CCNA online course

What Is Subnetting? Purpose, Broadcast Domains, and IPv4 Subnets

Learn how IPv4 subnetting divides networks, reduces broadcast domains, supports routing and security, and helps design organized address plans.

Subnetting is the process of dividing one IP address block into multiple smaller logical networks. Each smaller network is called a subnet. Subnetting helps organizations control broadcast traffic, organize devices, design routes, and apply security policies.

This lesson focuses on IPv4 subnetting. You will learn how subnet masks and CIDR prefixes identify subnets, how to calculate host ranges, and how routers or Layer 3 switches connect different subnets.

What Is a Subnet?

An IPv4 subnet is a logical IP network identified by a network prefix and a subnet mask. Each subnet normally has:

• A network address, which identifies the subnet.
• A range of addresses that can usually be assigned to hosts.
• A broadcast address for ordinary IPv4 broadcast-capable subnets.
• A subnet mask or CIDR prefix length describing which bits identify the network.

A subnet is more specific than the general term network. A network might refer to an entire organization or address allocation, while a subnet is one defined portion of that allocation.

A VLAN is a Layer 2 segmentation method. A subnet is a Layer 3 IP network. In common designs, each VLAN is mapped to one IP subnet, but the terms do not mean the same thing. VLANs separate Ethernet broadcast domains, while subnetting defines IP network boundaries. A VLAN without a matching IP design, or multiple IP networks placed in one VLAN, can create operational complications.

Why Networks Are Subnetted

Reducing broadcast scope

Broadcast traffic is delivered to all applicable devices in a broadcast domain. A large, flat network causes more devices to receive and process each broadcast. Subnetting, when implemented with separate VLAN and Layer 3 boundaries, creates smaller broadcast domains.

Organizing devices and departments

Separate address ranges can represent departments, locations, device types, or services. For example, Accounting might use one subnet, Marketing another, and voice phones a third. An address plan becomes easier to understand and troubleshoot when each range has a documented purpose.

Supporting security policies

Subnet boundaries give routers, Layer 3 switches, access control lists (ACLs), and firewalls a point at which to inspect or restrict traffic. For example, a policy can allow Marketing to reach a shared web service while denying direct access to Accounting-only financial systems.

Improving routing design

Structured subnets make routing tables and address allocations easier to manage. Related subnets can sometimes be summarized into a larger route, reducing the amount of routing information exchanged between devices.

IPv4 Addressing Foundations

An IPv4 address is a 32-bit address normally written as four decimal octets, such as 10.0.0.25. Each octet represents eight bits and can contain a value from 0 through 255.

An address is divided into two logical portions:

• Network bits identify the subnet.
• Host bits identify an interface within that subnet.

The subnet mask tells devices where the network portion ends and the host portion begins. For example, 255.255.255.0 means the first 24 bits are network bits and the final 8 bits are host bits.

Important IPv4 addresses

• Network address: The first address in a subnet, with all host bits set to zero. It identifies the subnet and is not normally assigned to an ordinary host.
• Usable host address: An address assigned to an interface, such as a computer, printer, server, or router interface.
• Broadcast address: The last address in a traditional IPv4 subnet, with all host bits set to one. A host can send a broadcast to reach devices in that subnet.
• Default gateway: The local router or Layer 3 interface that a host uses to reach destinations outside its own subnet.

For most conventional IPv4 subnets, the all-zeros host value is reserved as the network address and the all-ones host value is reserved as the broadcast address. Special cases exist: a /31 is commonly used for point-to-point links and does not use the usual two-address reservation, while a /32 identifies one individual address and has no host range in the ordinary subnet sense.

Subnet Masks and CIDR Prefix Lengths

A subnet mask is a 32-bit value that marks network bits with binary ones and host bits with binary zeros. CIDR prefix notation expresses the number of network bits after a slash.

• 255.255.255.0 equals /24.
• 255.255.255.128 equals /25.
• 255.255.255.192 equals /26.

Increasing the prefix length borrows one or more host bits for the network portion. This creates more subnets, but each subnet contains fewer host addresses.

