Why isn't 255.255.249.0 a valid subnet mask?

Question

I was just wondering about this question above and I would greatly appreciate it if someone can explain why 255.255.249.0 isn't a valid subnet mask.

Answer 1

It's not a valid subnet mask because it doesn't define a prefix. If you convert it to binary, you'll see that its '1'-bits (and/or its '0'-bits) are not all contiguous. This is explicitly forbidden by RFC 4632 (part of the CIDR specification).

The only outstanding constraint is that the mask must be left contiguous

---

For example, convert a valid netmask 255.255.248.0 to binary:

|    255    |    255    |    248    |     0     |
  1111 1111   1111 1111   1111 1000   0000 0000

All the "1"-bits are at the beginning, which means the mask always matches a prefix – the first 21 bits define the network. (This means the whole 255.255.248.0 netmask can be written as "/21" for short.)

Among other things, allows networks to be easily ordered by their netmask – a /24 route is always more specific than a /21 route.

Now convert your 255.255.249.0 to binary:

|    255    |    255    |    249    |     0     |
  1111 1111   1111 1111   1111 1001   0000 0000
                                  ↑

This one has some 1-bits, some 0-bits, and then some 1-bits again. It has 22 "network" bits, but so does 255.255.250.0, and so does 255.255.252.0 – if an address matches routes with all those netmasks, it's unclear which one of them has higher priority.

As people in the comments mention, this used to be allowed, but not for very long.

From: David Edelman on NANOG

You could be sure of two things when there were ambiguities in the routing tables:
1 - Every manufacturer knew how to handle them.
2 - Every manufacturer did it a different way.

---

Note: There is another thing often called filter or ACL masks, where this restriction doesn't apply because filter masks don't have the "subnet" semantics associated with them (e.g. longest-prefix match) – they only either match or don't. For example, iptables would accept a filter mask 255.255.249.0 just fine.

Answer 2

The mask needs to contiguously have high order bits on to mask the network address under which the subnet addresses are. 249 does not have this property, as it is 11111001 in binary, there are zeroes between the ones.

Answer 3

Formally speaking, it actually is a valid subnet mask. As the name implies, a subnet mask is simply a bitmask pattern (any pattern) that tells you which portions of the address define the network as a whole.

The reason that you never see more than eight distinct octet values is that starting very early on, the convention was to simply use the leftmost bits for the network and the remainder for host or sub-network addressing. This allowed a simple rule that everyone could remember and which told you which bits you could use if you needed to subdivide a network.

As far as standards go, we started with "classful" (not named at the time) networks, with classes A, B, and C being defined by their first one, two, or three octets, respectively, and allocated based on the size of who requested it. As far as I know, a fair amount of network kit early on was optimized in ways that only really worked on octet boundaries (classes D and E weren't used much and could still be handled that way).

This was eventually replaced by CIDR (Classless Inter-Domain Routing), which does mandate that the netmask be "contiguous 1s to the left". Among other reasons, it guaranteed that you could "roll up" someone's routing announcements into a smaller routing table entry if you knew that all of your routes for their networks went to the same port, even if they only announced separate route entries for each one.

This was especially important for mid-sized / regional ISPs who had multiple interconnects with the "tier 1" providers but often ended up with all of the routes for someone across the country effectively pointing to a single outbound route — while their RIB (routing information base, the complete set of routing info) would still know about all of the separate routes, their FIB (forwarding information base, the thing which drives the actual hardware at wire speed) could be kept smaller and thus faster. If you had mid-grade hardware, which was common, that could really make quite a lot of difference in how efficient your hardware was and how fast you could switch things.

TL;DR: A netmask really is a mask, and can have an arbitrary pattern, but in practice you'll basically never see one that isn't "all ones to the left".