Linux

I'm not sure how useful this is, but it helped me understand.

The subnet mast is the count of the bits from the front that matter.

This is useful for switches and network equipment that only have to look at that much if the packet and route it quickly.

So a 10.0.0.0/8 address the switch only looks at the first 8 binary digits (also called an octet) and routes it based on that.

This also works for non multiple of 8 masks, as it's an operation done on a binary level (it's a mask using a binary AND so only bits that are true and.the mask can be matter)

10.192.0.0/10

IP: 00001010.11000000.00000000.00000000

Mask: 11111111.11 000000.00000000.00000000

So 10.192.0.1 and 10.192.255.255 look the same with their mask on

1: 00001010.11 000000.00000000.00000001

255: 00001010.11 111111.11111111.11111111

Mask: 11111111.11 000000.00000000.00000000

Result for both is: 00001010.11 000000.00000000.00000000

You might want to use either a /24 address or a /32 address in a firewall rule, depending on what you're trying to do. The difference is that the /24 one refers to a set of IPs, while the /32 one applies to only one IP.

Say you're adding a firewall rule like iptables -A - s 192.168.1.123/32 - j ACCEPT. This will accept all traffic with the source IP 192.168.1.123. If instead you use iptables -A - s 192.168.1.123/24 - j ACCEPT, you'll accept all traffic with a source IP in the 192.168.1.123/24 subnet, which is all the IPs between 192.168.1.0 & 192.168.1.255.

In the case of your WiFi IP, the subnet does something different. It tells you which IP addresses you should expect to be able to contact directly, and which you need to contact via a router. 192.168.1.214/24 says that all the IPs between 192.168.1.0 & 192.168.1.255 can be reached directly, whereas IPs outside that range need to be sent to a router.

ip route will show you the routes a device knows about. It'll look something like this (simplifying a bit):

default via 192.168.1.1
192.168.1.0/24 dev wlan0 src 192.168.1.214

The first line is the default route, which is used when no more specific route exists. It says that you talk to these IPs by sending your traffic to 192.168.1.1 (your wifi router) and it'll send it on from there.

The second one says that for IPs in the 192.168.1.0/24, you directly talk to them using your wlan0 interface

Iproute2 definitely does write things a bit compact. ip address show and shorthands state the routed local address space (192.168.1.x/24) and the actual /32 address (192.168.1.214) you are assigned as one unit. Additionally, it shows the broadcast address for the space. Ironically, ip route show may genuinely give you less confusing information, clearly splitting the actual route and showing your straight IPv4 address as src.

Typically in firewalling, you'd use /32 to target a singular IPv4 host. This is analogous to using /128 for IPv6 hosts. You can absolutely use /24, /16, /8, or any other mask really if you need to target a range of IP addresses for a rule to apply to. Technically, /32 is a range itself, just with a size of 1. There are CIDR calculators available to play around and see what different CIDR masks actually target.