If a bit in those 4 bytes is 1 that means that the same bit in the IP address is part of what defines the network whilst the bits that are 0 are bits that can change in the IP address and that machine will still be part of that sub-network.

So a mask of 255.255.252.0 (notice the 3rd byte) on a network with a prefix 192.168.0.0 means that 192.168.0.20 is in that sub-network AND 192.168.2.20 is part of that sub-network too, because the two lowest bits of the 3rd byte in that mask are 0, meaning that IP address where those bits vary are still in the same sub-network (i.e. the ranges 192.168.0.XXX, 192.168.1.XXX, 192.168.2.XXX and 192.168.3.XXX are all in the same sub-network).

If instead the sub-network prefix was the same 192.168.0.0 but with a mask of 255.255.255.0 (the most common case you find in home internal networks) then 192.168.2.20 would NOT be part of the same sub-network as 192.168.0.20

You probably also see now why a network mask is needed alongside the network prefix - in both examples above 192.168.0.0 is the network prefix, but without the network mask you don't know which 0 bits in that network code can be changed to make an IP address still in the same sub-network.

Note that you can change the mask to make the sub-network smaller as well as to make them bigger: for example 192.168.0.0/255.255.255.223 is a perfectly valid subnetwork that fits 30 machines.

See chronicledmonocle@lemmy.world 's post for a full explanation.