Network administrators create subnets (smaller network segments within a larger network) to streamline traffic and improve security. But to correctly route traffic among those segments, you need subnet masks.
Learn what subnet masks are, why they matter, and how to use them to your advantage.
What Is a Subnet Mask?
A subnet mask is a 32-bit value used to determine the network and host portions of an IPv4 address via bitwise comparison. This allows routers and hosts to determine whether a destination IP is local or must be forwarded to a gateway. As the RFC 950 Internet Standard Subnetting Procedure memo states, subnets are useful for organizations with multiple buildings or facilities (i.e., multiple LAN cables).
Routers route traffic between subnets; subnet masks help devices identify subnet boundaries.
What Is the Purpose of a Subnet Mask?
Subnet masks enable communication without conflict, simplifying IP network management.
Subnet Masks in IP Addressing
IP addressing is the process of assigning IP addresses to all network devices.
Without a subnet mask to interpret the IP address, routers can’t distinguish between local network devices and remote internet traffic. This creates failed network connections. With incorrect subnet masks, even authorized devices on the same network can’t communicate.
Subnet Masks in Network Security and Network Performance
Subnet masks play a crucial role in network security by isolating network segments into more manageable containers. They help secure sensitive data through fine-tuned firewalls and access controls.
Subnet masks also reduce broadcast traffic, narrowing attack surfaces and improving network performance.
This makes subnets an essential part of your broader network access control (NAC) strategy.
How Does a Subnet Mask Work?
A subnet mask works by separating the network and host portions of an IP address, letting routers determine whether devices are remote or local.
For example, say your IP address is 164.118.40.6 with subnet mask 255.255.0.0. Each “255” tells your router that local devices match that portion of your network address exactly. So, in this case, any valid host address beginning with 164.111 uses your local network.
Subnet masks can shrink and expand to your network’s requirements. In traditional IPv4 subnetting, the smallest practical subnet (/30) supports two usable host addresses; /31 may be used for point-to-point links. With variable length subnet masking (VLSM), you can create multiple subnets of different sizes, improving IP address allocation while minimizing waste.
Representation of Subnet Mask Notations with Examples
Subnet masks have two common representations: dotted decimal notation and CIDR notation.
Dotted Decimal Notation
Dotted decimal notation takes the same format as IP addresses: four octets (eight bits each for a total of 32 bits), separated by decimal points and ranging from 0-255.
Common subnet masks in dotted decimal notation include:
- 255.0.0.0: Devices IPs with the first octet matching the network IP is local and can connect with other devices on that subnet. Also known as a Class A Network, it has 16,777,216 available IP addresses.
- 255.255.0.0: Device IPs with the first two octets matching the network IP are local. Also known as a Class B Network, it has 65,536 available IP addresses.
- 255.255.255.0: Device IPs with the first three octets matching the network IP are local. Also known as a Class C Network, it has 256 available IP addresses.
CIDR Notation
Classless Inter-Domain Routing (CIDR) is a modern, concise way to represent subnet masks using the number of network-portion bits in an IP address. According to RFC 1519, by removing class considerations, CIDR counters the impending exhaustion of usable addresses within the IPv4 address space.
Larger CIDR numbers represent smaller subnets with fewer usable host addresses. Relative to 32 bits, CIDR numbers range from /0 (every possible IP address) to /32 (one host for the entire network).
The CIDR translations of the dotted decimal notations are:
- /8 Subnet Mask: 255.0.0.0 or Class A
- /16 Subnet Mask: 255.255.0.0 or Class B
- /24 Subnet Mask: 255.255.255.0 or Class C
To reference a specific subnet, place the CIDR number at the end of the IP address:
196.143.2.9/24
What Is a /24 Subnet Mask?
A /24 subnet mask denotes the number of network bits in an IP address (24). Out of a possible 32 bits, a /24 subnet mask has eight host bits.
The “/24” format is a CIDR notation. In dotted decimal notation, it’s 255.255.255.0. And among the three common network classes from traditional subnetting, it’s a Class C Network.
This subnet mask accommodates 254 hosts with 256 possible IP addresses.
Other common subnet masks are /16 subnet mask (Class B Network) and /8 subnet mask (Class A Network), where 16 and 8 bits are reserved for the network, respectively.
Subnet Masks vs. Other Networking Terms
It’s easy to confuse subnet masks with other types of network routing and segmentation. In fact, subnet masks play a unique role which sets them apart from other network mechanisms.
What’s the difference between a subnet mask and an IP address?
IP addresses identify devices on a network. Every device connected to your network has its own IP address.
A subnet mask tells devices how to interpret your IP address using a network portion and a host portion. This helps route traffic among connected devices within your network, improving network speed and reducing connection failures.
What’s the difference between a subnet mask and a default gateway?
A default gateway is a specific IP address for the device connecting your local network to remote networks.
A subnet mask is the number that segments that device’s IP address (your default gateway) into the network and host portions.
Benefits and Challenges of Subnetting
Benefits include:
- Routing efficiency: Without subnets, broadcast traffic routes data packets across your entire network, creating unnecessary traffic that reduces network efficiency.
- Network security: Subnets enable network administrators to curate access to files, databases, or whole networks. If attackers infiltrate a subnet, the attack only affects that same subnet.
- Flexibility and scalability: IPv4 has limited permutations (four sets of numbers between 0 and 255). Subnetting splinters from a single IP address, prolonging IPv4.
Challenges include:
- Complex implementation and documentation: Expect to invest significant time and resources into setup, documentation, and onboarding.
- Device incompatibility: Not all devices support modern subnets; those that don’t will pose challenges.
- Increased costs: Extensive subnetting may require advanced network routers, updated devices, and associated setup and maintenance costs.
Optimize Your Network Access Control Strategy with Subnet Masks
Traditional cybersecurity tactics aren’t enough to keep your network secure. By segmenting network traffic, subnet masks reduce your attack surface and minimize threats.
With the combination of subnet masks and certificate-based passwordless authentication, you can streamline network access while enhancing security. It’s all part of a comprehensive, robust, and reliable network access control strategy.
