Introduction to Subnets
A subnet is a smaller, identifiable part of a larger IP network. If you have ever seen a company split office PCs, servers, printers, and guest Wi-Fi into different network segments, you have seen subnetting in action. The goal is simple: make a large network easier to manage, faster to troubleshoot, and safer to operate.
The keyword here is segmentation. Organizations use subnetting to separate traffic by location, department, environment, or device type without needing a separate physical network for every group. That can mean one subnet for accounting, another for engineering, and another for servers in the data center. It can also mean splitting a branch office from headquarters while still keeping both on the same routed enterprise network.
This guide covers the pieces people actually need on the job: subnet masks, CIDR notation, IP address classes, private IP ranges, and subnet cheat sheets. It also explains how to read common examples like .248 CIDR, a .248 subnet mask, a .252 subnet, and a /29 subnet. If you have ever looked at an address like 192.168.1.101 and wondered what part belongs to the network and what part belongs to the host, this article will make that clear.
For a grounding in how IP address planning affects real networks, NIST’s guidance on network segmentation and access control is a useful reference point, especially when you connect subnet design to policy enforcement and monitoring. See NIST CSRC for security architecture guidance that aligns with good segmentation practices.
What a Subnet Is and Why It Matters
A subnet is a logical division of a network. It does not have to map to a physical switch or router, although it often aligns with them for simplicity. Think of it as an address boundary that tells routers and hosts which traffic stays local and which traffic should be forwarded elsewhere.
That matters because broadcast traffic does not scale well. If every device in a building had to hear every local broadcast, the network would get noisy fast. By breaking a larger network into smaller broadcast domains, subnetting limits unnecessary traffic and keeps local communications local. That improves efficiency and reduces the chance that a simple flood of broadcasts will degrade performance.
In real environments, subnetting supports clean separation. A branch office might get its own subnet so it can be managed independently. A server subnet can be isolated from user endpoints so access is easier to control. A lab network can be kept separate from production systems to reduce the risk of accidental damage or test traffic leaking into the wrong place.
The business value is just as important as the technical value. Subnets make it easier to scale, document, and troubleshoot. When a help desk analyst can immediately see that a user is on the guest subnet instead of the corporate subnet, troubleshooting becomes faster. When a firewall rule is tied to a subnet, policy enforcement becomes much more predictable. Cisco’s network design documentation is a strong reference for how routing, segmentation, and addressing fit together in real deployments; see Cisco.
Good subnetting is less about memorizing formulas and more about building a network you can defend, support, and grow without rework.
IP Addressing Fundamentals
An IPv4 address is a 32-bit number written in dotted decimal form, such as 192.168.1.101. Each address identifies a device or interface on a network. Network devices use the address together with the subnet mask to decide whether traffic should stay local or be sent to a router.
Every IPv4 address has two parts: the network portion and the host portion. The network portion identifies the subnet. The host portion identifies the specific device inside that subnet. The subnet mask tells the system where the split occurs.
It helps to think of this like a mailing address. The street name and house number work together, but the neighborhood matters too. In IP networking, the subnet mask defines the “neighborhood,” and the host portion identifies the exact device.
Not every range of addresses is automatically usable. A subnet includes reserved addresses, usually one for the network itself and one for the broadcast address. That is why a range and a subnet are not the same thing. A range is just a sequence of numbers. A subnet is a defined network block with routing and broadcast rules.
Binary is part of the story because subnet masks are built from bits, not magic. You do not need to calculate everything by hand every day, but you do need enough binary awareness to understand why a /24 is different from a /25. The official Microsoft Learn networking resources are useful when you want to see how IP addressing and subnetting affect real configuration work in Windows and Azure environments.
Subnet Masks and CIDR Notation
A subnet mask separates the network portion of an IPv4 address from the host portion. In dotted decimal form, a common example is 255.255.255.0. In CIDR form, the same mask is written as /24. Both represent the same thing: the first 24 bits belong to the network.
CIDR notation stands for Classless Inter-Domain Routing. It is the modern way to write subnet size because it is compact and clear. Instead of writing 255.255.255.0 over and over, engineers write /24. That makes configuration, documentation, and planning much easier, especially when you are comparing multiple subnets quickly.
