What Is a Subnet Mask?

You learned in Chapter 2, “Introduction to Microsoft Networking,” how the subnet
mask can be used to determine whether a host is a local or remote host. To review,
the IP address is ANDed with the subnet mask to extract the network ID for the local
network on which the host resides. The IP address that IP receives in the pseudo
header is now ANDed with the subnet mask to determine a network ID.
It is important to note that the network ID generated might be incorrect. If the host
attempting to send is a Class C host using 255.255.255.0 as the subnet mask, ANDing
generates an incorrect address if the remote host is a Class B. This does not matter,
however, because the network IDs will not match (remember the first octet differs,
depending on the class of network).
As you can see, therefore, the subnet mask enables you to extract the network ID.
This information is used to see whether the datagram is for the local network. If it is
not, the system needs to look at the remote IP address and use the routing table to
figure out where to send it.
Introduction to Routing
After the network IDs are known, they can be compared. The only case where they
should match is if the two hosts are on the same network. If the host that you are
trying to reach is on the same network, the IP layer finds that host and transmits the
data to it. If not, you need to look for a route to the host. This will be done in the
routing table. All devices that have IP have a routing table. The following is an
example of a routing table from an NT system:
Active Routes:
Network Address Netmask Gateway Address Interface Metric
0.0.0.0 0.0.0.0 206.51.250.69 206.51.250.69 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
206.51.250.0 255.255.255.0 206.51.250.69 206.51.250.69 1
206.51.250.69 255.255.255.255 127.0.0.1 127.0.0.1 1
206.51.250.255 255.255.255.255 206.51.250.69 206.51.250.69 1
224.0.0.0 224.0.0.0 206.51.250.69 206.51.250.69 1
255.255.255.255 255.255.255.255 206.51.250.69 206.51.250.69 1
If you want to look at your routing table, you can use the ROUTE command. The
syntax for the ROUTE command is as follows:

Manipulates network routing tables.
ROUTE [-f] [command [destination] [MASK netmask] [gateway] [METRIC metric]]
-f Clears the routing tables of all gateway entries. If this is
used in conjunction with one of the commands, the tables are
cleared prior to running the command.
-p When used with the ADD command, makes a route persistent across
boots of the system. By default, routes are not preserved
when the system is restarted. When used with the PRINT command,
displays the list of registered persistent routes. Ignored for
all other commands, which always affect the appropriate
persistent routes.
command Specifies one of four commands
PRINT Prints a route
ADD Adds a route
DELETE Deletes a route
CHANGE Modifies an existing route
destination Specifies the host.
MASK If the MASK keyword is present, the next parameter is
interpreted as the netmask parameter.
netmask If provided, specifies a sub-net mask value to be associated
with this route entry. If not specified, it defaults to
255.255.255.255.
gateway Specifies gateway.
METRIC specifies the metric/cost for the destination
All symbolic names used for destination are looked up in the network database
file NETWORKS. The symbolic names for gateway are looked up in the host name
database file HOSTS.
If the command is print or delete, wildcards may be used for the destination
and gateway, or the gateway argument may be omitted.
In the case of a host, the routing table generally does not contain actual routing
information, except for the default gateway (router) address. Any packet not on the
local network is normally sent to the default gateway. IP on the gateway then looks in
its routing table for a route to the remote network. Occasions will arise where you
have entries in the local host’s routing table. In those cases, this table is consulted to
find the first hop in the route.
A routing table contains the following five pieces of information:
u Network Address. The actual network ID to which the entry describes a
route. This is the real network ID, not the one generated earlier when checking,
if the host is local or remote.
u Netmask. The subnet mask that can be used to generate the network ID. The
system runs through the table and ANDs the IP address you are trying to reach
with each of the netmasks. Then it can compare the result to the Network
Address to see whether they match. If they match, a route has been found.
u Gateway Address. Where to send the packet if it is a remote network ID to
which the computer is sending.
u Interface. Which network interface to send the packet from. Normally you
only have one network card, and this is the same for all entries. (The exception
here is the loopback and multicasting addresses.)
u Metric. How far away this network is. This is the number of routers (gateways)
that the packet must travel through to get to the remote.
There will often be an entry for network 0.0.0.0 with a netmask of 0.0.0.0. This is the
entry for the default gateway and is checked last. If you work it out in binary, you will
see that all addresses match this one.