First, you must understand some binary math. Given the binary '1011' with the mask '0010' what happens when you AND these two numbers together?
Your result is '0010' -- everywhere there is a one-bit in your number with a corresponding one-bit in your mask, your result will contain a one-bit as well.
When applied to an IP address, say '172.25.30.21' and the net mask of
'255.255.0.0' your mask has one's on the left end giving a result of
'172.25.0.0' [REMEMBER -- an IP address is four decimal numbers representing four, 8-bit values, separated by periods.]
What the netmask actually says is
Given any IP address, apply the netmask (using AND) and which ever bits remain tell you the "network" portion of the address. The other IP address bits -- the ones that went away -- tell you which host within that network.
I hope that this helps. Check out the O'Reilly book on network routing for more than most people ever want to know.
Cheers,
~~~ 8d;-Dan