Here is the basic relationship: the larger the mask number, the smaller the subnet. A /24 leaves 8 bits for hosts, which gives 256 total addresses and 254 usable host addresses. A /25 leaves 7 bits for hosts, which gives 128 total addresses and 126 usable host addresses. A /30 leaves 2 bits for hosts, which gives 4 total addresses and 2 usable host addresses.
This is why the terms .248 CIDR, .248 subnet mask, and .252 subnet matter in practical work. They are shorthand for how much address space is available. A /29 subnet, for example, is commonly used when a small number of devices need a dedicated block without wasting a /24. For more on address planning and standards-based network design, IETF RFCs and drafts are the canonical technical references.
| CIDR | Dotted Decimal |
| /24 | 255.255.255.0 |
| /25 | 255.255.255.128 |
| /30 | 255.255.255.252 |
IP Address Classes and Their Historical Context
The original IPv4 design used a classful addressing model. That model divided addresses into fixed categories. Although modern networks rely on CIDR, the class system still appears in training, documentation, and older network references, so it is worth understanding.
Class A addresses range from 1.0.0.0 to 126.0.0.0. They were originally intended for very large networks. Class B ranges from 128.0.0.0 to 191.255.0.0 and was designed for medium-sized networks. Class C ranges from 192.0.0.0 to 223.255.255.0 and was intended for smaller networks.
Class D is used for multicast traffic, and Class E was reserved for experimental purposes. Those classes are not used the same way as A, B, and C in everyday subnet planning, but they remain part of the IPv4 structure.
The main reason classful addressing matters today is conceptual clarity. It helps new network engineers understand why the old model was too rigid. A business no longer has to accept a fixed “class” size and waste thousands of addresses. CIDR allows much more flexible allocation. That flexibility is exactly why modern network design is far more efficient than the old class-based approach.
For historical and protocol-level context, the IANA and IETF are the most authoritative sources for IP address architecture and allocation rules.
Private IP Address Ranges and Their Uses
Private IP ranges are reserved for internal networks and are not routed on the public internet. That means they can be used freely inside homes, offices, labs, and enterprise environments without conflicting with public addressing rules.
The standard private IPv4 ranges are:
- Class A private range: 10.0.0.0 to 10.255.255.255
- Class B private range: 172.16.0.0 to 172.31.255.255
- Class C private range: 192.168.0.0 to 192.168.255.255
These ranges support internal addressing for endpoints, printers, servers, wireless clients, IoT devices, and virtual machines. A home router might use 192.168.1.0/24 for laptops and phones. A branch office might use 10.20.0.0/16 for staff devices. A lab environment might use 172.16.50.0/24 for temporary test systems that should never be reachable from the public internet.
Private addressing usually works with NAT, or Network Address Translation. NAT allows many private devices to share a smaller number of public IP addresses. That is common in offices and homes because public IPv4 space is limited. A firewall or router translates the internal address, such as 192.168.1.101, to a public address when traffic goes out to the internet.
For standards and operational guidance around secure internal design, NIST security publications and CISA guidance on segmentation and network hygiene are useful references.
Note
Private IP ranges are not “less important” than public IPs. In many organizations, private addressing is the backbone of the entire internal network, and public addresses are just the edge.
How Subnetting Works in Practice
The simplest way to understand subnetting is to look at host capacity. The basic formula is 2^(32 – subnet mask bits). That gives the total number of addresses in the subnet. To find usable hosts, subtract the network address and broadcast address, except in special cases like /31.
Here is what that looks like in practice. A /24 has 256 total addresses and 254 usable hosts. A /25 has 128 total addresses and 126 usable hosts. A /30 has 4 total addresses and 2 usable hosts, which is why it is often used for point-to-point links.
The important idea is right-sizing. Do not assign a /24 to a 6-device lab just because it is easy to remember. That wastes address space and can make planning sloppier over time. Instead, choose the smallest subnet that meets current needs and leaves a realistic amount of room for growth.
