How to figure out the subnet mask when the printer cannot connect 255.255.255.0

When I helped install a computer for a friend's company, I filled in the network settings according to my family habits. 255.255.255.0 , As a result, the shared printers in half of the office 192.168.0.x cannot be connected, and the ping fails. I spent an afternoon trying to change network cables and restart switches to no avail. Finally, I compared it with the ipconfig /all of my colleague's computer and found out.: The whole company’s mask is 255.255.254.0 , just mine is 255.255.255.0 . Change it to the same, and it will be connected in seconds.

That was the day I really understood the subnet mask thing. It's not some advanced configuration. To put it bluntly, it's just one sentence.: Decide who is in the same neighborhood as you . Devices in the same community can call each other directly. Those in different communities must go through the gateway door. This article breaks it down and explains it clearly.

First distinguish: IP is the house number, and the mask is the community wall.

There are two address concepts in the router world, The MAC address is the device’s ID card, and the IP address is the house number. , these have been written before. But just having house numbers is not enough - you have to know which house numbers count as the same community.

My router is 192.168.31.1 , the house number obtained by the mobile phone is 192.168.31.108 , NAS is 192.168.31.10 . These three devices transfer files to each other, cast screens, and access the backend. The data flies directly in the LAN without going through the operator. This was previously done in The article about gateways I used an analogy in: If you are in the same community, call directly; if you are in another community, please leave it to the gate.

Here comes the problem: How to determine the router" 192.168.31.108 and 192.168.31.10 Are they from the same neighborhood?" It doesn't know number sense. The answer is to use the subnet mask as a ruler. Without a mask, an IP address is just a string of lonely numbers, and no one can tell whether two house numbers are neighbors.

255.255.255.0 Take it apart and see: Three groups are locked and one group is free.

255.255.255.0 This string of numbers needs to be broken down into four groups.: The first three groups are 255, and the last group is 0. The rules are extremely rough—— For those groups whose mask is 255, the corresponding numbers in the IP are "locked" and are counted as part of the community name. ； For the group whose mask is 0, fill it in casually and calculate the house number. .

Take my family as an example. IP is 192.168.31.108 , mask 255.255.255.0 , then the community name is 192.168.31, and the tail number 108 is just the room number in this building. For equipment in the same community, the first three digits must be exactly the same, and the last digit can be randomly selected from 1 to 254. so 192.168.31.50 and 192.168.31.200 is a neighbor, and 192.168.30.50 Even if it's from another neighborhood - even if it looks like there's only one number missing.

In the background of the router, it is often written as 192.168.31.0/24 In this case, the 24 after the slash is another notation.: 255 converted into binary is 8 ones, three groups of 255 is 24 ones, so 255.255.255.0 Equal to /24. The /24 and /16 you see in various tutorials are all about masks, the same thing.

Quick calculation tips: 255 copied, 0 returned to zero

To determine whether two devices are in the same community, the professional saying is to do an "AND operation" between the IP and the mask to calculate the network number. This sounds scary, but there is actually a simple method.: The mask is a group of 255, and the IP bit is copied ； If the mask is 0, it will be returned to zero directly. .

Do the math. 192.168.31.108 Served with 255.255.255.0 , copy the first three groups, reset the last group to zero, and get 192.168.31.0 , this is the network number. another 192.168.31.66 Even if you calculate it 192.168.31.0 ——The network number is the same, the community is the same, and you can call directly. and 192.168.30.66 Calculated it is 192.168.30.0 , if it doesn’t match, the package will be thrown to the gateway. 192.168.31.1 Go forward. The underlying logic of all routing decisions is this comparison, without any metaphysics.

By the way, the "direct call" in the same community is the other party's MAC address, and ARP broadcast is used to find people. Therefore, the range circled by the mask is actually a broadcast domain - the size of this circle directly determines whether the broadcast is noisy or not, which will be discussed in detail later.

I failed in the company: 255.255.254.0 Divide two segments into one family

Back to the pit at the beginning. My friend Lao Ji's company has a lot of equipment, and the installation master divided the intranet into 192.168.0.0/23 , that is, mask 255.255.254.0 , the two segments 192.168.0.x and 192.168.1.x are divided into the same community, which can accommodate a total of 510 devices.

The day I went to help out, I manually assigned an IP address to the new computer, and I filled in the third number at home.: IP 192.168.1.158 , mask 255.255.255.0 , gateway 192.168.0.1 . As a result, something strange happened: Colleagues’ computers at 192.168.1.x have full access, and shared directories can be opened in seconds. ； The printer over there at 192.168.0.x cannot be connected, and the ping times out.

