• The device ANDs the destination IP with the same mask.
• If the two results match, the destination is on the same local network, and the packet is sent directly.
• If they do not match, the packet is handed to the default gateway.

That is it. That is the actual job of a subnet mask. It is not decoration in the network settings dialog. It is the test that decides "local delivery" versus "send it to the router and let the router figure it out."

Work an example. You are 192.168.1.47 with mask 255.255.255.0. You want to reach 192.168.1.99. AND your address with the mask and you get 192.168.1.0. AND the destination with the mask and you get 192.168.1.0. Match. Send it directly, no router involved. Now try 8.8.8.8. AND it with the mask and you get 8.8.8.0, which does not match 192.168.1.0. Off to the gateway it goes.

Notice how the AND works mechanically. A 1 in the mask preserves the bit underneath it. A 0 in the mask zeroes the bit underneath it. So the mask literally strips away the host portion and leaves the network address behind, on both addresses, and then compares them. Same mask, both sides, one comparison. That is why an IP Subnet Calculator can tell you the network address instantly: it is just doing the AND for you.

What happens if the subnet mask is wrong?

You get partial, confusing failures rather than a clean outage. That is the signature of a mask problem, and it comes straight from the AND check.

If the mask is too long, hosts that should be local look remote. Say you are 192.168.1.47 and you should be running /24, but someone typed 255.255.255.192, a /26. Now your AND result is 192.168.1.0, and 192.168.1.99 ANDs to 192.168.1.64. No match. Your machine sends traffic for a neighbour on the same switch to the gateway instead. If the router is helpful, it might still work but slowly and oddly. If it is not, the traffic dies. Meanwhile 192.168.1.20 still works fine, because it happens to land in the same wrong block.

If the mask is too short, the opposite happens. Remote hosts look local. Your device tries to deliver directly to something that is not on the wire, ARPs for it, gets nothing, and the connection just hangs. No error, no route, just silence.

Worse, the failure can be one-directional. If your machine has the right mask and the far machine has the wrong one, your packets arrive and the replies get misrouted. Ping fails, but a capture shows the request landing. That asymmetry is the tell. When connectivity is weird for some destinations and fine for others on what looks like the same LAN, check the mask on both ends before you touch anything else.

How do subnet masks map to CIDR and host counts?

The mask, the CIDR prefix, and the number of usable addresses are three views of the same number. Here are the ones you will meet constantly:

• 255.255.255.0 = /24 = 254 usable
• 255.255.255.128 = /25 = 126 usable
• 255.255.255.192 = /26 = 62 usable
• 255.255.255.224 = /27 = 30 usable
• 255.255.255.240 = /28 = 14 usable
• 255.255.255.248 = /29 = 6 usable
• 255.255.255.252 = /30 = 2 usable
• 255.255.0.0 = /16 = 65,534 usable

The formula is usable = 2^(32-prefix) - 2. You subtract two because the all-zeros host address is the network identifier and the all-ones host address is the broadcast. Neither can be assigned to a machine.

Two exceptions. A /31 has 2 usable addresses on point-to-point links, per RFC 3021, because there is no need for a broadcast address when there are exactly two ends. A /32 is a single host, typically a loopback or a specific route. For everything else the minus two holds. If you want the full table without the arithmetic, keep a subnet mask cheat sheet nearby.

What is a wildcard mask?

A wildcard mask is the inverse of a subnet mask, and it shows up in access control lists. Flip every bit: 255.255.255.0 becomes 0.0.0.255. Subtract each octet from 255 and you have it.

The logic is reversed too. In a subnet mask a 1 means "this bit is network." In a wildcard mask a 0 means "this bit must match" and a 1 means "this bit is a don't care." Same boundary, opposite notation. It trips people up mainly because the two masks sit in the same config file and look almost identical at a glance.

Bottom line

A subnet mask marks the network bits with 1s and the host bits with 0s, and the 1s are always contiguous from the left. That contiguity is why only 0, 128, 192, 224, 240, 248, 252, 254 and 255 can appear in an octet, and why an all-ones octet reads as 255. The 255.255.255.0 meaning is a /24: three octets of network, one octet of hosts, 254 usable addresses.

Remember the AND check above everything else. Your device masks its own address, masks the destination, and compares. Match means deliver locally. No match means hand it to the gateway. Get the mask wrong and that single comparison starts lying to you, which is why bad masks produce those maddening half-broken networks. To check your work on any address and prefix, run it through the IP Subnet Calculator.