For example, if a small team currently has 10 devices and expects to reach 20 within the year, a /27 may be a practical choice because it provides 30 usable addresses. If a network segment only needs two routed endpoints, a /30 may be enough. If you need a single static address for a loopback or NAT exception, a /32 is the right fit.
Different vendors may present these choices differently, but the rule stays the same: the mask determines the size of the network. For official implementation details on routing and interface addressing, vendor documentation from Cisco and Microsoft Learn is the best place to verify syntax and behavior.
Reading and Using a Subnet Cheat Sheet
A subnet cheat sheet is a quick reference that maps CIDR values to useful planning information. It usually includes the subnet mask, total addresses, usable hosts, block size, wildcard mask, and often a binary representation. When you are working under pressure, that kind of reference saves time and reduces mistakes.
Cheat sheets are especially useful when you need to move between formats quickly. A row for /24 tells you the dotted decimal mask, the number of hosts, and the size of the network block. A row for /26 shows that the subnet is smaller and can support fewer devices. A row for /30 helps you confirm that only two usable hosts are available.
What to look for in a cheat sheet
- Subnet mask: Dotted decimal form such as 255.255.255.0
- CIDR prefix: Slash notation such as /24 or /29
- Usable hosts: Device count available after network and broadcast addresses are reserved
- Wildcard mask: The inverse of the subnet mask, often used in ACLs
- Binary mask: Helpful for understanding where the subnet boundary falls
In day-to-day work, cheat sheets are useful for VLAN planning, router setup, firewall rule design, and troubleshooting. They are also useful when documenting a network for another engineer. If you hand off a subnet plan to a colleague, a clean cheat sheet reduces interpretation errors. For more practical standards on access control and addressing logic, Palo Alto Networks documentation and CIS Benchmarks can help connect subnetting with secure configuration.
Common Subnet Mask Examples and What They Mean
Some subnet sizes show up constantly in real networks. Learning these by sight makes subnet planning much faster. The most common examples include /32, /31, /30, /29, /28, and /27.
A /32 represents a single host address. It is commonly used for loopbacks, host routes, or very specific firewall rules. A /31 is often used for point-to-point links because it can conserve address space on links where broadcast is not needed. A /30 provides two usable addresses and is still common in smaller router-to-router links. A /29 gives six usable addresses and is useful for small device groups. A /28 gives fourteen usable addresses, and a /27 gives thirty usable addresses.
The pattern is straightforward: as the prefix length gets smaller, the subnet gets larger. More host bits mean more usable IPs. That is why choosing the right size is a planning decision, not just a math exercise. A /29 subnet is a better fit for a small device segment than a /24, and a /27 is a better fit than a /30 when a few extra endpoints may be added soon.
Quick size categories
- Very small: /32, /31, /30
- Small: /29, /28, /27
- Medium and larger: /26, /25, /24 and above
For design consistency, many teams standardize on common blocks so they can spot subnet size immediately. That reduces errors in routing tables, ACLs, DHCP scopes, and documentation. Official guidance from Juniper and Cisco can be helpful when comparing how vendors handle mask-based configuration in production networks.
Planning a Network with Subnets
Subnet planning should start with a simple question: what are you trying to separate? Common answers include departments, floors, branches, labs, server tiers, and service groups. The goal is to assign address blocks based on function, not just convenience.
A good method is to estimate host counts before you assign a subnet. Count the endpoints you have today, then add realistic growth. That growth might include new desktops, phones, printers, cameras, wireless clients, virtual machines, or temporary contractor devices. If a department has 18 devices today and is likely to reach 25 soon, a /27 may be a better choice than a /28 because it gives you a safer buffer.
Plan for separation where it matters. Put servers in one subnet, employee devices in another, and guest Wi-Fi in another. Printers often deserve their own subnet too, because printer traffic is predictable and security policies are easier to manage when printing systems are isolated from general user traffic. If you have branch offices, give each one a clean block so routing and support are easier.
Subnet planning is also about avoiding waste. Oversized subnets are easy at first, but they become messy as the environment grows. Smaller, well-organized blocks make DHCP scopes, ACLs, monitoring, and troubleshooting more predictable. For workforce and network design alignment, the NICE Workforce Framework is a useful reference for mapping technical responsibilities to operational roles.
