Subnet Masks are how you get networks. It’s simple binary ANDing math.
For example, if you have a 192.168.1.1 IP address and a subnet mask of 255.255.255.0, that means the first 3 octets (each block of numbers between the dots representing an 8 bit value) of 255 are the network part of the IP (192.168.1.0/24) and the fourth octet is the host addresses space of the address. It’s saying 192.168.1 is the network and the last number is the host on that network.
If you take 1 from 192.168.1.X and convert it to binary, you get 00000001. If you convert 255 to binary, you get 11111111.
If you line them up and “AND” them together sort of like you’re adding them together in a “both must be true” comparison, you get
00000001
11111111
00000001
A 1 and a 1 makes 1. Anything else makes a 0. Basically the 192 gets ANDed to 255 and comes out as itself. Same for 168 and 1.
For a 255.0.0.0 (or /8) 255.255.0.0 (or /16), and 255.255.255.0 (or /24) it’s easy, because it’s all 1s or 0s for each block of 8 bits of the 32 bits that make up an IPv4 address. Each block just plops out as itself or zero because it’s all 1s or all 0s for each of the 4 blocks.
Now try that with 23 bits instead of 24.
00000001 for the third octet “1” part of 192.168.1.1
11111110 for “254” part of 255.255.254.0 (aka a /23)
00000000 or 0 for the third octet.
This means that the network ID is 192.168.0.0/23 and the usable IP addresses are 192.168.0.1 through 192.168.1.254.
With a /23 network, you get 512 addresses instead of 256 with a /24 (192.168.0.0-192.168.1.256 versus 1.0 through 1.256). The first IP is the network ID and the last is the broadcast address, both of which are unusable, so you have 510 IP addresses in a /23 to use for devices instead of 254 with a /24.
This is how basic IPv4 subnetting works and it’s how you size various networks for things like Enterprise that needs more than a small home network of less than 254 devices.
Congrats. If you understood that, you now have enough knowledge to probably pass some network exams.
Thank you for this explanation! Now i finally understand what the “mask” part means! Any 0s will mask the IP address in the AND operation and tell the computer that address is not part of the network.
Glad I could help with learning a new thing! If you are curious on anything else networking, I’m a Network Engineer by trade and happy to share knowledge.
That’s another private range that was added for Carrier-Grade NAT that is part of RFC6598. It’s a non-Internet routable 100.64.0.0/10 subnet for things like WISPs, Satellite providers like Starlink, Tailscale, and cellular providers that are strapped for IPv4 addresses.
If a bit in those 4 bytes is 1 that means that the same bit in the IP address is part of what defines the network whilst the bits that are 0 are bits that can change in the IP address and that machine will still be part of that sub-network.
So a mask of 255.255.252.0 (notice the 3rd byte) on a network with a prefix 192.168.0.0 means that 192.168.0.20 is in that sub-network AND 192.168.2.20 is part of that sub-network too, because the two lowest bits of the 3rd byte in that mask are 0, meaning that IP address where those bits vary are still in the same sub-network (i.e. the ranges 192.168.0.XXX, 192.168.1.XXX, 192.168.2.XXX and 192.168.3.XXX are all in the same sub-network).
If instead the sub-network prefix was the same 192.168.0.0 but with a mask of 255.255.255.0 (the most common case you find in home internal networks) then 192.168.2.20 would NOT be part of the same sub-network as 192.168.0.20
You probably also see now why a network mask is needed alongside the network prefix - in both examples above 192.168.0.0 is the network prefix, but without the network mask you don’t know which 0 bits in that network code can be changed to make an IP address still in the same sub-network.
Note that you can change the mask to make the sub-network smaller as well as to make them bigger: for example 192.168.0.0/255.255.255.223 is a perfectly valid subnetwork that fits 30 machines.
See chronicledmonocle@lemmy.world 's post for a full explanation.
Thankyou! So when I see things like 192.168.1.0/24, is that CIDR notation? And does that do a similar thing of the subnet mask by telling you which addresses are part of the subnetwork?
