What a subnet is
A subnet is a smaller slice of a larger block of network addresses. Every device on a network needs an address, and rather than keeping all of them in one flat pool, organizations usually divide the pool into groups. Each group is a subnet. Devices in the same subnet can talk to each other directly; traffic between subnets goes through a router.
Think of a street of numbered houses. The whole street is the network, and a subnet is like a block of houses within it. Mail between houses on the same block stays local, while mail to another block goes through a sorting point.
Reading an IPv4 address
The most familiar addresses are IPv4, written as four numbers from 0 to 255 separated by dots, such as 192.168.1.25. Each number represents eight bits, so the whole address is 32 bits long.
An address has two parts: a network portion, which identifies the subnet, and a host portion, which identifies the device within it. The subnet mask tells you where the line between them falls.
What the mask does
A subnet mask looks like an address too, for example 255.255.255.0. In binary, it is a run of ones followed by a run of zeros. The ones mark the network portion; the zeros mark the host portion. With 255.255.255.0, the first 24 bits are the network and the last 8 bits are for hosts.
Because writing the full mask is clumsy, people use slash notation, which counts the ones. So 255.255.255.0 is written /24, and 192.168.1.0/24 describes the whole range from 192.168.1.0 to 192.168.1.255.
How many devices fit
If h bits are left for hosts, the subnet holds 2 to the power h addresses. Two of them are normally reserved: the first identifies the network itself, and the last is the broadcast address. That leaves 2^h minus 2 usable addresses.
| Notation | Mask | Total addresses | Usable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /30 | 255.255.255.252 | 4 | 2 |
A bigger slash number means a smaller subnet. This tends to feel backward at first, but it follows from the count of network bits.
A worked example
Suppose an office has been given 192.168.1.0/24 and wants four separate groups: staff, guests, printers and servers. Each needs fewer than 60 devices. Borrowing two extra bits for the network turns /24 into four /26 subnets of 64 addresses each:
- 192.168.1.0/26 covers 192.168.1.0 to 192.168.1.63
- 192.168.1.64/26 covers 192.168.1.64 to 192.168.1.127
- 192.168.1.128/26 covers 192.168.1.128 to 192.168.1.191
- 192.168.1.192/26 covers 192.168.1.192 to 192.168.1.255
Four blocks of 64 add up to the original 256, so nothing is lost or overlapping. Each block has 62 usable addresses, enough for the stated need.
Private address ranges
Some ranges are reserved for internal use and are not routed on the public internet. These are:
- 10.0.0.0/8
- 172.16.0.0/12 (172.16.0.0 through 172.31.255.255)
- 192.168.0.0/16
Home and office networks almost always use these. Many devices share a single public address through address translation on the router, which is why two different organizations can both use 192.168.1.x without conflict.
Why divide a network at all
Several practical reasons tend to come up:
- Traffic control. Broadcast messages reach every device in a subnet. Smaller subnets keep that noise contained.
- Security. Placing guests, cameras or equipment in their own subnet lets firewall rules decide what each group may reach. This is a common ingredient of a secure network.
- Organization. When addresses map to purposes, logs and diagrams become easier to read. A glance at an address can tell you whether it belongs to staff or to a printer.
- Fault isolation. A misconfigured device in one subnet is less likely to disrupt all the others.
Dividing too finely has costs too: more routing rules to maintain and more chances for mistakes. Most small organizations need only a few subnets.
Gateways and default routes
Every subnet needs a way out. The default gateway is the router address that devices send traffic to when the destination lies outside their own subnet. By convention it is often the first or last usable address in the range, although that is a habit, not a rule. If a device has the wrong mask or gateway, it may reach some places and not others, which makes for confusing symptoms.
Static and dynamic addresses
Most client devices receive addresses automatically from a DHCP service, which leases an address from a pool. Servers, printers and network equipment are often given fixed addresses, or reservations, so they stay predictable. Keeping a record of which addresses are assigned avoids duplicates, and an asset management record is a sensible place to store it.
A word on IPv6
IPv6 uses 128-bit addresses written in hexadecimal and has a vastly larger space. The ideas are the same, a prefix for the network and the remainder for the host, but subnet planning is simpler because there is no shortage of addresses. Many networks run IPv4 and IPv6 side by side.
Where to go next
Once you can read a slash notation and count hosts, the rest of addressing follows. The next step is seeing how names turn into addresses, which is the job of DNS lookups, and how rules at the boundary decide what crosses between subnets.