Subnet (TCP/IP and routing)

Subnetting takes bits from the host portion of an IP address for the network portion. This increases the number of available networks, at the cost of the number of hosts per network.

From classful to classless

The original internet used a classful network model. IP addresses fell into classes (A, B, C), each with a fixed number of network and host bits. This system led to address waste and a growing amount of routing information worldwide.

The Internet Engineering Task Force (IETF) introduced Classless Inter-Domain Routing (CIDR) in 1993. This system replaced the rigid classful model and made flexible, class-independent IP address allocation possible. CIDR marked a turning point: more efficient address allocation and limiting the explosive growth of routing tables — a goal that RFC 1519 explicitly mentions.

The technical basis: RFC 1518 and RFC 1519

Two RFCs from September 1993 form the basis of CIDR:

• RFC 1518, An Architecture for IP Address Allocation with CIDR, by Y. Rekhter and T. Li — describes an architecture for IP address allocation with CIDR.
• RFC 1519, Classless Inter-Domain Routing (CIDR): an Address Assignment and Aggregation Strategy, by V. Fuller, T. Li, J. Yu and K. Varadhan — specifies the strategy for address assignment and aggregation.

CIDR notation

CIDR notation represents an IP address followed by a slash and a number: `192.168.1.0/24`. The number after the slash indicates the number of leading 1-bits in the subnet mask. With `/24`, the first 24 bits form the network portion; the remaining 8 bits are available for hosts. The subnet mask is then `255.255.255.0`.

This notation is standard in both IPv4 and IPv6 networks. It offers a compact way to indicate subnet size and network structure.

How a subnet mask works

The subnet mask determines which part of an IP address identifies the network and which part identifies the specific host. In a routing decision, the router only looks at the bits that match the network prefix as defined by the mask.

All addresses within the same prefix — thus within the same subnet — the router treats as one logical unit. With one route entry, a router reaches a whole range of IP addresses, instead of managing a separate route per address.

Steps: calculating and configuring subnets

Step 1: Determine the IP address block

Suppose you have the block `10.0.0.0/16`. This offers 65,536 IP addresses. You want to divide this into smaller subnets for departments.

Step 2: Choose the subnet size

Each department has a maximum of 200 devices. A `/24` subnet offers 254 usable hosts — sufficient. The block `10.0.0.0/16` contains 256 `/24` subnets: `10.0.0.0/24` to `10.0.255.0/24`.

Step 3: Calculate the subnet mask

For a `/24` subnet, the mask is `255.255.255.0`. The network address of the first subnet is `10.0.1.0`, the broadcast address `10.0.1.255`. Usable hosts: `10.0.1.1` to `10.0.1.254`.

Step 4: Assign subnets

Assign:

• ICT: `10.0.1.0/24`
• Production: `10.0.2.0/24`
• Guests: `10.0.3.0/24`

Step 5: Configure the router

On a Linux router with `iproute2`, you add routes:

ip route add 10.0.1.0/24 dev eth1
ip route add 10.0.2.0/24 dev eth2
ip route add 10.0.3.0/24 dev eth3

Step 6: Apply route aggregation

Instead of three routes, you can aggregate into one route:

ip route add 10.0.0.0/16 dev eth0

The router sends all traffic for `10.0.0.0/16` to the correct interface. This is called supernetting.

Step 7: Firewall rules per subnet

Apply policy per subnet with `iptables` (version 1.8.7 or newer):

iptables -A FORWARD -s 10.0.1.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.2.0/24 -j DROP
iptables -A FORWARD -s 10.0.3.0/24 -j ACCEPT

Step 8: Route traffic between subnets

Traffic between subnets goes through the router. Devices within the same subnet communicate directly via local switches.

Longest prefix match

Routers use routing tables that link network prefixes in CIDR notation to outgoing interfaces or next-hop addresses. When a packet arrives, the router looks up the longest matching prefix in the table — this is called longest prefix match.

For example: `192.168.1.100` belongs to `192.168.1.0/24`. The router sends the packet via the interface linked to that prefix.

Determining Subnet Size

The right subnet size is a design consideration. Subnets that are too large lead to broadcast traffic problems and security risks — all devices are in the same broadcast domain. Subnets that are too small result in a lack of addresses when adding new devices.

Use a subnet calculator to strike a balance between availability, security, and efficiency.

Security and Monitoring

Separating subnets enables targeted policies: firewall rules, access control, or QoS settings per subnet. This gives you control over who can do what on the network.

When monitoring with `traceroute` or `pathping`, you can see at which hop — and therefore in which subnet — delays or packet loss occur.

Common Problems

Problem: no connection between two subnets Check whether the router has a route for both subnets. Use `ip route show` and add missing routes with `ip route add`.

Problem: broadcast storm in a subnet that is too large Make the subnet smaller. Split a `/16` into `/24` subnets and add firewall rules to limit broadcast traffic.

Problem: IP address conflict within a subnet Check with `arp-scan` (version 1.9.3 or newer) whether there are duplicate addresses:

arp-scan --interface=eth0 10.0.1.0/24

Verification

Check whether your subnet configuration works:

ip route show
ip addr show
ping -c 4 10.0.1.1
traceroute 10.0.2.1

The first two commands show your routes and interfaces. `ping` confirms connectivity within a subnet. `traceroute` shows the hops between subnets.

The Core

Subnetting is a logical and necessary part of any serious network. From small office environments to large data centers and internet service providers: wherever IP traffic is routed, subnets apply. The principles have remained largely unchanged since 1993.

The question is not whether you need subnetting, but how you optimize the design for your specific traffic patterns and security requirements — and that remains a design decision that every network administrator must make anew.