What Is a Subnet? Subnetting Explained for Beginners

A subnet (short for subnetwork) is a logical subdivision of an IP network. Subnetting divides a large network into smaller, more manageable segments. Each subnet functions as its own mini-network with its own range of IP addresses.

Think of it like dividing a large office building into departments. Instead of one giant network where every device can see every other device, subnetting creates separate sections that keep traffic organized and improve security.

For example, a company might divide its network into subnets for different departments: 192.168.1.0/24 for Engineering, 192.168.2.0/24 for Marketing, and 192.168.3.0/24 for Finance. Devices within each subnet can communicate freely, while traffic between subnets goes through a router.

A subnet mask determines which portion of an IP address identifies the network and which portion identifies the individual host (device). It's a 32-bit number that "masks" the network portion of the address.

Common subnet masks:

How it works: The subnet mask is ANDed (bitwise) with the IP address. Bits set to 1 in the mask represent the network portion; bits set to 0 represent the host portion.

For example, with IP 192.168.1.100 and mask 255.255.255.0 (/24):

• Network address: 192.168.1.0 (first 24 bits)
• Host portion: .100 (last 8 bits)
• Broadcast address: 192.168.1.255
• Usable range: 192.168.1.1 to 192.168.1.254

CIDR (Classless Inter-Domain Routing) notation is a compact way to express a subnet mask. Instead of writing 255.255.255.0, you write /24 — the number after the slash indicates how many bits are used for the network portion.

Reading CIDR notation:

• /24 = 256 total IPs, 254 usable (most common for home and small office networks)
• /25 = 128 total IPs, 126 usable
• /26 = 64 total IPs, 62 usable
• /27 = 32 total IPs, 30 usable
• /28 = 16 total IPs, 14 usable
• /30 = 4 total IPs, 2 usable (used for point-to-point links between routers)
• /32 = 1 IP (single host)

Quick formula: Total IPs in a subnet = 2^(32 - prefix length). Usable IPs = Total - 2 (one for network address, one for broadcast).

CIDR replaced the old classful addressing system (Class A, B, C) which wasted huge amounts of address space. With CIDR, you can allocate exactly the number of addresses needed.

Reduced broadcast traffic: Broadcasts (like ARP requests) are contained within a subnet. Without subnetting, every device on the network receives every broadcast, wasting bandwidth.

Improved security: Subnets create boundaries. You can apply firewall rules between subnets — for example, preventing the guest Wi-Fi subnet from accessing the internal server subnet.

Better organization: Assigning different subnets to departments, floors, or device types makes the network easier to manage and troubleshoot.

Efficient IP usage: Instead of wasting a full /24 (254 IPs) on a department with only 10 devices, you can assign a /28 (14 usable IPs) and use the remaining addresses elsewhere.

Performance: Smaller subnets mean less broadcast traffic and less congestion, improving overall network performance.

Suppose you have the network 10.0.0.0/24 (254 usable IPs) and need to divide it into 4 subnets:

You need 2 extra bits to create 4 subnets (2^2 = 4), changing /24 to /26.

Resulting subnets:

Each subnet has 62 usable host addresses. Devices in different subnets need a router to communicate with each other. This is how most business networks are structured.

Most subnetting questions can be answered in a few seconds without binary arithmetic, using two small tables worth memorising.

Powers of two, descending from 256:

/24 = 256    /25 = 128    /26 = 64    /27 = 32
/28 = 16     /29 = 8      /30 = 4     /31 = 2

The "magic number" method. For any prefix, the block size is 256 minus the relevant mask octet, and subnet boundaries fall on multiples of that number.

Take 192.168.1.0/26. The mask is 255.255.255.192, so the magic number is 256 − 192 = 64. Subnets therefore start at 0, 64, 128 and 192:

To find which subnet an arbitrary address belongs to, round down to the nearest multiple of the magic number. 192.168.1.100 with a /26: the multiples are 0, 64, 128 — 100 falls between 64 and 128, so the network is 192.168.1.64, the broadcast is .127, and usable hosts run .65–.126.

Usable host count is 2^(32−prefix) − 2, subtracting the network and broadcast addresses. A /26 gives 64 − 2 = 62.

Two prefixes break that rule deliberately. A /31 (RFC 3021) has no network or broadcast address and provides exactly two usable addresses, which is why it is now standard for point-to-point router links — using a /30 there wastes half the block. A /32 is a single host, used for loopback interfaces and for individual routes.

Subnetting exercises focus on splitting a block. Real network design is about choosing a scheme you will not regret in three years.

