255.255.255.255: limited broadcast

255.255.255.255 is the limited broadcast address. A packet sent to it reaches every host on the local link and no further, because RFC 919 and RFC 1122 forbid routers from forwarding it. The same digits also appear as the subnet mask for a single-host /32 route, which is unrelated.

Two standards, two kinds of broadcast

RFC 919, published in 1984, defined broadcasting on internet networks. RFC 922 extended it to subnets. Between them they describe two forms.

Limited broadcast uses 255.255.255.255. It goes to every host on the sender’s own link. Routers must not forward it, so it cannot be used to reach another subnet and cannot be used from the internet.

Directed broadcast uses the all-ones host portion of a specific subnet, such as 192.168.1.255 for 192.168.1.0/24 or 10.255.255.255 for 10.0.0.0/8. A router could historically forward these, which is what made smurf amplification attacks possible. RFC 2644 changed the default in 1999 so routers drop directed broadcasts unless explicitly configured otherwise.

Work out the directed broadcast address for any prefix in /subnet-calculator.

When you see it

• In DHCP traffic. A client with no address sends DHCPDISCOVER from 0.0.0.0 to 255.255.255.255, and the server’s offer often comes back the same way.
• In Wake on LAN. The magic packet is normally a UDP broadcast to 255.255.255.255 on port 9, which is why WoL works on the local network and needs port forwarding or a directed broadcast to work from outside.
• In packet captures, as a destination for older service discovery and network game lobby announcements.
• As a subnet mask in routing tables, static route commands, and VPN configurations, where 255.255.255.255 means /32.
• In firewall logs, where broadcast noise from a neighbouring device fills the deny counter.

The mask that is not an address

route add 10.1.2.3 mask 255.255.255.255 192.168.1.254 on Windows adds a host route. Here the digits describe how many bits identify the network, all 32 of them, so the route matches one address exactly. Nothing is being broadcast.

The overlap confuses people reading a configuration file. Read the field name: a netmask or mask field takes a mask, a destination or remote field takes an address. Convert between mask, prefix length, and wildcard forms in /ip-converter.

Why broadcast has faded

Every host on the link has to process a broadcast frame, even the ones with no interest in it, which costs CPU on every device and airtime on Wi-Fi. IPv6 removed broadcast altogether and replaced it with multicast groups such as 224.0.0.1’s IPv6 counterpart ff02::1, so only the machines that joined a group are interrupted. IPv4 protocols have been migrating the same way for years, with mDNS on 224.0.0.251 replacing older broadcast discovery.

What it is not

255.255.255.255 is not a device address, and no host is ever assigned it. It is not reachable from the internet, so nothing can broadcast to your LAN from outside. It is also not the end of any address range in a useful sense: the last usable unicast address in IPv4 space depends on the block, and 255.255.255.0/24 as a whole is reserved. Seeing 255.255.255.255 in a log as a destination means local link traffic, not an attack from outside.