a subnet mask

A subnet mask is a simple ruler that tells a host or router where the network part of an IP address ends and the host part begins. Picture a stencil laid over the address: the holes (the ones) show through the network bits, the solid part (the zeros) hides the host bits. It answers one practical question for every machine: which addresses are on my local network, and which need to be sent to a router?

The mask is itself a 32-bit pattern, written in the same dotted-decimal style, where the leading bits are all 1s (marking the network part) and the rest are all 0s (the host part). So 255.255.255.0 is 24 ones followed by 8 zeros — the dotted-decimal equivalent of a /24 prefix. To find the network a given address belongs to, a device computes a bitwise AND of the address and the mask: 192.168.1.20 AND 255.255.255.0 = 192.168.1.0, the network address. When the host wants to send to 192.168.1.55, the same AND gives 192.168.1.0, the same network, so it delivers directly; sending to 10.0.0.5 gives a different network, so it forwards to its default gateway instead.

The mask and the CIDR prefix length are two notations for the same thing: /24 and 255.255.255.0 are identical, as are /16 and 255.255.0.0. Older equipment and dialogs often want the dotted-decimal mask; routing tables and modern docs prefer the slash. A non-contiguous mask (ones and zeros interleaved) is illegal in practice — the ones must form one unbroken run at the front.