Leave room to grow, but not everywhere. The instinct to size every subnet exactly to current host count produces a network that cannot absorb any change. Since private address space is free, use it: a /24 per VLAN is a perfectly good default even for twelve devices, because it keeps arithmetic trivial and leaves headroom.

Make the address encode the location. A scheme where the address tells you where a device is makes troubleshooting dramatically faster. One common pattern using 10.0.0.0/8:

10.<site>.<vlan>.<host>

10.1.10.0/24   Site 1, users
10.1.20.0/24   Site 1, servers
10.1.30.0/24   Site 1, voice
10.1.40.0/24   Site 1, IoT / cameras
10.2.10.0/24   Site 2, users

Anyone reading 10.2.30.45 in a log immediately knows it is a phone at site 2.

Keep subnets summarisable. Allocating site 1 the whole of 10.1.0.0/16 means routers elsewhere carry a single route for the entire site instead of one per VLAN. Contiguous allocation is what makes summarisation possible; scattering subnets randomly forecloses it permanently.

Avoid 192.168.0.0/24 and 192.168.1.0/24 for anything that will ever be reached over a VPN. These are the default ranges on essentially every consumer router, which means a remote worker's home network will collide with your office network and the VPN route will be ambiguous. Choosing something arbitrary from 10.0.0.0/8 avoids a class of support problem entirely.

Reserve ranges by role within each subnet. A convention such as .1–.9 for gateways and infrastructure, .10–.99 for static assignments, .100–.199 for DHCP and .200–.254 for reserved growth makes the network self-documenting.

Variable Length Subnet Masking simply means using different prefix lengths within one network rather than splitting everything evenly. It is how you avoid wasting a /24 on a two-address router link.

Work from largest requirement to smallest. Given 192.168.10.0/24 and requirements of 100 users, 50 servers, 25 devices and four point-to-point links:

192.168.10.0/25    126 hosts   Users        (needs 100)
192.168.10.128/26   62 hosts   Servers      (needs 50)
192.168.10.192/27   30 hosts   Devices      (needs 25)
192.168.10.224/30    2 hosts   P2P link 1
192.168.10.228/30    2 hosts   P2P link 2
192.168.10.232/30    2 hosts   P2P link 3
192.168.10.236/30    2 hosts   P2P link 4
192.168.10.240/28   14 hosts   Reserved

Allocating largest-first matters: each block must start on a boundary that is a multiple of its own size, and working small-to-large fragments the space so that the large blocks no longer fit.

Summarisation is the reverse operation. Four contiguous /24 networks — 10.1.0.0, 10.1.1.0, 10.1.2.0, 10.1.3.0 — can be advertised as a single 10.1.0.0/22. To find the summary, look for the longest prefix common to all the addresses in binary; here the first 22 bits match.

This is not a cosmetic optimisation. Summarisation reduces routing table size, cuts the CPU cost of route recalculation, and — most importantly — contains instability. A link flapping inside a summarised block does not propagate an update to the rest of the network, because the summary route is still valid. On a large network, this is the difference between a local problem and a network-wide reconvergence event.

The same principle operates on the global internet: the more than 950,000 prefixes in the IPv4 routing table would be several times larger without aggregation.

Why can I not use the first and last address in a subnet?

The first identifies the network itself and is what appears in routing tables. The last is the directed broadcast address, which reaches every host on the segment. Neither can be assigned to an interface. The exception is a /31 on a point-to-point link, where RFC 3021 removes both concepts because there are exactly two ends and no need to broadcast.

What is the difference between a subnet mask and CIDR notation?

They express the same information. 255.255.255.0 and /24 both mean the first 24 bits are the network portion. CIDR is more compact and is what routers and modern documentation use; dotted-decimal masks persist in operating system configuration dialogs.

Can two subnets overlap?

They should not, and if they do the behaviour depends on longest-prefix matching — the more specific route wins for addresses it covers. Overlapping subnets on the same layer-2 segment cause hosts to make wrong decisions about whether a destination is local or needs the gateway, producing intermittent connectivity that is very hard to diagnose.

How do I choose between /24 and something smaller?

Broadcast domain size is the real constraint. A /24 holding 254 hosts is comfortable; a /16 holding 65,000 hosts on one segment would drown in broadcast traffic. If a subnet is oversized, the cost is broadcast overhead and a larger blast radius for layer-2 problems, not wasted addresses — in private space, addresses are free.

Does subnetting improve security?

Only in combination with filtering. Splitting a network into subnets creates boundaries where you *can* apply policy; it does not apply any. A router that forwards freely between subnets provides isolation of broadcast traffic and nothing else. The security benefit comes from access control lists at those boundaries.