What is Subnet?
Updated: 3 days ago
A subnet is a logical subdivision of an IP network. It uses part of an IP address as the network prefix and leaves the remaining bits to identify addresses inside that prefix. Subnetting lets one larger address block be divided into smaller networks so devices, routers and administrators can make clearer decisions about what is local, what must be routed elsewhere and how address space is organised.
For a home broadband user, the subnet is usually hidden behind familiar settings such as 192.168.1.1 and 255.255.255.0. For someone running VLANs, multiple Wi-Fi networks, a lab, servers or business connectivity, understanding the subnet boundary becomes essential because it directly affects routing, DHCP, broadcast domains, firewall policy and address planning.
What is a subnet?
A subnet, short for subnetwork, is a portion of an IP network identified by a prefix. Devices compare a destination address with their own prefix to decide whether the destination is on the local network or whether traffic needs to be sent to a router.
The original Internet subnetting specification described subnets as logically visible subdivisions of a single Internet network. Modern networks use classless addressing, so the important concept is the prefix length rather than the old Class A, B or C boundaries.
This sits underneath both IPv4 and IPv6. The address formats differ, but both use a prefix to identify the network portion of an address.
Subnet vs network: what is the difference?
In everyday networking, the words network and subnet are often used loosely. Technically, subnetting is the act of taking an address block and dividing it into smaller prefixes. Once created, each resulting prefix can operate as its own routed network segment.
A subnet does not have to correspond to one physical cable. It is an IP-layer boundary. Ethernet switches, Wi-Fi access points and VLANs can all influence how the underlying local network is built, but the subnet is defined by IP addressing and routing.
What does a subnet mask do?
In IPv4, a subnet mask identifies which bits belong to the network prefix and which bits remain for host addressing. A mask of 255.255.255.0 has 24 leading one-bits, so it is equivalent to a /24 prefix.
192.168.1.0/24 means the first 24 bits identify the network prefix.
The remaining 8 bits can vary within that IPv4 address block.
The same prefix can be written as the subnet mask 255.255.255.0.
Modern routing normally uses CIDR prefix notation because it expresses the boundary directly.
What is CIDR notation?
CIDR notation writes an IP address or network followed by a slash and the number of significant prefix bits. RFC 4632 describes this classless model for IPv4. For example, 172.16.0.0/16 has 16 prefix bits, while 192.168.1.0/24 has 24.
A larger slash number means a longer prefix and therefore a smaller address block. A /26 is smaller than a /24 because more bits are fixed as the network portion and fewer remain available to vary.
CIDR is not the same thing as NAT. CIDR describes address prefixes and routing boundaries. NAT translates addresses, and sometimes ports, between different sides of a translator.
Worked example: splitting a /24 into four /26 subnets
Take the private IPv4 block 192.168.1.0/24. It contains 256 addresses in total. If two additional bits are borrowed for subnetting, the prefix becomes /26. Two borrowed bits provide four possible subnet values, so the original /24 becomes four equal /26 blocks.
192.168.1.0/26 covers addresses 192.168.1.0 to 192.168.1.63.
192.168.1.64/26 covers addresses 192.168.1.64 to 192.168.1.127.
192.168.1.128/26 covers addresses 192.168.1.128 to 192.168.1.191.
192.168.1.192/26 covers addresses 192.168.1.192 to 192.168.1.255.
Each /26 contains 64 IPv4 addresses. On a conventional multi-access IPv4 subnet, the first address identifies the network and the last is the subnet-directed broadcast address, leaving 62 addresses normally available for interfaces. That familiar minus-two rule has exceptions, including /31 point-to-point links.
Why /31 is an important exception
A common shortcut says every IPv4 subnet loses two addresses to the network and broadcast addresses. That is useful for ordinary LAN planning but it is not universally true. RFC 3021 defines /31 prefixes for point-to-point IPv4 links, where both addresses can be used as endpoint addresses because a point-to-point link does not need a conventional directed broadcast address.
