The netmask is used to identify which portion of the IP address represents the network address and which portion represents the machine address*.
Consider the class A network 10.0.0.0 to 10.255.255.255 (this is the designated "private" class A block i.e. packets destined for these addresses will not be routed). In binary the addresses are: 00001010.00000000.00000000.00000000 through to 00001010.11111111.11111111.11111111. The netmask is generated by assigning a 1 for each bit in these addresses that does not change IE:
00001010.00000000.00000000.00000000
00001010.11111111.11111111.11111111
-----------------------------------
11111111.00000000.00000000.00000000
Which converts to 255.0.0.0, the classic class A netmask.
* Actually, to get the network address given an IP address, you just do a logical AND. For example, for the netmask 255.0.0.0 and the IP address 10.0.0.1:
00001010.00000000.00000000.00000001
11111111.00000000.00000000.00000000
-----------------------------------
00001010.00000000.00000000.00000000
And 00001010.00000000.00000000.00000000 translates to 10.0.0.0 which is indeed the network address.
Note that you usually don't need a class A network for a home network (do you need more than 255 addresses?) and can thus use 255.255.255.0 as netmask and/or use a class C network (e.g. 192.168.1.0).
Added http://superuser.com/questions which explains IPv4 subnetting in detail. (Question is a copy of the canonical answer on Serverfault).
– Hennes – 2016-07-27T16:33:17.403Over-simplifying a bit: Anything with the same subnet mask can talk to each other directly without going through a router (in fact, a router must NOT be used). Anything that wants to talk to a host with a different subnet mask needs to go through a router (or the IP that is the default gateway) to get to that host. – LawrenceC – 2012-09-16T14:17:50.040
4So essentially the "subnet mask" indicates which part of the IP number are relevant. Since I'm only using the last triplet, I would use 255.255.255.0 to mask out the first three triplets. Thanks for your answers! – Torben Gundtofte-Bruun – 2009-10-13T13:55:49.027
correct. For your private network it doesn't matter though. It only matters if you want to separate different parts of your network. – StampedeXV – 2009-10-13T14:03:25.570
1It doesn't exactly "mask out" any of the octets (in fact it doesn't have to provide an 8-bit boundary at all). It just designates which part of the IP is the network identifier and which part is the host identifier. – MDMarra – 2009-10-13T14:04:05.957