Most automation techs do not need to be network engineers, but they do need to lay out a control network where every PLC, RTU, and gateway can reach the SCADA host - and that requires understanding just enough about subnet masks. The subnet mask decides which devices are on the same local network and which need a router to reach. This guide covers the practical minimum of subnet masks and CIDR notation, why two devices on different subnets cannot talk directly, and how to plan address ranges at a facility so everything reaches the SCADA host.
Subnet Mask and CIDR for SCADA Networks in one line: A subnet mask defines which portion of an IP address identifies the network and which portion identifies the individual device, and thereby which devices share a local subnet. A common mask is 255.255.255.0, written in CIDR notation as /24, meaning the first three of the four address numbers identify the network and the last identifies the host, giving up to 254 usable device addresses. Two devices with matching network portions can talk directly; if their network portions differ they are on different subnets and need a router to communicate.
An IPv4 address is four numbers separated by dots, such as 192.168.10.20. The subnet mask splits that address into a network part and a host part. With a mask of 255.255.255.0, the three positions shown as 255 lock down the network portion and the position shown as 0 is free for host numbering - so in 192.168.10.20 the network is 192.168.10 and the host is 20. Every device whose address begins 192.168.10 is on the same subnet, and the last number distinguishes the individual devices.
CIDR notation is a shorthand for the same thing. The mask 255.255.255.0 is written as /24 because it fixes 24 of the address's 32 bits as the network portion, leaving 8 bits for hosts. Those 8 host bits give 256 combinations, but two are reserved - one identifies the subnet itself and one is the broadcast address - leaving 254 usable addresses for actual devices. A /24 is the workhorse of small control networks precisely because 254 devices is plenty for most facilities and the boundary falls neatly on the dots, making it easy to read.
Other mask sizes shift that boundary. A /16, mask 255.255.0.0, fixes only the first two numbers as the network and leaves the last two for hosts, giving a much larger range; a /25 or smaller carves a /24 into smaller pieces with fewer hosts each. For most automation work the /24 is the default worth internalizing, with the understanding that a smaller number after the slash means a bigger network with more hosts, and a larger number means a smaller one. The key habit is being able to look at an address and its mask and immediately see which part is the network.
When one device wants to send to another, it first checks whether the destination is on its own subnet by comparing network portions under the mask. If the destination shares its network portion, the device delivers the packet directly on the local network. If the destination's network portion differs, the device knows the target is elsewhere and hands the packet to a router - its default gateway - to forward off the local subnet. This decision happens for every packet and is driven entirely by the mask.
This is why two devices with mismatched subnets cannot communicate directly even if they are plugged into the same switch. Suppose a PLC is set to 192.168.10.5 with a /24 mask and a SCADA host is at 192.168.20.5 with a /24 mask. Under their masks the PLC's network is 192.168.10 and the host's is 192.168.20 - different networks - so each considers the other off-subnet and expects a router to bridge them. If there is no router between those subnets, or the devices are not told where it is, the traffic simply has nowhere to go and the two never connect, regardless of the physical wiring.
The practical lesson is that being on the same wire is not the same as being on the same subnet. Cabling and switching move packets around the local network, but the subnet mask defines the logical boundary of what counts as local. Cross that boundary and you need routing. A great many control-network faults trace back to a device given an address in the wrong subnet, or the right subnet but the wrong mask, so that it silently believes its intended peer is unreachable local traffic or, worse, tries to reach a local peer through a router that has no path back.
A workable facility plan starts by choosing a private address range - the 192.168 and 10.x families are reserved for private use and are the usual choice for control networks - and a mask, commonly /24, that comfortably holds the devices at the site. Within that /24 it helps to reserve blocks by role: perhaps a range for PLCs, a range for RTUs, a range for gateways and network gear, and a fixed address for the SCADA host or the gateway that reaches it. Fixed, documented addresses matter in control systems because devices are configured to talk to specific peers, not discovered dynamically.
The cardinal rule is consistency of subnet and mask across everything that must talk locally. Every device that needs to reach the SCADA host directly should sit in the same subnet with the same mask, so none of them mistakenly treats the host as off-subnet. Where devices genuinely belong on separate subnets - perhaps a segmented network for security or a remote pad behind a cellular router - a router and correct default gateways must connect those subnets, and each device's address, mask, and gateway must be set so its path to the SCADA host is complete. An address plan is only correct when you can trace, for every device, how its packets reach the host.
For a cloud SCADA such as Merobix, the field-network layout is what determines whether local devices can reach the on-site gateway or router that carries their data upward. The PLCs and RTUs at a facility typically share a local subnet with the cellular or edge router that forwards their traffic, and that router is their path to Merobix. Getting the masks and ranges right so every field device sits in the correct subnet with a clear route to that router is the foundation everything else rests on - if a device is misplaced in the wrong subnet, it can be perfectly powered and wired yet never hand its data to the router, and therefore never appear in the cloud at all.
They are two ways of writing the same subnet mask. 255.255.255.0 is the dotted-decimal form and /24 is CIDR notation, meaning 24 of the address's 32 bits identify the network. Both indicate that the first three numbers of an IPv4 address are the network portion and the last number identifies the individual device, giving up to 254 usable host addresses.
Because each device decides whether a destination is local by comparing network portions under its subnet mask. If the network portions differ, each considers the other off-subnet and expects a router to forward the traffic. Without a router between the two subnets, and correct gateway settings on the devices, the packets have nowhere to go - even if both devices are on the same physical switch.
A /24 has 8 host bits, giving 256 addresses, but two are reserved - one for the subnet's network address and one for the broadcast address - leaving 254 usable for devices. That is ample for most facilities. If a site needs more, a larger network such as a /16 provides many more host addresses, at the cost of a broader broadcast domain.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.