Can you have CIDR and subnet mask at the same time?
Well, a network mask is by definition always a sequence of 1s followed by 0s (in other words, you can’t arbitrarilly have some bits be 0 in between bits which are 1), so that /24 in CIDR notation is literally “/” + the number of bits in the network mask which have the value 1.
In other words, because of that “sequence of 1s followed by 0s” rule both 255.255.255.0 and /24 are just two different descriptions of the same network mask, first as 4 decimal numbers separated by dots, whilst the second as the count of bits in the binary representation of the mask which have the value 1.
For example, the 255.255.252.0 network mask from my first example in my last post could also be represented by /22 since the mask has 8+8+6 = 22 bits with value 1 and the rest are 0 - 192.168.0.0/22 means the same as 192.168.0.0/255.255.252.0
There is no point in having both that part of the CIDR representation and the decimal mask representation at the same time because they’re both different representations of the same thing so having both is redundant.
Depends on the equipment. I prefer cidr because its simpler, and ipv6 uses CIDR. Do you want to spell out a /64 in a netmask format? It would look like this: 255.255.255.255.255.255.255.255.0.0.0.0.0.0.0.0
Why can’t you have ip addresses without subnet masks? Couldn’t the whole internet be on a single network? Would be horrible for a number of reasons, but everything could still work.
Your question is already answered here, but it also reduces traffic by keeping packets within a network defined by the subnet mask. It establishes guardrails so packet broadcasts aren’t sent everywhere.
The Internet is a single network. But not all of it can communicate with other parts without the right access permissions. Subnet masks are one very basic aspect of that access control.
IP addresses are one thing, but wtf is a subnet mask??
Wtf is 255.255.255.255 and why does it keep showing up???
Its just descriptor of size of your local network (aka size of address pool you can assign to your devices)
Subnet Masks are how you get networks. It’s simple binary ANDing math.
For example, if you have a 192.168.1.1 IP address and a subnet mask of 255.255.255.0, that means the first 3 octets (each block of numbers between the dots representing an 8 bit value) of 255 are the network part of the IP (192.168.1.0/24) and the fourth octet is the host addresses space of the address. It’s saying 192.168.1 is the network and the last number is the host on that network.
If you take 1 from 192.168.1.X and convert it to binary, you get 00000001. If you convert 255 to binary, you get 11111111.
If you line them up and “AND” them together sort of like you’re adding them together in a “both must be true” comparison, you get
00000001
11111111
00000001
A 1 and a 1 makes 1. Anything else makes a 0. Basically the 192 gets ANDed to 255 and comes out as itself. Same for 168 and 1.
For a 255.0.0.0 (or /8) 255.255.0.0 (or /16), and 255.255.255.0 (or /24) it’s easy, because it’s all 1s or 0s for each block of 8 bits of the 32 bits that make up an IPv4 address. Each block just plops out as itself or zero because it’s all 1s or all 0s for each of the 4 blocks.
Now try that with 23 bits instead of 24.
00000001 for the third octet “1” part of 192.168.1.1
11111110 for “254” part of 255.255.254.0 (aka a /23)
00000000 or 0 for the third octet.
This means that the network ID is 192.168.0.0/23 and the usable IP addresses are 192.168.0.1 through 192.168.1.254.
With a /23 network, you get 512 addresses instead of 256 with a /24 (192.168.0.0-192.168.1.256 versus 1.0 through 1.256). The first IP is the network ID and the last is the broadcast address, both of which are unusable, so you have 510 IP addresses in a /23 to use for devices instead of 254 with a /24.
This is how basic IPv4 subnetting works and it’s how you size various networks for things like Enterprise that needs more than a small home network of less than 254 devices.
Congrats. If you understood that, you now have enough knowledge to probably pass some network exams.
Thank you for this explanation! Now i finally understand what the “mask” part means! Any 0s will mask the IP address in the AND operation and tell the computer that address is not part of the network.
Glad I could help with learning a new thing! If you are curious on anything else networking, I’m a Network Engineer by trade and happy to share knowledge.
