Subnetting

Subnetting is the practice of dividing one IP network into smaller networks, called subnets or subnetworks, by borrowing bits from the host part of an address and adding them to the network prefix. In Internet addressing, it is the basic technique that turns a single address allocation into separate, routable segments for departments, server tiers, sites or security zones.

Every subnet receives its own address range, prefix length and gateway, and traffic between subnets must pass through a router or Layer 3 switch. Subnetting applies to both IPv4 and IPv6, but its purpose differs: in IPv4 it is largely about conserving scarce addresses, while in IPv6 it is about structure and routing hierarchy, since address space is abundant.

How subnetting splits an address

An IPv4 address has 32 bits, divided into a network portion and a host portion. The boundary is given by the prefix length in CIDR notation, such as /24, or by the equivalent subnet mask, such as 255.255.255.0. Subnetting moves this boundary to the right, so the network portion grows and each resulting subnet holds fewer hosts.

Borrowing n bits creates 2^n subnets, and the remaining h host bits give 2^h addresses per subnet. In traditional IPv4 subnets, two addresses are reserved: the all-zeros network address and the all-ones broadcast address, so the usable count is 2^h minus 2.

The table below shows how a /24 network divides as the prefix becomes longer.

The /31 prefix is a defined exception: RFC 3021 allows both addresses to be used on point-to-point links, because a link with only two endpoints needs no broadcast address. A /32 identifies a single host and is common for loopback and router identifiers.

Hosts decide whether a destination is local by applying a bitwise AND with the mask. For the address 192.168.10.77/27, the block size is 32, so the host belongs to the subnet 192.168.10.64/27, whose broadcast address is 192.168.10.95 and whose usable range runs from .65 to .94. Any destination outside that range is sent to the default gateway.

Fixed-length and variable-length subnetting

Early subnetting used fixed-length subnet masks, where every subnet of a network had the same size. Variable-length subnet masking (VLSM) removed this restriction, so a planner can assign a /26 to a large office floor, a /28 to a server rack and /31 or /30 prefixes to router links, all carved from one block without wasting addresses.

Allocation order matters with VLSM. The usual method is to assign the largest subnets first and place smaller ones in the remaining space, which keeps subnets aligned on their natural boundaries and leaves contiguous blocks free for later growth.

Subnetting compared with CIDR and supernetting

Subnetting and CIDR are two views of the same prefix arithmetic. Subnetting lengthens the prefix to divide a block, whereas route aggregation, or supernetting, shortens the prefix to summarize many contiguous networks into one routing entry. CIDR is the notation and the classless model that makes both possible.

Subnetting is also distinct from VLANs and from NAT. A VLAN separates traffic at Layer 2, a subnet separates addressing at Layer 3, and in typical designs each VLAN carries exactly one subnet. NAT translates addresses between networks and does not create subnets, although it often connects private IP subnets to a public address.

Planning subnets in practice

Good subnet plans start from requirements, not from addresses: number of hosts per segment, expected growth, security zones and routing boundaries. A common rule is to size each subnet for at least double the current host count, since renumbering a live subnet later is disruptive.

In IPv6, segment prefixes other than /64 break stateless address autoconfiguration on most systems. Sites typically receive a /48 or /56, which provides 65,536 or 256 /64 subnets, so planning focuses on a readable hierarchy, for example encoding site and function in the subnet bits.

Common subnetting mistakes

Subnetting errors usually show up as intermittent reachability problems, because hosts that disagree about the subnet boundary may still talk to some neighbors directly and to others only through the gateway.

• Mismatched masks on hosts in the same segment, causing one-way or partial connectivity.
• Overlapping subnets between sites, which become visible only when the sites are connected by VPN.
• Assigning the network or broadcast address to a host on a /30 or larger subnet.
• Using common private ranges such as 192.168.1.0/24 for corporate networks, which collide with home networks of remote users.
• Undersizing subnets for DHCP pools, leading to address exhaustion when devices multiply.

An IP address management (IPAM) register, even a disciplined spreadsheet, prevents most of these mistakes by recording every subnet, its purpose, its gateway and its reserved ranges before configuration begins.

In everyday language

Subnetting is like dividing a large office building into floors and rooms. The building has one street address. Inside, each floor gets its own range of room numbers. People on the same floor can walk to each other directly. To reach another floor, they must take the elevator, which in a network is the router.

Splitting the building this way keeps things organized and safer. A noisy floor does not disturb the others. Access to sensitive rooms can be controlled at the stairs. Each floor also gets only as many room numbers as it needs, so few numbers are wasted.

Seen in the real world

A school receives the private block 10.20.0.0/22 for its new campus network, giving 1,024 addresses. The network administrator plans with VLSM: 10.20.0.0/23 for student devices with 510 usable addresses, 10.20.2.0/24 for staff laptops and phones, 10.20.3.0/26 for servers, 10.20.3.64/27 for printers and cameras, and several /31 links between the core switch and the firewall.

Each subnet sits in its own VLAN, and the firewall applies rules between subnets, so student devices cannot reach the management interfaces of cameras or servers. When the school later adds a second building, the plan leaves 10.20.3.128/25 free for its staff network. The design keeps broadcast traffic small, separates sensitive systems and still uses one compact address block.