What Is Subnetting? IP Subnets and CIDR Explained

Subnetting divides a large IP network into smaller segments. Learn why we subnet, how subnet masks work, what CIDR notation means, and how to calculate subnets.

What Is a Subnet?

A subnet (short for subnetwork) is a logically defined segment of a larger IP network. Subnetting divides a single large network into multiple smaller networks, each with its own range of IP addresses.

Think of it like dividing a large office building into floors. The building has one address (the network), but each floor has its own room-numbering scheme (the subnet).

Why Subnet?

| Reason | Explanation | |---|---| | Reduce broadcast-address-resolution-protocol-explained) traffic | ARP and other broadcasts are contained within a subnet, not flooding the entire network | | Improve security | Devices in different subnets must go through a router-network-address-translation-explained), allowing [firewall rules](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) between segments | | Efficient [IP allocation](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) | Assign only as many addresses as a segment needs | | Organisational clarity | Separate HR, Finance, and Engineering onto their own subnets | | Network performance | Smaller broadcast-address-resolution-protocol-explained) domains reduce noise for each device |

IP Address Structure

An [IPv4-address-ipv4-IPv6-and-addressing-explained) address](/learning-center/what-is-an-ip-address-ipv4-ipv6-and-addressing-explained) is 32 bits, written as four 8-bit numbers (octets):

192  .  168  .  1   .  50
11000000.10101000.00000001.00110010

Every [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) has two parts:

Network portion — identifies which network the address belongs to
Host portion — identifies the specific device within that network

The subnet mask determines where the network portion ends and the host portion begins.

Subnet Masks

A subnet mask is also 32 bits. Wherever a bit in the mask is 1, that bit in the [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) belongs to the network. Wherever the mask bit is 0, that bit belongs to the host.

IP address:   192.168.1.50    = 11000000.10101000.00000001.00110010
Subnet mask:  255.255.255.0   = 11111111.11111111.11111111.00000000
                                                            --------
                                Network portion             Host portion

In this example:

network address-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained): 192.168.1.0 (all host bits = 0)
broadcast-address-resolution-protocol-explained) address: 192.168.1.255 (all host bits = 1)
Usable host range: 192.168.1.1 to 192.168.1.254 (254 hosts)

CIDR Notation

CIDR (Classless Inter-domain-kerberos-directory-services-explained) [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3)) is a compact way to express a subnet mask using a forward slash and the number of 1-bits in the mask:

192.168.1.0/24   means subnet mask 255.255.255.0   (24 ones)
10.0.0.0/8       means subnet mask 255.0.0.0       (8 ones)
172.16.0.0/16    means subnet mask 255.255.0.0     (16 ones)

The number after the slash is called the prefix length.

Common Subnet Sizes

| CIDR | Mask | Usable Hosts | Typical use | |---|---|---|---| | /8 | 255.0.0.0 | 16,777,214 | Large enterprise / ISP | | /16 | 255.255.0.0 | 65,534 | Large campus network | | /24 | 255.255.255.0 | 254 | Home / small office LAN | | /25 | 255.255.255.128 | 126 | Medium segment | | /26 | 255.255.255.192 | 62 | Small department | | /28 | 255.255.255.240 | 14 | Small server cluster | | /30 | 255.255.255.252 | 2 | Point-to-point link | | /32 | 255.255.255.255 | 1 | Single host (loopback, firewall rule) |

> Formula: Usable hosts = 2^(host bits) minus 2 > (Subtract 2 for the network address-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) and broadcast-address-resolution-protocol-explained) address)

Private IP Ranges (RFC 1918)

These ranges are reserved for private networks and are not routable on the public internet:

| Range | CIDR | Addresses | |---|---|---| | 10.0.0.0 to 10.255.255.255 | 10.0.0.0/8 | ~16.7 million | | 172.16.0.0 to 172.31.255.255 | 172.16.0.0/12 | ~1 million | | 192.168.0.0 to 192.168.255.255 | 192.168.0.0/16 | 65,536 |

These are the addresses you see on home routers (192.168.1.x) and enterprise networks. They require NAT ([network address-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) translation](/learning-center/what-is-nat-network-address-translation-explained)) to communicate with the internet.

How Routers Use Subnets

A router-network-address-translation-explained) maintains a [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) table — a list of known networks and which interface or next-hop to use for each. When a packet-the-internets-core-protocol)-ip-the-internets-core-protocol) arrives:

router-network-address-translation-explained) extracts the destination IP
Applies each subnet mask in the [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) table
Finds the longest prefix match (most specific route)
Forwards the packet-the-internets-core-protocol)-ip-the-internets-core-protocol) to the correct interface or next-hop

Routing table example:
  10.0.0.0/8     via Interface 0  (broad internal route)
  10.10.0.0/24   via Interface 1  (specific subnet — longer match wins)
  0.0.0.0/0      via 203.0.113.1  (default route / internet gateway)

Subnetting Example: Dividing a /24

You have the network 192.168.10.0/24 and need to divide it into 4 equal subnets.

4 subnets requires 2 additional bits (2 to the power of 2 = 4), so borrow 2 bits from the host portion:

New prefix: /26 (24 + 2 = 26)
New mask:   255.255.255.192

Subnet 1:  192.168.10.0/26   hosts: .1 to .62    broadcast: .63
Subnet 2:  192.168.10.64/26  hosts: .65 to .126  broadcast: .127
Subnet 3:  192.168.10.128/26 hosts: .129 to .190 broadcast: .191
Subnet 4:  192.168.10.192/26 hosts: .193 to .254 broadcast: .255

Each subnet has 62 usable host addresses.

Subnetting and Security

Subnets are a foundational security tool:

DMZ: Public-facing servers live in a dedicated subnet, isolated from internal systems
zero trust networking: microsegmentation creates subnets so small each application has its own
VLAN-backed subnets: Combine Layer 2-address-resolution-protocol-explained) VLANs with Layer 3 subnets for complete logical separation
[firewall rules](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network): Traffic between subnets passes through a router-network-address-translation-explained) or firewall where rules can be applied

A flat network (no subnets) is a security problem — once an attacker is inside, they can reach every device without passing through any inspection point.

Summary

A subnet is a logically defined segment of a larger IP network
Subnet masks (or CIDR prefix lengths) determine the network vs host portion of an [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)
Subnetting reduces broadcast-address-resolution-protocol-explained) traffic, improves security, and enables efficient [IP allocation](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)
private [IP](/learning-center/what-is-NAT-network-address-translation-explained) ranges (10.x, 172.16-31.x, 192.168.x) require NAT to reach the internet
Routers use longest-prefix matching to determine where to forward packets
Subnetting is a core building block of network segmentation-virtual-local-area-network-explained) and security architecture