Subnets

A subnet is an IP address range defined by a network prefix. Hosts in one subnet are often on the same local link, but physical proximity is not the definition: VLANs, tunnels, overlays, and routed links can change topology.

Prefixes and Masks

IPv4 can express a 24-bit prefix as either /24 or mask 255.255.255.0. In binary, a valid conventional subnet mask has contiguous ones followed by zeros:

11111111.11111111.11111111.00000000

For address 192.168.1.8/24, the network prefix is 192.168.1.0/24. Writing 192.168.1.0/255.255.255.0 is understood by some contexts, but CIDR prefix notation is the standard compact form.

Deciding Whether a Destination Is On-Link

Linux installs connected routes from interface addresses and prefixes. It compares a destination with eligible routes rather than merely comparing the first three decimal octets. For non-octet boundaries such as /20, the split occurs inside an octet.

Inspect connected routes and the decision for one address:

$ ip route show
$ ip route get 192.168.1.50

Routing Between Subnets

A router with suitable interfaces and routes can forward traffic between subnets. A default gateway is simply a next hop selected by a default route; it need not use the first usable address or end in .1.

Subnet separation creates a place to apply routing and filtering policy, but it is not automatically a security boundary. If forwarding is allowed without restrictive policy, hosts in different subnets can still communicate.

Reasons to Subnet

Subnetting can organize address allocation, limit link-layer broadcast scope, separate failure domains, and provide policy boundaries. It can also add routing, firewall, DHCP, monitoring, and documentation complexity. Design prefixes around actual scale, growth, redundancy, and security requirements rather than assuming smaller always means faster.

Summary

You can now relate an IPv4 prefix to local delivery and routed policy.

1. Express contiguous masks with CIDR prefix lengths.
2. Calculate the network prefix from address bits and mask.
3. Use routes to determine on-link versus next-hop delivery.
4. Treat subnet isolation as a policy opportunity, not a guarantee.