The Subnet Mask
How a device uses a mask and a bitwise AND to decide: send direct, or route?
Your device faces a decision on every packet: is the destination on my own network (send it directly) or somewhere else (hand it to the router)? The subnet mask, plus one binary operation, is exactly how it answers.
This is the most "mathy" chapter so far, but the payoff is real understanding — you will be able to work out yourself whether two IPs are on the same network.
Why we need a subnet mask
When a device wants to send data, it must first decide how. If the target is on the same network, it can send directly — no router, no internet. If not, it has to go through the router and out to the wider internet. The subnet mask is the tool that makes this decision.
The whole job: Same network → send direct. Different network → route. The mask tells you which.
A mask looks like an IP
A subnet mask is written like an IP address — for a /24 network it is 255.255.255.0. But it is not a usable address: you cannot assign it to a device. It exists purely to be applied to IPs.
255 means "all ones"
The magic of a mask is clearest in binary. 255 is 11111111 (eight ones) and 0 is 00000000 (eight zeros). So 255.255.255.0 is twenty-four 1s followed by eight 0s — exactly the /24 split from the last chapter.
Connection: The 1s mark the network bits; the 0s mark the host bits. A /24 mask = 24 ones = 255.255.255.0.
The bitwise AND rule
To use the mask, the device performs a bitwise AND between an IP and the mask, bit by bit. The rule is simple:
- AND with 1
- Keeps the original bit (1·1=1, 0·1=0).
- AND with 0
- Forces the bit to 0.
So the mask preserves the network bits (the 1s) and zeroes out the host bits (the 0s). The result is the network address.
Working an example
Take the laptop 192.168.1.4 and AND it with 255.255.255.0. The first three octets are ANDed with all 1s, so they survive: 192.168.1. The last octet (4) is ANDed with all 0s, so it becomes 0. Result: 192.168.1.0 — the network address.
Takeaway: IP AND mask = the network the IP belongs to. That single result is what gets compared.
Same network? Send direct
Now the comparison. The laptop (192.168.1.4) reduces to 192.168.1.0. A phone at 192.168.1.9 also reduces to 192.168.1.0. The two network addresses match — so they are on the same network, and the laptop sends directly.
Different network? Route it
Try a target of 10.0.0.1. AND it with the mask and you get 10.0.0.0 — which does not equal the laptop’s 192.168.1.0. Different networks. The laptop cannot send directly; it must hand the packet to the router to be routed out.
That is the decision: Compare (my IP AND mask) with (target IP AND mask). Equal → direct. Not equal → gateway.
A /16 mask
Masks come in other sizes. A /16 mask is 255.255.0.0: the first two octets (16 ones) are the network, the last two octets (16 zeros) are the host. You will see masks like this in your WiFi settings and in cloud networks.
Why developers care: latency
This is not just trivia. If your app server and database sit in the same subnet, they talk directly — low latency. Put the database outside the subnet and every query has to hop through routers both ways, adding delay.
Practical tip: Keeping tightly-coupled services (app + DB) in the same subnet is a real, common latency optimization in production.