The basic capacity formulas are:

• Total addresses: 2^(host bits)
• Typical usable IPv4 host addresses: 2^(host bits) - 2

For a /26, there are 32 network bits plus 6 host bits. Therefore, it contains 2^6 = 64 total addresses and typically 64 - 2 = 62 usable host addresses.

Example: One Flat /24 Network

Consider the network 10.0.0.0/24, whose mask is 255.255.255.0. It has eight host bits.

• Network address: 10.0.0.0
• Usable host range: 10.0.0.1 through 10.0.0.254
• Broadcast address: 10.0.0.255
• Total addresses: 256
• Typical usable host addresses: 254

If all devices are in the same VLAN and subnet, they share one broadcast domain. A local broadcast can be forwarded by the switch to ports in that VLAN, causing every device in the domain to receive and process it.

Splitting a /24 into Two /25 Subnets

To divide 10.0.0.0/24 into two equal subnets, borrow one host bit. The new prefix is /25, with mask 255.255.255.128. Each child subnet contains 128 addresses.

The child networks are contained within the original 10.0.0.0/24 range, do not overlap, and together cover the parent range. If each child subnet is placed in a separate VLAN with a separate Layer 3 gateway, broadcasts remain within the appropriate child broadcast domain.

Changing from 10.0.0.0/24 to 10.1.0.0/24 does not split the first network. These are two different /24 networks within a larger address plan. A subnet split must produce child ranges contained inside the original parent range.

Broadcast Domains

An IPv4 broadcast domain is the Layer 2 scope in which a broadcast frame is propagated. Hosts in the same subnet generally receive and process local broadcast traffic, subject to their operating system and interface behavior.

• Switches normally forward broadcasts within the same VLAN.
• VLAN boundaries separate Layer 2 broadcast domains.
• Routers do not forward ordinary IPv4 broadcasts between subnets.
• A routed interface or Layer 3 switch interface commonly forms the gateway boundary for a subnet.

Subnetting reduces the number of devices affected by a broadcast only when the IP design is matched by actual Layer 2 and Layer 3 boundaries. Simply assigning different-looking IP addresses while leaving every port in one VLAN does not create the intended broadcast isolation.

Department Segmentation Example

Suppose an organization uses two /26 subnets from the 10.0.0.0/24 block:

Accounting uses host addresses 10.0.0.1 through 10.0.0.62, with broadcast 10.0.0.63. Marketing uses 10.0.0.65 through 10.0.0.126, with broadcast 10.0.0.127.

A router or Layer 3 switch provides the two gateways and routes traffic between the subnets. An ACL or firewall can allow Marketing to reach a shared HTTPS service, such as a server at 10.0.0.10, while denying other access to the Accounting range. The subnet boundary provides the policy enforcement point; the ACL or firewall rules provide the actual restriction.

How Hosts Reach Other Subnets

When a host needs to send traffic, it compares the destination address with its own address and subnet mask. If the destination is local, the host sends directly on the local network. If the destination is in another subnet, the host sends the frame to its default gateway.

Successful communication requires a correct IP address, subnet mask or prefix, default gateway, and routing information. The gateway interface must be active, and ACL or firewall policy must permit the traffic.

Optional Layer 3 VLAN Gateway Example

The following Cisco IOS-style example shows Layer 3 switch interfaces for the Accounting and Marketing subnets. It is illustrative rather than a complete switch configuration.

ip routing

interface vlan 10
 ip address 10.0.0.1 255.255.255.192
 no shutdown

interface vlan 20
 ip address 10.0.0.65 255.255.255.192
 no shutdown

show ip interface brief
show ip route

End devices must also be connected to the intended VLANs, and switch ports must be configured appropriately. The commands verify interface state and routing information; they do not by themselves configure VLAN membership or endpoint addressing.

