By Uniqcli Team
A subnet, short for subnetwork, is a logical subdivision of a larger IP network. Subnetting splits one block of IP addresses into several smaller, self-contained networks, each with its own range of addresses and its own boundary. Every IP address carries two parts — a network portion that identifies which subnet it belongs to and a host portion that identifies the individual device — and a value called the subnet mask marks where one ends and the other begins. Devices that share a subnet can reach each other directly; traffic to any other subnet must pass through a router.
Subnetting exists because a single flat network does not scale well. As the number of connected devices grows, so do broadcast traffic, address sprawl, and the blast radius of a security incident. Dividing the address space into subnets keeps each segment small and predictable, lets an organization assign address blocks by site, floor, or function, and — because every subnet boundary is a routing boundary — creates natural places to apply firewall rules and access controls. Subnetting is a foundational skill in almost every enterprise, campus, and data-center network.
How does a subnet work?
A subnet is defined by combining an IP address with a subnet mask. The mask is a string of bits in which the leading 1s mark the network-and-subnet portion of the address and the trailing 0s mark the host portion. When a device prepares to send a packet, it performs a bitwise AND of its own address and mask against the destination address to decide whether that destination sits inside its own subnet or somewhere else on the network. That single comparison governs how the device forwards nearly every packet it sends.
If the destination is in the same subnet, the device delivers the frame directly over the local link using the destination's hardware (MAC) address, resolved through ARP — no router is involved. If the destination is in a different subnet, the device cannot reach it directly; instead it hands the packet to its default gateway, the router interface that connects the subnet to the wider network. The router then forwards the packet toward the destination subnet. This is why a subnet boundary is also a routing boundary: crossing it always means passing through a Layer 3 device.
What is a subnet mask and CIDR notation?
The subnet mask sets the dividing line between the network and host portions of an address. A common IPv4 mask is 255.255.255.0, which in binary is twenty-four 1s followed by eight 0s — meaning the first 24 bits identify the network and the last 8 identify the host. Because those 1-bits are always contiguous and left-aligned, the mask can be written far more compactly as a slash followed by the count of network bits: 255.255.255.0 becomes /24. This shorthand is called CIDR, or Classless Inter-Domain Routing.
CIDR replaced the older "classful" system, which locked networks into fixed sizes of roughly 16 million, 65,000, or 256 addresses (the former Class A, B, and C). With CIDR, the prefix length can be any value, so a network is sized to fit its actual need — a /30 for a two-device point-to-point link, a /24 for a typical office segment, a /16 for a large campus. A shorter prefix (a smaller number after the slash) makes the subnet larger; a longer prefix makes it smaller. Every subnet is fully described by its network address and its prefix length together.
How many hosts can a subnet hold?
The size of a subnet is set entirely by how many bits are left for the host portion. In IPv4, which uses 32-bit addresses, the number of host bits equals 32 minus the prefix length, and the number of addresses is 2 raised to that power. A /24 therefore has 8 host bits and 256 total addresses; a /26 has 6 host bits and 64 addresses. In every ordinary subnet, two of those addresses are reserved and cannot be assigned to a device.
The two reserved values are the network address, in which all host bits are 0 and which names the subnet itself, and the broadcast address, in which all host bits are 1 and which reaches every device on the subnet at once. Subtracting them gives the usable host count: a /24 supports 254 hosts, while a /30 supports just 2 — the standard size for a link between two routers. (A /31, defined for point-to-point links, is a special case that puts both addresses to use.) Remember that the default gateway also consumes one usable address, so a /24 office segment really has 253 left for endpoints.
How is a subnet different from a VLAN?
Subnets and VLANs are frequently configured together and are easy to confuse, but they operate at different layers. A VLAN is a Layer 2 construct: it divides a physical switch into separate broadcast domains so that traffic in one group stays isolated from another at the Ethernet level. A subnet is a Layer 3 construct: it divides the IP address space so that routing can distinguish one group of devices from another. One is about switching frames; the other is about addressing and routing packets.
