The subnet mask

A subnet mask is a 32-bit number written like an address, whose job is to mark the split.

Address:  192.168.1.20
Mask:     255.255.255.0

The rule is simple: where the mask has a 1, that bit belongs to the network. Where it has a 0, that bit belongs to the host.

Line them up in binary and it becomes obvious:

Address  11000000.10101000.00000001.00010100
Mask     11111111.11111111.11111111.00000000
         └──────── network ─────────┘└─host─┘

The first 24 bits are the network. The last 8 identify the host. So the network is 192.168.1.0 and this machine is host .20 within it.

Slash notation

Writing masks out in full is tedious, so we count the ones instead:

255.255.255.0    = 24 ones  = /24
255.255.0.0      = 16 ones  = /16
255.255.255.192  = 26 ones  = /26

So 192.168.1.20/24 says everything: the address, and that the first 24 bits are the network.

This is CIDR notation, and it is what AWS uses everywhere. Section three is devoted to it.

Reading a mask you have not seen before

255.255.255.192 — the first three octets are all ones, so that is 24. The last octet is 192, which the table says is 2 ones. Total 26, so it is a /26.

Going the other way, a /27 is 27 ones: three full octets (24) plus 3 more, and 3 ones is 224. So the mask is 255.255.255.224.

Why the same address can be on different networks

This is worth sitting with, because it is the point of the whole mechanism.

192.168.1.20/24   network is 192.168.1.0    (256 addresses)
192.168.1.20/26   network is 192.168.1.0    (64 addresses)
192.168.1.20/16   network is 192.168.0.0    (65,536 addresses)

Same machine, same address, three different networks — because the mask, not the address, decides where the boundary falls.

Two machines can only talk directly if they are on the same network. Get the mask wrong on one of them and you get the classic symptom: it can reach some machines and not others, with no obvious pattern.