Just follow the formula above and you will understand. The /24 mask I filled in locked the community name to 192.168.1, so in the eyes of my computer, all the devices at 192.168.0.x were "outside the community", and all packets looking for the printer were sent to the gateway for detour. As for the old printer, the gateway column was left blank, and it would only communicate directly with devices that it thought were in the same neighborhood. The two parties' judgments of "who is the neighbor" did not match the table at all, and the ARP search step was messed up. Change the mask to 255.255.254.0 , and the whole company has the same caliber, and everyone can get through immediately.

There is another knowledge point here: 254 converted to binary is 11111110, seven 1s plus one 0. so 255.255.254.0 It's not that "the whole group is locked when it comes to a certain group", but the first 7 digits of the last group are locked and the last 1 digit is free - just encircling the two numerical fields 0 and 1 into the same cell. This is why it is called "Supernet", two /24s are combined into one.

You don’t have to worry about matching a large mask with a small mask. There is a hard rule.

After suffering the loss, I specifically conducted experiments at home. Copying games to my cousin. The two computers are directly connected with a network cable, without a router. On the first trip, I randomly matched it. 192.168.0.10 and 192.168.1.10 , the masks are all 255.255.255.0 ——The two machines thought each other was from another community, so they threw all the packets to the gateway, but there was no gateway at all, so pinging all night was in vain. The second trip was changed to 192.168.0.10 and 192.168.0.11 , connect immediately. This is a small hole in the mask: Neighbors who were originally directly connected were classified as outsiders. .

There are pitfalls as well with larger ones. Someone tried to save trouble by filling in the mask at home 255.255.0.0 , I thought, "Whatever, the boss in the circle is right." Normally it's fine, but once you connect to the company's VPN, things may go wrong.—— I have written about corporate VPN before 192.168.2.0/24 Push it to my computer , if the mask of my local machine is /16, then all 192.168.xx will be in the same community in the eyes of the system, and the packets going to the company server will be directly ARPed without any reason. After calling for a long time, no one responds, and the connection is inexplicably disconnected. Be honest at home 255.255.255.0 That’s it.

There is a hidden cost to drawing a circle that is too large: The radio is noisy. The range circled by the mask is a broadcast domain. If anyone in the community shouts (ARP is looking for someone, discovering new equipment), the whole community can hear it. The circle of 254 stations at home does not matter, but if all the hundreds of devices in the company are circled into a /16, the broadcast packets can fill up the air, and the forwarding pressure of the switch is visible to the naked eye. Therefore, the principle of delineating network segments is that it is enough, not that the bigger the network segment, the more impressive it is.

In addition, there are hard rules about masks: 1 must be consecutive, starting from the left . 255.255.255.0 , 255.255.254.0 All legal, but 255.0.255.0 This method of writing with a hollow in the middle does not exist, and the device will directly report an error. I will make a list of common mask capacities, and explain an old question by the way - why /24 is 254 units and not 256 units.: Because the one with all 0s at the end is reserved as the network number itself, and the one with all 1s is the broadcast address, one for each end, and 256 minus 2 is exactly 254.

Will we really encounter it at home one day?

If you use DHCP to automatically obtain the address every day, the mask is issued by the router along with the IP, and you will not be aware of its existence. The DHCP article talked about this mechanism . There are only a few occasions when you really need to fill in a mask by hand.:

One is to manually configure a static IP. 192.168.1.1 Manually set IP when self-rescue cannot be opened , Optical modem changes the bridge and configures 192.168.2.x to enter the background , both times there is a mask column in the four-piece set, fill it out according to the router. 255.255.255.0 That's right. For devices such as printers and NAS Bind static IP The same thing applies.

The second is to play with virtual machines and Docker, and let you fill in the network segment when creating a new network, such as 172.17.0.0/16 , which is another way of writing mask. The third is IPv6. It does not have the name mask. Instead, it is called the prefix length, such as /64. The previous article about disassembling IPv6 addresses As mentioned here, the ideas are consistent. As for separating different devices into different cells at the router level, the tool used is VLAN division , much more formal than changing the mask.

The troubleshooting checklist is here. When there is a network problem, check the mask first to avoid detours.:

Just remember one sentence in order.: If you suspect that the network is not connected, first ipconfig /all (check WiFi details on your mobile phone), copy down the IP, mask, and gateway, and compare them with normal equipment one by one. Nine times out of ten, the mask or gateway is filled in incorrectly. If you really can’t find it, you will no longer doubt the network cable and equipment.