Subnetting is the process of dividing one IP network into multiple smaller sub-networks by borrowing bits from the host portion of the address. Each subnet becomes its own broadcast domain with a dedicated range of addresses, a network address, and a broadcast address — so a single 192.168.1.0/24 network (254 usable hosts) can be split into four /26 subnets of 62 usable hosts each. Engineers subnet for three concrete reasons: to contain broadcast traffic and keep networks fast, to create boundaries a firewall can filter across for security, and to allocate address space efficiently by matching each subnet's size to the number of devices it actually holds.
That's the summary an AI Overview gives you. Here's what it can't show you: how the bits actually move when you subnet, how prefix length maps to real host counts, and how to pick the right mask for a given number of devices. The diagram, reference table, and worked example below turn the definition into something you can apply.
How subnetting actually works: borrowing host bits
An IPv4 address is 32 bits split into a network part and a host part. The subnet mask (or CIDR prefix) is the line between them. Subnetting moves that line to the right — turning host bits into network bits — which creates more networks, each with fewer hosts. The diagram below shows a single /24 being split into four /26 subnets by borrowing two bits.
The trade-off is visible in that last line: subnetting costs you addresses. Every subnet reserves its own network and broadcast address, so four /26s waste 8 addresses that the single /24 did not. That is the price of isolation, and it is almost always worth paying.
Prefix length, subnet mask, and usable hosts — the reference table
The single most useful thing to internalize is how CIDR prefix maps to host count. Each step of the prefix halves the network. Here is the reference for the common IPv4 sizes:
| CIDR prefix | Subnet mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 | Standard office/department LAN |
| /25 | 255.255.255.128 | 128 | 126 | Split a /24 in half |
| /26 | 255.255.255.192 | 64 | 62 | Small department or VLAN |
| /27 | 255.255.255.224 | 32 | 30 | Small office, IoT segment |
| /28 | 255.255.255.240 | 16 | 14 | Rack of servers, small DMZ |
| /29 | 255.255.255.248 | 8 | 6 | Tiny segment, firewall cluster |
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point router link |
| /31 | 255.255.255.254 | 2 | 2 (RFC 3021) | Point-to-point link, no broadcast |
| /32 | 255.255.255.255 | 1 | 1 | Single host, loopback, host route |
Which should you use? Pick the smallest subnet that still fits your hosts with room to grow. A 40-device team fits a /26 (62 usable) with headroom; squeezing it into a /27 (30 usable) will fail the moment you add printers and laptops. Router-to-router links should always be /30 or /31 — assigning a /24 to a two-address link wastes 252 addresses. Matching subnet size to real host count across a network is called Variable Length Subnet Masking (VLSM), and it is the whole point of classless addressing.
Why engineers subnet: the three real motivations
1. Performance — shrinking the broadcast domain
Every device in a subnet hears every broadcast (ARP requests, DHCP discovers, service announcements) sent within it. In a flat /16 with 65,000 potential hosts, broadcast traffic becomes a constant background roar that every NIC must process. Splitting into /24s confines broadcasts to ~254 hosts each, so the noise stays local and the network stays fast.
2. Security — boundaries you can enforce
Subnetting by itself does not block anything — but it creates the lines that a router, firewall, or access-control list enforces. Put servers, employee laptops, IoT devices, and guest Wi-Fi into separate subnets and traffic between them must cross a control point you can log, filter, and block. This is the mechanical basis of network segmentation and zero-trust design: a compromised smart thermostat on the IoT subnet cannot reach the finance server subnet without passing a firewall rule that says no.
3. Efficiency and management — structure that mirrors reality
A subnet per department, floor, site, or environment makes addressing predictable and troubleshooting fast. When you see 10.20.30.x you know it is the third-floor sales VLAN; a device's address tells you where it lives. Route tables stay compact because you advertise one aggregate prefix instead of thousands of individual hosts, and address space gets handed out in right-sized blocks instead of one wasteful pool.
Worked example: subnetting for four departments
Suppose you own 192.168.10.0/24 and need to serve four teams — Engineering (50 devices), Sales (30), Operations (20), and a point-to-point link to a branch router (2). A single flat /24 would leave all four teams in the same broadcast domain with no boundary between them. Here is the VLSM plan:
- Engineering →
192.168.10.0/26— 62 usable hosts (fits 50 with growth room) - Sales →
192.168.10.64/27— 30 usable hosts (fits 30 exactly; consider a /26 for growth) - Operations →
192.168.10.128/27— 30 usable hosts (fits 20) - Branch link →
192.168.10.160/30— 2 usable hosts (the router pair)
Each block starts on a valid boundary (a multiple of the block size), the ranges do not overlap, and you still have address space left over in the upper part of the /24 for future subnets. Assign a firewall or router ACL between these subnets and you have segmentation, not just organization. You can check any of these calculations — ranges, masks, broadcast addresses — with our subnet calculator.
Common subnetting mistakes to avoid
- Off-by-two on host counts. Remember to subtract the network and broadcast addresses. A /28 gives 16 addresses but only 14 usable.
- Misaligned subnet boundaries. A subnet must start on a multiple of its block size.
192.168.1.32/26is invalid — a /26 block size is 64, so valid starts are .0, .64, .128, .192. - Sizing with no headroom. Fitting 30 devices into a /27 (30 usable) means the next device breaks. Leave growth room or step up a size.
- Oversizing point-to-point links. A router-to-router link needs 2 addresses. Use /30 or /31, never a /24.
- Assuming subnetting equals security. The boundary is only as strong as the firewall rule or ACL enforcing it. A subnet with a permit-any rule between it and the next is not segmented.
Key takeaways
Subnetting divides one IP network into smaller, isolated ones by moving the boundary between the network and host portions of the address. You do it to keep broadcast traffic contained (performance), to create lines a firewall can enforce (security), and to allocate addresses in right-sized blocks that mirror your real-world structure (efficiency). The math reduces to one rule — usable hosts equal 2 to the power of the host bits, minus 2 — and the practical skill is choosing the smallest prefix that fits each segment with room to grow.