How a device uses its mask
A host does one small piece of math with its mask. It runs a bitwise AND of its own address and the mask, then does the same for the destination address. If both give the same network address, the destination is local and the host sends to it directly. If they differ, the host hands the packet to its default gateway.
Take 192.168.1.130 with the mask 255.255.255.0. The AND keeps the first three octets and zeroes the last, so the network is 192.168.1.0. Switch to 255.255.255.128 and the same address lands on network 192.168.1.128, because the extra bit keeps part of the last octet.
A mask is always a run of 1 bits followed by a run of 0 bits. That's why a mask like 255.255.255.0 is valid and 255.0.255.0 isn't.
Masks you'll see most
Each mask matches a slash prefix, and each prefix has a fixed number of addresses:
- 255.0.0.0 is /8, with 16,777,216 addresses
- 255.255.0.0 is /16, with 65,536 addresses
- 255.255.240.0 is /20, with 4,096 addresses
- 255.255.252.0 is /22, with 1,024 addresses
- 255.255.255.0 is /24, with 256 addresses
- 255.255.255.192 is /26, with 64 addresses
- 255.255.255.240 is /28, with 16 addresses
- 255.255.255.252 is /30, with 4 addresses
Cloud consoles such as AWS and Azure take the slash form. Cisco style access lists want the inverse, the wildcard mask, which is 0.0.0.255 for a /24.
When two devices disagree
A wrong mask rarely breaks everything, which makes it hard to find. Say host A is 192.168.1.10 with 255.255.255.0, and host B is 192.168.1.200 with 255.255.255.128 by mistake.
A sees B inside its own network and sends straight to it. B works out its network as 192.168.1.128, decides A is outside it, and sends replies to the gateway. Whether those replies arrive depends on the gateway and the switch. You get a connection that half works, or works only in one direction.
When two machines on the same switch can't talk, compare their masks before anything else.