In practice most networks map the two one to one — each VLAN is assigned a single IP subnet — so the boundaries line up and a device's VLAN membership determines its subnet. But they remain independent ideas. You can have a subnet with no VLAN, as on a simple routed link, or, less commonly, more than one subnet sharing a VLAN. The distinction matters when you segment a network for security, because isolation is only complete when both the Layer 2 broadcast domain and the Layer 3 routing boundary enforce the same policy.
How do you plan subnets for an enterprise or agency network?
Sound subnet design starts with an address plan. Most internal networks draw from the private IPv4 ranges reserved in RFC 1918 — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — and carve them into blocks allocated by site, building, or function, leaving headroom in each block for growth. Using variable-length subnet masks, a large allocation can be divided unevenly: a big /22 for a user population, a handful of /30s for router links, a /26 for a server row. Keeping the scheme consistent and documented avoids the overlapping ranges that break site-to-site VPNs and complicate mergers.
Segmentation is also a security decision. Because every subnet boundary is a routing boundary, it is the natural place to enforce firewall rules and access-control lists — separating user devices, servers, management interfaces, and untrusted or IoT equipment into their own subnets is a foundation of least-privilege and zero-trust designs, and it contains the lateral movement an attacker relies on. Delivering that segmentation takes managed switches and Layer 3-capable routers or switches that can route between subnets and apply policy at the boundary; on federal orders, each device should be screened for country of origin and NDAA §889 status before it ships.
Key takeaways
- A subnet is a logical subdivision of a larger IP network, created by splitting one block of addresses into smaller, self-contained segments.
- Every IP address has a network portion and a host portion; the subnet mask marks the boundary between the two.
- CIDR notation writes the mask as a prefix length — /24 means 24 network bits — and lets a subnet be sized to fit its actual need.
- Usable hosts equal 2 to the power of the host bits, minus two for the reserved network and broadcast addresses; a /24 holds 254 hosts.
- Devices in the same subnet communicate directly, but reaching another subnet always requires a router, so every subnet boundary is also a routing boundary.
- A subnet is a Layer 3 addressing boundary while a VLAN is a Layer 2 broadcast domain; paired together, they make network segmentation an effective security control.
Shop it at Uniqcli
Frequently asked
- What is the difference between a subnet and a subnet mask?
- A subnet is the network segment itself — a group of IP addresses that behave as one small network. The subnet mask is the value that defines that segment by marking which bits of an address are the network portion and which are the host portion. In other words, the mask is the rule, and the subnet is the result of applying it. A subnet is usually written as its network address plus a prefix, such as 192.168.10.0/24, where the /24 is the mask expressed in CIDR shorthand.
- How many usable IP addresses are in a /24 subnet?
- A /24 subnet has 256 total addresses but 254 usable ones. The count comes from the 8 host bits — 32 address bits minus the 24-bit prefix — which give 2 to the 8th, or 256, combinations. Two of those are always reserved: the all-zeros host is the network address that names the subnet, and the all-ones host is the broadcast address. That leaves 254 for devices, and because one is normally the router serving as the default gateway, about 253 remain for endpoints.
- Do two devices on different subnets need a router to communicate?
- Yes. Devices in the same subnet exchange traffic directly over the local link using hardware (MAC) addresses, with no router involved. When a device determines that a destination lies in a different subnet, it cannot deliver the packet itself; it sends the packet to its default gateway, and the router forwards it toward the destination. This holds even if both devices are plugged into the same physical switch — without a routing device to move traffic between the two subnets, they cannot reach each other.
- Is a subnet the same thing as a VLAN?
- No, though they are closely related and often paired. A VLAN operates at Layer 2 and divides a switch into separate broadcast domains. A subnet operates at Layer 3 and divides the IP address space for routing. Most networks assign one subnet to each VLAN so the boundaries align, but they are distinct concepts: the VLAN isolates Ethernet frames while the subnet organizes IP addresses and routing. For full isolation between groups of devices, both the VLAN and the subnet boundary should enforce the same segmentation policy.