Illustrative ACL policy

This simplified ACL permits Marketing HTTPS access to one Accounting host, denies other Marketing-to-Accounting traffic, and permits other traffic according to the remaining policy.

ip access-list extended MARKETING_TO_ACCOUNTING
 permit tcp 10.0.0.64 0.0.0.63 host 10.0.0.10 eq 443
 deny ip 10.0.0.64 0.0.0.63 10.0.0.0 0.0.0.63
 permit ip any any

In this example, the wildcard mask 0.0.0.63 corresponds to a /26 network. The ACL must be applied in the correct direction and on the correct interface. Production security designs should also account for return traffic, management access, logging, and the platform's implicit ACL behavior.

Variable-Length Subnet Masking

VLSM means Variable-Length Subnet Masking. It allows different subnet sizes within one address plan instead of assigning every group an identical range.

• A department needing about 50 hosts could receive a /26, providing 62 typical usable addresses.
• A small group needing about 10 hosts could receive a /28, providing 14 typical usable addresses.
• A point-to-point routed link might use a /30 or, where supported and appropriate, a /31.

VLSM conserves addresses, but every subnet must remain aligned to valid boundaries, contained within the planned parent block, and non-overlapping.

Subnetting Design Checklist

• Estimate current devices and expected growth.
• Include gateways, infrastructure interfaces, printers, phones, servers, and other required addresses.
• Choose a subnet size that meets capacity needs without creating unnecessarily large broadcast domains.
• Ensure subnet ranges do not overlap.
• Use consistent masks on hosts that are intended to share a subnet.
• Document the VLAN, subnet, gateway, usable range, purpose, DHCP scope, and access policy.
• Plan routing between subnets and decide where ACLs or firewalls will enforce policy.
• Use VLSM when groups have substantially different address requirements.

Verifying Addressing and Routes

Endpoint commands can confirm the local address, prefix or mask, gateway, and path toward another subnet.

ipconfig /all       # Windows
ip addr             # Linux
ip route            # Linux
ping <default-gateway-address>
tracert <remote-ip-address>       # Windows
traceroute <remote-ip-address>   # Linux and other Unix-like systems

Use the platform-specific command available on the device. Start by checking the local configuration, then test the default gateway, and finally trace the route to a remote address.

Troubleshooting Subnet Problems

Hosts that appear to be on the same LAN cannot communicate

• Compare the IP address and prefix or mask on both hosts.
• Calculate each host's network address and confirm that they match when direct communication is expected.
• Verify that both switch ports belong to the intended VLAN.
• Check local firewalls, switch-port status, and address conflicts.

A host reaches local devices but not another subnet

• Ping the default gateway.
• Check for a missing or incorrect default gateway.
• Confirm that the gateway interface is up and has the correct mask.
• Inspect the endpoint and router or Layer 3 switch routing tables.
• Use traceroute to identify where forwarding stops.
• Review ACL and firewall rules.

Intermittent connectivity or duplicate-address warnings

• Check for overlapping subnet assignments or duplicate IP addresses.
• Validate DHCP scope network, mask, excluded ranges, and default-router settings.
• Inspect ARP entries and address-management records.

Broadcast traffic remains excessive

• Verify that ports were actually divided into separate VLANs; different IP ranges alone are insufficient.
• Check broadcast and multicast counters on switch interfaces.
• Confirm that every intended subnet has its own Layer 2 broadcast domain and Layer 3 gateway.

Exam-Relevant Summary

• Subnetting divides one IP address block into smaller logical networks.
• The prefix length states how many of the 32 IPv4 bits belong to the network portion.
• A longer prefix creates more, smaller subnets.
• For ordinary IPv4 subnets, usable hosts are usually total addresses minus the network and broadcast addresses.
• Routers do not forward ordinary IPv4 broadcasts between subnets.
• Different subnets require a router or Layer 3 switch for communication.
• A default gateway is used for destinations outside the local subnet.
• VLANs commonly map one-to-one with IP subnets, but a VLAN and a subnet are different concepts.
• Subnetting creates boundaries for policy; ACLs and firewalls determine what traffic is actually allowed.
• Child subnets must be aligned, contained within the parent block, and non-overlapping.

Subnetting is therefore both an addressing technique and a network design tool. Correctly sized subnets create manageable broadcast domains, support structured routing, and provide clear points for security enforcement.