That distinction matters when reading subnet calculators or configuring router-to-router links. Rules that are correct for a typical /24 LAN should not be applied blindly to every prefix type.
How a device uses its subnet
A device needs its own IP address and prefix information to work out whether a destination is local. Conceptually, it applies the prefix to its own address and to the destination address. If both fall within the same local prefix, it can try to reach the destination directly on the local link. If they do not, it normally sends the packet towards a configured router or default gateway.
This is one of the most useful subnetting concepts for troubleshooting. Two devices can be physically connected to the same switch and still fail to communicate as expected if their IP configuration tells them they are on different subnets and no suitable router exists between those prefixes.
Subnetting does not automatically create isolation
Creating different IP subnets gives a router a boundary across which traffic can be routed and controlled, but the prefix alone is not a security policy. If a router is configured to route freely between two subnets, devices in those subnets may still communicate.
Isolation comes from the surrounding design: VLAN placement, routing and firewall policy. Subnetting gives those controls useful boundaries; it does not replace them.
Subnetting, VLANs and broadcast domains
A VLAN is a Layer 2 segmentation mechanism. A subnet is a Layer 3 IP addressing concept. In many well-designed networks there is a one-to-one relationship between a VLAN and an IP subnet, but they are not synonyms.
Putting two IP subnets on one Layer 2 segment is possible, and extending one IP subnet across multiple Layer 2 technologies is also possible. Whether either design is sensible depends on the network. For home and small-business networks, keeping one routed subnet per VLAN is usually easier to understand and troubleshoot.
Why create more than one subnet?
Separate trusted computers from IoT or smart-home devices.
Create a guest network that cannot directly reach internal systems.
Keep servers or lab equipment in a dedicated routed segment.
Apply different firewall policies to different device groups.
Reduce the scope of IPv4 broadcast traffic.
Organise address space so routing and troubleshooting are easier to understand.
Use address space more efficiently when a large block does not need to exist as one flat network.
Subnetting and DHCP
DHCP commonly supplies a device with an IPv4 address, subnet mask or prefix information, default gateway and DNS settings. A DHCP pool must be planned around the subnet it serves. Giving a client an address from one prefix but the wrong mask can make it misclassify local and remote destinations.
DHCP broadcast discovery also does not naturally cross a router boundary. Networks with a central DHCP server serving multiple subnets commonly use DHCP relay functionality on routers or Layer 3 switches.
Subnetting and routers
Routers connect different IP prefixes. If a home router has a LAN such as 192.168.1.0/24 and a separate guest network such as 192.168.50.0/24, the router can have an interface in each subnet and decide whether traffic may pass between them.
The routing table is what tells the router where each prefix is reachable. The subnet itself does not move packets between networks; routing does.
Subnetting and IPv4 private addresses
Home networks frequently use private IPv4 address space. The familiar 192.168.0.0/16 range is only one private block. 10.0.0.0/8 and 172.16.0.0/12 are also private IPv4 space. You can subnet those blocks into smaller prefixes to suit the local design.
Private addressing does not mean every private address is on the same local subnet. For example, 192.168.1.10/24 and 192.168.2.10/24 are in different /24 prefixes even though both addresses are private. They require routing to communicate across that subnet boundary.
IPv6 subnets work differently
IPv6 uses prefix lengths rather than dotted-decimal subnet masks. A typical IPv6 LAN uses a /64 prefix, leaving a 64-bit interface identifier field. RFC 7421 explains why the 64-bit boundary became the normal architecture for almost all IPv6 unicast subnets.
This means IPv6 subnet planning should not simply copy IPv4 habits. With IPv4, administrators often conserve addresses by making LAN prefixes only as large as necessary. IPv6 has an enormous address space, and /64 per LAN is the normal expectation for mechanisms such as SLAAC.
There are specialised exceptions, such as /127 prefixes for router point-to-point links, but a normal user LAN should not be made smaller than /64 merely because only a handful of devices are connected.
Does a smaller subnet make broadband faster?
