What is a subnet?
A subnet is a smaller network carved out of a larger IP network. Subnetting splits one address block into several independent segments, each with its own range of hosts and its own broadcast domain, so that devices inside a segment talk directly while traffic between segments has to pass through a router.
Last reviewed:
Looking for the complete table instead? Every prefix from /0 to /32, with mask, wildcard and host count, is on the CIDR reference.
The one-sentence version
A subnet is a logical subdivision of an IP network. Instead of putting every device in one giant network, you break the address space into smaller pieces, each of which is a subnet. Devices inside the same subnet talk directly; traffic between subnets goes through a router.
The word itself is short for sub-network. When someone says a network is subnetted, they mean the original block has been divided so that each department, floor, or purpose gets its own slice.
Why does subnetting exist?
The original reason was the broadcast domain. Some protocols work by shouting at everyone on the segment: ARP asks which machine owns an IP address, DHCP asks whether any server will hand out a lease. Every device on the subnet has to receive and process each of those frames. On a flat network of a few thousand hosts that background noise becomes a real cost on every machine, and one misbehaving device can flood the lot.
Splitting the address space puts a boundary in the way. A router does not forward broadcasts, so a broadcast in one subnet never reaches another. That is why the segment boundary and the subnet boundary are the same thing in practice.
The second reason is control. Once servers, staff laptops and guest Wi-Fi are in different subnets, all traffic between them passes a router, which means it can be filtered, logged and rate-limited. You cannot apply a firewall rule between two hosts that talk directly over a switch, because nothing in the path is looking at IP addresses.
The third reason is routing table size. A router can advertise one summary route for a whole block instead of a route per network, which is what the supernet calculator on this site does in reverse. That aggregation is what keeps the global routing table manageable.
How do you read a subnet like 192.0.2.0/24?
A subnet is written as a network address plus a prefix length. The /24 says the first 24 bits identify the network and the remaining 8 bits identify hosts inside it. Since 8 bits count from 0 to 255, that block holds 256 addresses, of which 254 are usable.
Change the prefix and you change the size, always by a factor of two. A /25 halves the block to 128 addresses, a /26 halves it again to 64, and a /27 to 32. The counterintuitive part is that a larger prefix number means a smaller subnet, because you are spending more bits on the network and leaving fewer for hosts.
The general formulas are worth committing to memory: a prefix of /n holds 2 to the power of (32 minus n) addresses, and 2 to the power of (32 minus n) minus 2 usable hosts. So /24 gives 256 and 254, /26 gives 64 and 62, /30 gives 4 and 2.
Why are two addresses in a subnet unusable?
The first address in the block is the network address, the identifier for the subnet itself. The last is the broadcast address, which reaches every host on that subnet at once. Neither can be assigned to a device, which is where the minus two comes from.
In 192.0.2.0/24 that means 192.0.2.0 is the network and 192.0.2.255 is the broadcast, leaving 192.0.2.1 through 192.0.2.254 for hosts. One of those is almost always the default gateway, so the practical count of hosts you can actually deploy is 253.
Two prefixes break the rule deliberately. A /31 has only two addresses and no room for a network and broadcast pair, so RFC 3021 defines both addresses as usable for point-to-point links between routers, where there will never be more than two ends. And a /32 is a single address with no host range at all, used for a loopback interface or to name one exact host in a route or firewall rule.
How do you split a network into subnets?
Work from how many hosts each segment needs, not from how many subnets you want, because the host count is the constraint that cannot be negotiated. Round each requirement up to the next power of two, add two for the network and broadcast addresses, and pick the prefix that fits.
Take 198.51.100.0/24 and split it into four equal subnets. Each becomes a /26 with 64 addresses and 62 usable hosts: 198.51.100.0/26, 198.51.100.64/26, 198.51.100.128/26 and 198.51.100.192/26. You might give one to servers, one to staff, one to phones and one to a DMZ.
Equal splits are the simple case. Real networks usually want unequal sizes, which is what variable-length subnet masking means: subnet the block once, then subnet one of the results again. From the same /24 you could take 198.51.100.0/25 for 126 staff devices, then split the upper half into 198.51.100.128/26 for 62 phones, 198.51.100.192/27 for 30 servers and 198.51.100.224/28 for 14 network devices, with 198.51.100.240/28 left spare. The rule that keeps this from going wrong is that each subnet must start on a multiple of its own size.
Does IPv6 use subnets the same way?
The concept is identical, the arithmetic is not, and the habit of squeezing address space disappears entirely. The convention in IPv6 is that a single subnet is a /64, which contains 18,446,744,073,709,551,616 addresses. You do not size an IPv6 subnet to the number of hosts; you give every segment a /64 and stop thinking about it.
That is not merely convenience. Stateless address autoconfiguration, where a host builds its own address from the prefix the router advertises, expects a 64-bit interface identifier, so a prefix longer than /64 breaks it. A site typically receives a /48 or /56 from its provider, which yields 65,536 or 256 subnets respectively.
There is also no broadcast address in IPv6 and no network address to reserve, so the minus two does not apply. The functions broadcast used to serve are handled by multicast groups instead. The IPv6 subnet calculator on this site works through prefixes and ranges for any IPv6 block.
Frequently asked questions
What is the difference between a subnet and a network?
A network is the whole address block; a subnet is a piece of it. Every subnet is a network in its own right, but the word subnet implies it was created by dividing a larger block, and that a router sits between it and its siblings.
How many hosts can a subnet hold?
A prefix of /n holds 2 to the power of (32 minus n) addresses and two fewer usable hosts. So a /24 holds 256 addresses and 254 usable hosts, a /26 holds 64 and 62, and a /30 holds 4 and 2. The exceptions are /31, where RFC 3021 makes both addresses usable for point-to-point links, and /32, which is a single address.
Why does a /24 have 254 usable hosts and not 256?
Because the first address in the block is the network address that identifies the subnet, and the last is the broadcast address that reaches every host at once. Neither can be assigned to a device. One of the remaining 254 is normally the default gateway, so in practice you can deploy 253 hosts.
Do I need a router between subnets?
Yes. Two hosts in different subnets cannot reach each other directly; the traffic has to be routed. A switch on its own keeps everything in one subnet and one broadcast domain unless you add VLANs and a router or a layer-3 switch to move between them.
What is a /24 subnet?
A /24 subnet has a 24-bit prefix, the mask 255.255.255.0, and 256 addresses of which 254 are usable. It is the most common LAN size, it maps exactly to one classic class C network, and it is the default many home routers hand out.
What is the difference between a subnet and a VLAN?
A subnet is a layer-3 concept, a range of IP addresses. A VLAN is a layer-2 concept, a separated switching domain. They are different layers doing complementary jobs, and in practice they are configured one-to-one, so each VLAN carries exactly one subnet. The VLAN versus subnet guide covers where that mapping breaks down.
Is a bigger prefix number a bigger or smaller subnet?
Smaller. The prefix counts how many bits identify the network, so a larger number leaves fewer bits for hosts. A /28 has 16 addresses while a /20 has 4,096. This is the single most common source of confusion when reading CIDR notation.
Sources
Everything technical on this page is checkable against the documents below. Where a document and common practice disagree, the guide says so rather than picking one quietly.
- RFC 950: Internet Standard Subnetting Procedure, which introduced subnetting
- RFC 4632: Classless Inter-domain Routing (CIDR)
- RFC 1918: Address allocation for private internets
- RFC 4291: IP Version 6 Addressing Architecture, for the IPv6 comparison
Spotted something wrong? Tell us and it gets corrected. How the data is maintained is described on the about page.