Benefits of Subnetting for Security and Performance
Subnetting improves performance by reducing broadcast scope and limiting unnecessary traffic. That means devices only see local traffic for their own subnet instead of everything on a giant flat network. In practical terms, fewer broadcasts can mean better responsiveness and less noise on busy segments.
Security improves too, but subnetting is not a complete security solution. It is one layer in a broader design that also includes firewalls, ACLs, identity controls, endpoint protection, and logging. The value of subnetting is that it creates enforceable boundaries. Once devices are separated into different subnets, you can apply different rules to each group.
That is especially useful for common scenarios. Guest users can be placed in a subnet that allows internet access but blocks internal resources. Production servers can be isolated from user devices so only approved ports and protocols are allowed. Management interfaces can be kept in a dedicated subnet that only administrators can reach.
Operationally, subnetting also makes monitoring easier. If traffic from one subnet spikes, the issue is more contained and easier to investigate. If a device misbehaves, the blast radius is smaller. This is why segmentation is such a common recommendation in security architecture and incident response guidance.
The Verizon Data Breach Investigations Report and IBM Cost of a Data Breach Report both reinforce a basic fact: limiting access and reducing exposure are not optional design choices. They are part of how modern networks stay resilient.
Key Takeaway
Subnetting reduces broadcast traffic, improves control, and supports security policy enforcement. It does not replace firewalls or authentication, but it makes both much more effective.
Troubleshooting and Avoiding Common Subnetting Mistakes
Most subnetting mistakes are not caused by bad math. They are caused by assumptions. A common error is confusing the subnet mask with the number of usable hosts. Another is mixing up CIDR notation and dotted decimal notation without checking the actual network size.
One of the easiest mistakes to make is forgetting that every subnet reserves addresses. If you plan a /30 as if all four addresses were usable, your design will fail. If you assign a subnet that is too small for real growth, you will end up renumbering devices later. If you assign one that is too large, you waste address space and make your segmentation less precise.
Private address overlap is another frequent issue. Two sites may both use 192.168.1.0/24, and that works fine until a VPN connects them. Then routing conflicts appear. This is why enterprise environments often prefer more structured private ranges, especially when remote access, mergers, or site-to-site VPNs are part of the network plan.
When troubleshooting, start with the basics. Verify the mask. Confirm the subnet boundary. Check whether the device should be in the same subnet as its gateway. If traffic is failing, confirm that the expected address really belongs to the intended subnet. A host like 192.168.1.101 may look valid, but without the correct mask, it could be placed in the wrong network.
For formal troubleshooting approaches and incident handling, CISA and NIST are strong references for network defense and operational hygiene.
Conclusion
Subnets divide a larger network into smaller, more manageable pieces. That is the core idea, and it is the part worth remembering when the syntax gets confusing. Whether you are planning a new VLAN, documenting a branch office, or checking a firewall rule, subnetting gives you structure.
Subnet masks, CIDR notation, and private address ranges are the building blocks of practical network design. They determine how many hosts fit in a segment, how traffic is routed, and how easily you can isolate users, servers, and services. Once you understand those pieces, the examples start to make sense quickly.
The real payoff is operational. Subnetting improves efficiency, organization, performance, and security. It helps you create networks that are easier to support and easier to grow. It also reduces the chance that one flat network will become a troubleshooting nightmare.
If you are still building confidence, keep a subnet cheat sheet nearby and work through examples until the patterns become familiar. Revisit /24, /25, /29 subnet, /30, and /32 examples until you can recognize them at a glance. That habit pays off in every router, switch, firewall, and cloud network you touch.
ITU Online IT Training recommends practicing subnetting with real address plans, not just memorizing formulas. The more you apply the concepts to office networks, labs, and server segments, the faster you will spot errors and design cleaner networks.
CompTIA®, Cisco®, Microsoft®, AWS®, EC-Council®, ISC2®, ISACA®, and PMI® are trademarks of their respective owners.