How to Compute a Subnet Mask From an IP Address

Understanding subnet masks is one of those networking fundamentals that looks intimidating at first but follows a clear, logical pattern once you see how it works. Whether you're setting up a home network, studying for a certification, or troubleshooting a connectivity issue, knowing how to derive a subnet mask from an IP address gives you real control over how networks are structured.

What a Subnet Mask Actually Does

A subnet mask works alongside an IP address to divide it into two parts: the network portion and the host portion. The network portion identifies which network a device belongs to. The host portion identifies the specific device within that network.

Every IPv4 address is 32 bits long, written as four octets (e.g., 192.168.1.45). A subnet mask is also 32 bits, and it uses a sequence of 1s followed by 0s in binary to mark where the network ends and the host begins.

For example, the subnet mask 255.255.255.0 in binary is:

The 1s cover the network bits. The 0s cover the host bits. Wherever the subnet mask has a 1, that corresponding bit in the IP address belongs to the network identity.

Understanding CIDR Notation and Prefix Length

Modern networking almost always pairs IP addresses with a CIDR prefix — that slash number you see after an IP address, like 192.168.1.45/24. That number tells you exactly how many leading bits are the network portion.

Computing the subnet mask from a CIDR prefix is straightforward:

To compute the mask manually, fill in that many 1s from the left across all 32 bits, then fill the remaining bits with 0s. Convert each 8-bit group to decimal.

Step-by-Step: Computing a Subnet Mask From a CIDR Address 🔢

Take the address 10.0.0.0/20 as an example.

Step 1 — Note the prefix length: /20 means 20 bits are the network portion.

Step 2 — Write out 32 bits:

The first 20 bits are 1s. The remaining 12 bits are 0s.

Step 3 — Convert each octet to decimal:

• 11111111 = 255
• 11111111 = 255
• 11110000 = 240
• 00000000 = 0

Result: The subnet mask is 255.255.240.0

The tricky octet is always the one where the boundary falls mid-byte. In this case, the third octet has four 1s and four 0s — 11110000 — which equals 240. You can calculate any mixed octet by adding the place values of the 1 bits: 128 + 64 + 32 + 16 = 240.

When There's No CIDR Prefix: Using IP Address Classes

Older networks used classful addressing, where the IP address range itself implied the subnet mask. This still comes up in textbooks, legacy documentation, and some basic configurations.

So if someone hands you the IP 172.16.5.10 with no prefix, the classful default would suggest 255.255.0.0. However, classful addressing is largely obsolete — most modern networks use CIDR and VLSM (Variable Length Subnet Masking), which give administrators much finer control over how address space is divided.

How Network and Broadcast Addresses Are Derived

Once you have the subnet mask, two more values fall out naturally: the network address and the broadcast address.

• Network address: Apply a bitwise AND between the IP address and the subnet mask. All host bits become 0.
• Broadcast address: Take the network address and set all host bits to 1.

For 192.168.1.45 with mask 255.255.255.0:

• Network address: 192.168.1.0
• Broadcast address: 192.168.1.255
• Usable host range: 192.168.1.1 through 192.168.1.254 (254 hosts)

The number of usable hosts in any subnet follows the formula: 2ⁿ − 2, where n is the number of 0 bits in the subnet mask. The subtraction accounts for the network and broadcast addresses, which can't be assigned to devices.

Variables That Affect Which Subnet Mask Is Right for a Given Network 🖧

Knowing how to compute a subnet mask is one thing. Knowing which mask to use in a real-world setup depends on several factors that vary significantly by situation:

• Number of hosts required — A /30 supports only 2 usable hosts (point-to-point links), while a /22 supports over 1,000
• Number of subnets needed — More subnets means borrowing more bits from the host portion
• IP address space available — Private ranges like 10.0.0.0/8 offer far more flexibility than 192.168.x.x
• Routing architecture — Some designs use summarized supernets; others require granular subnets per department or VLAN
• Growth planning — A subnet sized for today's 50 devices might be too small if the network doubles in a year

Different network environments — a small home lab, a corporate office with segmented VLANs, a cloud VPC, or an ISP assigning prefixes to customers — reach meaningfully different conclusions about the right mask, even when starting from the same base IP range.

The math for computing the mask is consistent and learnable. What changes is how that math applies once your own network's size, structure, and growth requirements enter the picture.