Subnetting

Subnetting

Subnetting divides an IP network into smaller logical sections called subnets. This structuring improves efficiency, isolates traffic, and defines boundaries between systems and functions.

A deep understanding of subnetting reveals how internal environments are organized, and how access and visibility are controlled across segments.

What Subnetting Enables

Subnetting assigns defined IP ranges to roles, departments, or zones. It introduces:

• Predictable address allocation
• Containment of broadcast traffic
• Segmentation between trust levels
• Flexible internal routing logic

Components of a Subnet

A subnet is a defined range of IP addresses divided into roles:

• The network address identifies the subnet itself.
• A host address is assigned to devices within the subnet.
• The default gateway forwards traffic beyond the subnet.

Address Type	Role	Example
Network Address	Identifies the subnet’s starting point	10.20.40.0
Host Address	Assigned to individual systems	10.20.40.17
Default Gateway	Sends traffic to external destinations	10.20.40.254

IP Addresses and Subnet Masks

An IPv4 address consists of 32 bits. A subnet mask determines how many bits define the network portion and how many are reserved for hosts.

Examples of subnet divisions:

• `/23` → 255.255.254.0 → 510 usable hosts
• `/26` → 255.255.255.192 → 62 usable hosts
• `/30` → 255.255.255.252 → 2 usable hosts

Smaller subnets reduce broadcast impact and expose fewer devices to lateral access.

Each octet in a subnet mask ranges from 0 to 255, depending on how many bits are allocated to the network portion.

Operational Relevance

Subnets reveal the boundaries of where one can move, what is reachable, and how systems relate to each other. Recognizing subnet layout supports:

• Identifying target clusters
• Locating edge devices and chokepoints
• Planning internal traversal across routing paths
• Matching IP observations to physical or functional layout

Example Layout

A segmented internal network might include:

Subnet	Function	Range
10.10.0.0/24	Core servers and directory services	10.10.0.1 – 10.10.0.254
10.10.1.0/25	General employee workstations	10.10.1.1 – 10.10.1.126
10.10.2.128/26	Printers and embedded devices	10.10.2.129 – 10.10.2.190
10.10.3.0/28	External-facing DMZ zone	10.10.3.1 – 10.10.3.14

Each of these zones may route differently, log independently, or apply unique firewall rules.

Strategic Benefits

• Minimized exposure – Only devices within the same subnet share direct access
• Tactical segmentation – Movement between zones requires deliberate routing
• Logical clarity – IP ranges reflect organizational structure

See Also

• IP Addressing
• CIDR Notation
• Routing Basics
• NAT
• LAN Topologies