Subnetting is the practice of dividing a single IP network into multiple smaller networks called subnets. It controls how IP addresses are allocated, how traffic is routed, and which devices can communicate directly without going through a router.
TL;DR — Subnetting splits a large IP address block into smaller segments. Each subnet has its own range of IP addresses, a subnet mask that defines the split between network and host portions, and a router as the gateway to other subnets. CIDR notation (e.g., 192.168.1.0/24) is the standard way to express a subnet. A /24 subnet provides 254 usable host addresses. Subnetting improves security by isolating traffic, reduces broadcast domain size, and makes IP address allocation more efficient.
Why subnetting exists
Without subnetting, every device on a network would receive every broadcast packet sent by any other device. A flat network with 5,000 devices generates massive broadcast traffic that degrades performance for everyone.
Subnetting solves this by creating smaller broadcast domains. Traffic within a subnet stays local. Traffic between subnets must pass through a router, which filters and controls what crosses the boundary.
Three practical reasons networks use subnetting:
- Security isolation — separate production servers from development environments, or guest Wi-Fi from corporate systems
- Performance — smaller broadcast domains mean less unnecessary traffic on each segment
- IP address efficiency — allocate only as many addresses as each segment needs instead of wasting a large block on a small department
Subnet masks explained
A subnet mask is a 32-bit number that defines which portion of an IP address identifies the network and which portion identifies the host.
Written in dotted decimal, the most common subnet masks are:
| Subnet mask | CIDR | Network bits | Host bits | Usable hosts |
|---|---|---|---|---|
| 255.0.0.0 | /8 | 8 | 24 | 16,777,214 |
| 255.255.0.0 | /16 | 16 | 16 | 65,534 |
| 255.255.255.0 | /24 | 24 | 8 | 254 |
| 255.255.255.128 | /25 | 25 | 7 | 126 |
| 255.255.255.192 | /26 | 26 | 6 | 62 |
| 255.255.255.224 | /27 | 27 | 5 | 30 |
| 255.255.255.240 | /28 | 28 | 4 | 14 |
| 255.255.255.252 | /30 | 30 | 2 | 2 |
The subnet mask works by performing a bitwise AND operation between the IP address and the mask. The result is the network address.
Example: IP 192.168.10.45 with mask 255.255.255.0 (/24)
- Network address:
192.168.10.0 - Broadcast address:
192.168.10.255 - Usable hosts:
192.168.10.1through192.168.10.254(254 addresses)
CIDR notation
CIDR (Classless Inter-Domain Routing) is the standard way to express an IP address and its subnet mask together. It replaces the older classful system (Class A, B, C) that wasted large blocks of addresses.
Format: IP address / prefix length
The prefix length is the number of bits used for the network portion.
| CIDR | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /28 | 255.255.255.240 | 16 | 14 |
| /30 | 255.255.255.252 | 4 | 2 |
| /32 | 255.255.255.255 | 1 | 1 (single host) |
The formula for usable hosts in any subnet: 2^(host bits) - 2
The two reserved addresses in every subnet are the network address (first address) and the broadcast address (last address).
How to calculate a subnet
Given: Network 192.168.5.0/24, need to create 4 equal subnets.
Step 1: Determine how many bits to borrow. To create 4 subnets, borrow 2 bits (2² = 4).
Step 2: New prefix length = 24 + 2 = /26
Step 3: Each /26 subnet has 64 addresses (2^6), with 62 usable hosts.
Step 4: List the subnets:
| Subnet | Network address | Usable range | Broadcast |
|---|---|---|---|
| 1 | 192.168.5.0/26 | 192.168.5.1 – 192.168.5.62 | 192.168.5.63 |
| 2 | 192.168.5.64/26 | 192.168.5.65 – 192.168.5.126 | 192.168.5.127 |
| 3 | 192.168.5.128/26 | 192.168.5.129 – 192.168.5.190 | 192.168.5.191 |
| 4 | 192.168.5.192/26 | 192.168.5.193 – 192.168.5.254 | 192.168.5.255 |
Variable Length Subnet Masking (VLSM)
VLSM allows different subnets within the same network to use different prefix lengths. This eliminates address waste when different segments have different size requirements.
Example: A company has 10.0.0.0/24 and needs:
- Data center: 100 hosts → use /25 (126 usable)
- Office floor: 50 hosts → use /26 (62 usable)
- Point-to-point link: 2 hosts → use /30 (2 usable)
VLSM lets all three coexist within the same /24 block without wasting addresses.
Subnetting and routing
Routers use subnet information to make forwarding decisions. Each router interface is assigned an IP address within a specific subnet and acts as the gateway for that subnet.
When a device sends traffic to an IP address outside its own subnet:
- The device determines the destination is not local (by comparing the destination IP against its own subnet mask)
- The packet is sent to the default gateway (the router interface for that subnet)
- The router looks up the destination subnet in its routing table
- The packet is forwarded to the next hop toward the destination
Common subnetting in practice
| Use case | Typical subnet | Reason |
|---|---|---|
| Point-to-point router link | /30 | Only 2 hosts needed |
| Server VLAN | /26 or /27 | Enough for servers, isolated from clients |
| Office floor | /24 | Up to 254 devices |
| Large campus | /16 | Thousands of devices, subdivided further |
| Cloud VPC | /16 or /8 | Large private space, further subnetted by service |
| Loopback interfaces | /32 | Single-host address for routers |
Frequently asked questions
What is subnetting? Subnetting is the process of dividing a single IP network into multiple smaller networks called subnets. Each subnet has its own IP address range defined by a subnet mask. Subnetting improves network performance, security, and IP address efficiency by creating smaller broadcast domains and isolating traffic.
What is a subnet mask? A subnet mask is a 32-bit number that defines which portion of an IP address represents the network and which represents the host. Written in dotted decimal (e.g., 255.255.255.0) or CIDR notation (/24), the subnet mask tells routers and devices how to interpret an IP address. Bits set to 1 identify the network portion; bits set to 0 identify the host portion.
What is CIDR notation? CIDR (Classless Inter-Domain Routing) notation expresses an IP address and its subnet prefix length together, separated by a slash. For example, 192.168.1.0/24 means the first 24 bits are the network address and the remaining 8 bits are for host addresses, providing 254 usable hosts. CIDR replaced the older classful system to allow more flexible address allocation.
How many hosts can a /24 subnet hold? A /24 subnet has 8 host bits, providing 2^8 = 256 total addresses. Two are reserved: the network address (first) and the broadcast address (last). This leaves 254 usable host addresses.
What is the difference between a /24 and a /16 subnet? A /24 subnet provides 254 usable host addresses and is the most common size for a single office or VLAN. A /16 subnet provides 65,534 usable host addresses and is typically used for large networks or cloud VPCs that are further subdivided into smaller subnets.
Why are two addresses reserved in every subnet? Every subnet reserves its first address as the network address (identifies the subnet itself) and its last address as the broadcast address (used to send packets to all hosts on the subnet simultaneously). Neither can be assigned to a device.
What is VLSM? Variable Length Subnet Masking (VLSM) allows a network to use different subnet sizes within the same address space. Instead of dividing a network into equal subnets, VLSM lets engineers allocate exactly the right number of addresses to each segment — a /30 for a two-device link, a /25 for a larger office — minimizing wasted addresses.
How does subnetting improve security? Subnetting creates isolated network segments. Traffic between subnets must pass through a router or firewall, which can enforce access control rules. This means a compromised device in one subnet cannot directly reach devices in another subnet without passing through a controlled boundary, limiting lateral movement in a security incident.