Ok one last question: did tailscale have to buy the 100.100.100.x range, or is that available to anyone and they are just the only user i know?
That’s another private range that was added for Carrier-Grade NAT that is part of RFC6598. It’s a non-Internet routable 100.64.0.0/10 subnet for things like WISPs, Satellite providers like Starlink, Tailscale, and cellular providers that are strapped for IPv4 addresses.
If a bit in those 4 bytes is 1 that means that the same bit in the IP address is part of what defines the network whilst the bits that are 0 are bits that can change in the IP address and that machine will still be part of that sub-network.
So a mask of 255.255.252.0 (notice the 3rd byte) on a network with a prefix 192.168.0.0 means that 192.168.0.20 is in that sub-network AND 192.168.2.20 is part of that sub-network too, because the two lowest bits of the 3rd byte in that mask are 0, meaning that IP address where those bits vary are still in the same sub-network (i.e. the ranges 192.168.0.XXX, 192.168.1.XXX, 192.168.2.XXX and 192.168.3.XXX are all in the same sub-network).
If instead the sub-network prefix was the same 192.168.0.0 but with a mask of 255.255.255.0 (the most common case you find in home internal networks) then 192.168.2.20 would NOT be part of the same sub-network as 192.168.0.20
You probably also see now why a network mask is needed alongside the network prefix - in both examples above 192.168.0.0 is the network prefix, but without the network mask you don’t know which 0 bits in that network code can be changed to make an IP address still in the same sub-network.
Note that you can change the mask to make the sub-network smaller as well as to make them bigger: for example 192.168.0.0/255.255.255.223 is a perfectly valid subnetwork that fits 30 machines.
See chronicledmonocle@lemmy.world 's post for a full explanation.
Thankyou! So when I see things like 192.168.1.0/24, is that CIDR notation? And does that do a similar thing of the subnet mask by telling you which addresses are part of the subnetwork?
Can you have CIDR and subnet mask at the same time?
Well, a network mask is by definition always a sequence of 1s followed by 0s (in other words, you can’t arbitrarilly have some bits be 0 in between bits which are 1), so that /24 in CIDR notation is literally “/” + the number of bits in the network mask which have the value 1.
In other words, because of that “sequence of 1s followed by 0s” rule both 255.255.255.0 and /24 are just two different descriptions of the same network mask, first as 4 decimal numbers separated by dots, whilst the second as the count of bits in the binary representation of the mask which have the value 1.
For example, the 255.255.252.0 network mask from my first example in my last post could also be represented by /22 since the mask has 8+8+6 = 22 bits with value 1 and the rest are 0 - 192.168.0.0/22 means the same as 192.168.0.0/255.255.252.0
There is no point in having both that part of the CIDR representation and the decimal mask representation at the same time because they’re both different representations of the same thing so having both is redundant.
Thanks, that rule about which masks are allowed was definitely not clear to me at first, thank you
Depends on the equipment. I prefer cidr because its simpler, and ipv6 uses CIDR. Do you want to spell out a /64 in a netmask format? It would look like this: 255.255.255.255.255.255.255.255.0.0.0.0.0.0.0.0
_
It tells you how to read the IP address. It’s a really cool trick that’s an enormous pain in the ass.
If you’re serious, you can’t have one without the other.
Why can’t you have ip addresses without subnet masks? Couldn’t the whole internet be on a single network? Would be horrible for a number of reasons, but everything could still work.
Your question is already answered here, but it also reduces traffic by keeping packets within a network defined by the subnet mask. It establishes guardrails so packet broadcasts aren’t sent everywhere. The Internet is a single network. But not all of it can communicate with other parts without the right access permissions. Subnet masks are one very basic aspect of that access control.
Yeah I was just saying saying that it’s possible to have one without the other.
It’d be like one big DDoS attack without them. Haha!
It is about security.
So you can differentiate between the outside network and the local network. And even divide 2 local networks as well.
Would it be possible? Sure. Just like it would be possible to have no speed limits for cars.