A subnet mask is a 32-bit value that splits an IPv4 address into a network portion and a host portion, telling devices which addresses belong to the same local network. It’s usually written in dotted-decimal form like 255.255.255.0, or as a CIDR prefix like /24, both of which represent the same 24 leading “network” bits.

CIDR (Classless Inter-Domain Routing) notation expresses a subnet mask as a slash followed by the number of network bits, such as 192.168.1.0/24. It replaced the older class-based addressing system and lets network size be defined flexibly rather than only in fixed Class A, B, or C blocks.

For a subnet with n host bits, the total number of addresses is 2 to the power of n. Two of those addresses are reserved — the network address and the broadcast address — so the number of usable host addresses is 2^n minus 2. The exceptions are a /31, which has exactly 2 usable addresses under point-to-point link rules, and a /32, which represents a single host address.

A wildcard mask is the bitwise inverse of a subnet mask, most commonly used in access control lists (ACLs) on routers and firewalls. Where a subnet mask uses a 1 bit to mean “must match” and 0 to mean “don’t care” for the host portion, a wildcard mask flips this so 0 means “must match” and 1 means “don’t care”.

VLSM (Variable Length Subnet Masking) is the practice of subdividing a network into subnets of different sizes rather than one fixed size, so each subnet only gets as many addresses as it actually needs. This reduces wasted IP address space compared to splitting a network into equally sized subnets regardless of how many hosts each one requires.

Private IP ranges — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — are reserved for use inside local networks and are not routed on the public internet, so the same private addresses can be reused by many different networks. Public IP addresses are globally unique and routable, and are assigned by regional internet registries to ISPs and organisations.