Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the use of a subnet mask?

What is the below output conveying to the user?

 Connection-specific DNS Suffix  . :
 IP Address. . . . . . . . . . . . :
 Subnet Mask . . . . . . . . . . . :
 Default Gateway . . . . . . . . . :

Basically, why do I need Subnet mask when I have my IP?

share|improve this question

migrated from Sep 10 '10 at 2:46

This question came from our site for professional and enthusiast programmers.

EA over at SF has answered this much better than anyone else I've ever seen. – MDMarra Sep 10 '10 at 18:22

If you think of your IP address like a phone number:

  • the subnet mask tells you how many digits are part of the area code
  • the remaining digits are your individual number under that area code
share|improve this answer
Nice succinct example that explains the purpose without getting technical. – Mike Christiansen Sep 10 '10 at 7:40


You subnet mask is used to define your local network or subnetwork. You can access everything within the same subnet directly, but everything that is not on your subnet requires the request to go via a gateway.

So, for a home user your subnet will be your home network - your computers and wireless devices can all talk directly to one-another. But, the internet is outside your subnet, so all communication has to go via your gateway (usually a router) first.

Slightly Technical

A subnet is a 32-bit long bit mask (as touched upon by Manaf Abo.Rous), normally written as four 8-bit bytes. Note that 255 is 11111111 (8 ones) in binary.

The mask basically means "only those IP addresses that have the same numbers in the places, as defined by the subnet mask, are in my local network".

So a subnet of means every IP address that matches the first three bytes is your local network, with your given numbers this is anything matching 192.168.001.###. Alternatively a wider subnet of would make your local network 192.168.###.###.

More Technical

The byte values don't always have to be 255, you could have, which is 28 one's and 4 zero's. This means the first 28 bits of another IP must match your's to be in the same subset. A subnet mask must always be a certain number of 1's followed by only zeros to make 32-bits, and this is why it can be represented as /28 as well (in this case anyway) with the value showing how many 1's the mask contains - this is normally used in the context of the IP, such as

So, if your IP is with the subnet mask, your subnet is the IP range of to (although the lowest and highest are generally not used for devices as they have special functions). If your IP was your network would be the range to

Notice how both these sets contain 16 unique addresses? The subnet also defined how large the subnet is because it defines how many IP addresses are available.

And now, with Binary

Finally, to paraphrase Manaf Abo.Rous's answer, let's look at the binary.

We'll start by using the mask, here it is in binary:

11111111 11111111 11111111 00000000

So given your IP you know that every IP in local network matches those first 24 ones, so lets check your IP ( in binary:

11000000 10101000 00000001 00000010 

Now, we only look where the 1's in the subnet are, to get your subnet number:

11000000 10101000 00000001 --------

And now we know every IP in your local network starts with your subnet number, and can have anything in the missing values at the end.

Finally, lets look at a second example, using IP and subnet

11111111 11111111 11111111 11110000  [subnet] 
11000000 10101000 00000001 00110101  [IP]
11000000 10101000 00000001 0011----  [subnet number]

And again, your local IP's would have anything in the last four binary values - which are 0000,0001,etc up to 1111 - or in decimal 0 to 15 - but remember they would have 0011 in front to make a full byte, so really the IP's available are 00110000 (48), 00110001 (49) and so on up to 00111111, which is 63.

share|improve this answer
Hmmm, just come back to have a re-read of my post and realised it really is painfully long. Sorry about that, but I'm not sure I can parr it down without damaging the content... – DMA57361 Sep 10 '10 at 10:34
Wow. Having seen the frankly excellent SF post that MarkM linked to from the comments on this question my answer actually looks small in comparison... which is worrying... – DMA57361 Sep 10 '10 at 22:11
+1 - Great answer. Helped me a lot. Cheers. – boehj Jul 15 '11 at 5:45

The subnet mask is used to identify your network IP.

Applying the logical AND operation on your IP Address and the Subnet Mask will output your network ip address.

in the example above

IP Address : 11000000 10101000 00000001 00000010 =

Subnet Mask : 11111111 11111111 11111111 00000000 =

AND Result : 11000000 10101000 00000001 00000000 = = You Network Address

More info here

share|improve this answer
Nice technical explanation :P Not too much information – Mike Christiansen Sep 10 '10 at 7:41
+1 this is the real answer of how the hardware gets the network information from – KMC Feb 27 '12 at 2:42

A subnet mask is used for routing IP packets.

Basically, you take your destination IP address, and it with the mask and, it it matches a value, you use that route.

For example, here's one bit of my output from netstat -nrv:

Destination      Netmask          Gateway         Interface

That means that any IP address of the form 192.168.182.x will route based on this rule, because any address of that format, when and-ed with (the netmask) will give (the destination).

Similarly, a default route would be:

Destination      Netmask          Gateway         Interface

since any address and-ed with gives

share|improve this answer
what is -ed here – JavaUser Sep 10 '10 at 5:21
and-ed : this means perform a bitwise and between two numbers ( – Mike Christiansen Sep 10 '10 at 7:39
Someone asking about subnet masks is likely to get confused when you start talking about routes... – Mike Christiansen Sep 10 '10 at 7:41
@Java - Past tense of the boolean operation "and" – MDMarra Sep 10 '10 at 18:23

The subnet mask splits the IP into two sections, a network (or subnet) part and a host part. The preceding comments illustrate that nicely.

Anything where the network part of the IP is the same can communicate without having to go "through" a router. The host part of the IP must be different for each device, of course.

If you had 4 computers with these IP/subnet masks set:

host_11 -

host_12 -

gateway -

host_21 -

only the first 3 could communicate. The fourth would not respond, because it is not on the same subnet.

"Default gateway" is a fancy name for a router, and it needs to be on the same network. You might have seen ipconfig output where there is no default gateway. That means no routing; i.e. communication can only happen between IP's on that network.

Keeping with our example:

host_11 -; default gateway

host_12 -; default gateway

gateway -

host_21 -; default gateway

If wanted to talk to say,, it would end up that picks up that traffic, and then forwards it. (Routing is forwarding.) would need a second IP that is set to something like Then, would need to have it's default gateway set to something on it's subnet, which is.

So, in all actuality, it really looks like this:

host_11 -; default gateway

host_12 -; default gateway

gateway - first IP, second IP

host_21 -; default gateway

So now the 192.168.2.X and 192.168.3.X networks can speak to each other. Of course, they can't speak to any other network, or the Internet. The gateway would need a third IP connected to an ISP, and have that set as it's default gateway. The gateway then picks up non-same-network traffic from 192.168.2.X and 192.168.3.X.

You can set routing rules for situations where the gateway can't find out everything on it's own. In this example we don't really need to since all networks are connected to the router. However, in situations where you have a network with multiple routers (default gateways), or "networks behind networks", then routing rules have to be specified. That's getting into some advanced stuff. I hope this was helpful.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .