Subnet mask
A subnet mask separates the network part of an IPv4 address from the host part; 255.255.255.0 is the same thing as a /24 prefix.
What a subnet mask is
An IPv4 address is 32 bits, and a subnet mask is a second 32-bit value that marks which of those bits identify the network and which identify the host within it. In binary, the mask is a run of ones followed by a run of zeros. Written in dotted form, 255.255.255.0 is 24 ones and 8 zeros: the first three octets of the address are the network, the last octet is the host. 255.255.0.0 is 16 ones; 255.255.255.128 is 25 ones.
The mask and CIDR notation express the same thing. 192.168.1.0 with mask 255.255.255.0 is 192.168.1.0/24. The slash form is shorter and is what routing tables and registries use; the dotted form is what you still type into many network settings dialogs.
How it is used
A device compares its own address with a destination address using the mask. If the network bits match, the destination is on the local network and the device sends the packet directly. If they differ, the packet goes to the default gateway. A wrong mask is the classic cause of a machine that can reach some neighbors and not others.
Within a subnet, the first address (all host bits zero) is the network address and the last (all host bits one) is the broadcast address; neither is assigned to a device. A /24 therefore has 254 usable addresses, not 256. Point-to-point links use /31 with both addresses usable, and /32 denotes a single host.
Why it matters
For anyone reading lookup results, the mask tells you how big the block containing an address is. A proxy address in a /29 registered to a small business looks different from one in a /16 belonging to a national ISP. For anyone configuring a network, VPN, or proxy server, the mask decides which traffic stays local and which goes through the tunnel, and a mistake here is one of the ways split-tunnel leaks happen.
How to check
The subnet calculator converts between dotted masks and prefix lengths and shows the network address, broadcast address, wildcard mask, first and last usable host, and host count for any block. IP lookup shows the announced prefix that contains an address, which is the mask the internet uses to route to it.
A common misconception
Subnet masks are an IPv4 concept. IPv6 uses prefix lengths only, written as /64 and so on; there is no dotted mask to type.