How does subnet mask work?