Not inherently. Changing a /24 into smaller subnets does not increase the speed of the internet connection. It can improve network organisation and can reduce the scope of some local broadcast traffic, but broadband throughput is governed by other constraints such as the access link, router performance, Wi-Fi conditions, Ethernet link rates, congestion and remote-server capacity.
Subnetting can indirectly improve manageability and fault isolation, which can make a complex network perform more predictably, but there is no simple rule that more subnets equal more speed.
Common subnetting mistakes
Assuming 255.255.255.0 is the only valid IPv4 subnet mask.
Treating private IPv4 space as though it were one single local network.
Using the wrong prefix on one device and then blaming DNS or the broadband connection.
Forgetting that the default gateway must be reachable from the device's local subnet.
Overlapping subnets on routed interfaces, which can make route selection ambiguous or invalid.
Confusing a VLAN with a subnet.
Assuming subnetting itself creates a firewall boundary.
Applying the conventional IPv4 minus-two host rule to /31 point-to-point links.
Trying to conserve IPv6 addresses by using unusually long prefixes on ordinary LANs.
How to troubleshoot a subnet problem
Check the device's IP address and prefix length or subnet mask.
Calculate the network prefix and confirm the expected local devices fall inside it.
Check the configured default gateway and confirm its address is on a directly reachable local prefix.
Test a destination on the same subnet before testing a remote subnet or the internet.
If local communication works but remote communication fails, inspect routing and firewall policy next.
Check DHCP configuration if clients are receiving inconsistent addresses, masks or gateways.
If VLANs are involved, confirm the Layer 2 VLAN and Layer 3 subnet design agree.
For dual-stack networks, diagnose IPv4 and IPv6 independently rather than assuming one working protocol proves the other is correct.
A practical way to think about subnetting
The most useful mental model is not 'a subnet is a range of addresses'. A subnet is an address prefix that helps define a routing boundary. The range is a consequence of that prefix.
When a device knows its own address and prefix, it can classify a destination as local or non-local. When a router knows multiple prefixes, it can move traffic between them. When a firewall knows those prefixes, it can apply different policy between them. That is why subnetting sits at the centre of IP network design rather than being just an exercise in binary arithmetic.
What is Subnet? FAQs
What is a subnet in simple terms?
A subnet is a smaller IP network identified by a prefix. The prefix tells devices which addresses are considered part of the same local network and which destinations normally need a router.
Is a subnet the same as a VLAN?
No. A VLAN separates Layer 2 traffic, while a subnet is a Layer 3 IP addressing and routing concept. They are often mapped one-to-one, but they are different technologies.
What does /24 mean?
In IPv4, /24 means the first 24 bits of the 32-bit address form the network prefix. It is equivalent to the subnet mask 255.255.255.0 and contains 256 total IPv4 addresses.
How many usable addresses are in a /26?
A /26 contains 64 total IPv4 addresses. On a conventional multi-access subnet, 62 are normally usable for interfaces because one address identifies the network and one is the broadcast address.
Does every IPv4 subnet lose two addresses?
No. The familiar network-and-broadcast reservation applies to conventional IPv4 subnets, but RFC 3021 allows both addresses in a /31 to be used on a point-to-point link.
What subnet size should I use for IPv6?
For a normal IPv6 LAN, /64 is the standard expectation and is required by common mechanisms such as SLAAC. Specialised point-to-point designs can use other prefix lengths.
Does subnetting improve security?
Subnetting creates useful network boundaries, but it does not enforce security by itself. Routing, VLAN design and firewall rules determine whether traffic is allowed between subnets.
Authoritative subnetting references
RFC 950: Internet Standard Subnetting Procedure.
RFC 4632: Classless Inter-domain Routing (CIDR).
RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links.
RFC 7421: Analysis of the 64-bit Boundary in IPv6 Addressing.
Read RFC 950 · RFC 4632 · RFC 3021 · RFC 7421
To explore the related technical concepts used in this Subnet guide, visit our broadband terminology guide.
