A network mask is used to determine which part of an IP address belongs to the network and which part identifies the host.

A classic IP v4 address consists of a 32 bit binary number. This number is a concatenation of the network and the host number.

e.g. if I have network 1.2.3.0/8 with on that computer number 4 then we say that:

  • 1.2.3.0 is the network
  • and 1.2.3.4 is the IP of a host on that network.

To determine where the numbers for the network range stop and where the host part starts we need an extra item. This is the network mask.

Example using the number from above:

32 bits as a ruler  12345678 90123456 78901234 56789012
1.2.3.4 in binary   00000001 00000010 00000011 00000100

Network/Host        NNNNNNNN NNNNNNNN NNNNNNNN HHHHHHHH

Here we see that 24 bits are used for the network part and 8 bits are used for the host. If we turn all these N's into 1's and the H's into zeros then we can logically and and IP address with that mask and the result is the network.

Example:

1.2.3.4 in binary   00000001 00000010 00000011 00000100
Mask                11111111 11111111 11111111 00000000
                    -----------------------------------  AND
                    00000001 00000010 00000011 00000000

Thus the network is 00000001000000100000001100000000.

This is usually written in dotted decimal format where eight bits are grouped into one number. Simple binary calculation will show use that 00000001 equals 1, 00000010 equals 2, 00000011 equals 3 and 00000000 equals 0. Thus the network in dotted decimal notation is 1.2.3.0.

This is usually written as 1.2.3.0/8, or in the combination of "network 1.2.3.0" "netmask 255.255.255.0" where 255 is the binary values of the mask we ANDed with.