What is a subnet, and what does a subnet mask do?

Subnetting is how a large IP address space is carved into manageable, routable pieces. The subnet mask is the tool that does the carving, and understanding it is foundational to routing and to network segmentation as a security control.

Network bits vs host bits

An IPv4 address is 32 bits. The subnet mask is a second 32-bit value where the leading 1s mark the network portion and the trailing 0s mark the host portion. For 192.168.1.0/24, the mask is 255.255.255.0 — the first 24 bits (192.168.1) identify the network, and the last 8 bits identify individual hosts within it. The /24 is CIDR notation, just shorthand for "24 network bits."

What the mask is used for

When a host wants to send a packet, it ANDs the destination IP with its own mask. If the result matches its own network, the destination is local and it delivers directly via ARP/MAC. If not, the packet is remote and goes to the default gateway. So the mask literally decides "talk directly or hand to the router."

Host counts

A /24 has 8 host bits = 256 addresses, but two are reserved: the network address (all host bits 0) and the broadcast address (all host bits 1), leaving 254 usable hosts.

Why it matters for security

Smaller subnets create smaller broadcast domains and natural boundaries you can put access controls on. Segmenting servers, user workstations, and IoT devices into separate subnets limits lateral movement — an attacker who lands in one subnet can't freely reach another if a firewall sits between them.

Interviewers want the network/host split, what /24 means, the local-vs-gateway decision, and ideally the segmentation security benefit.