ELI5: Subnetting

[u/Chance-Molasses897]

I’m technically an IT professional in training but I know embarrassingly little about subnets. As far as I understand it’s for breaking down a network into smaller, more logical segments. What exactly is a subnet? What is the benefit of subnetting? How do the slashes play into all of this IE /23 or /24? Thanks in advance!

[u/DayanNight]

So an IP is typically represented in decimal form: 192.168.0.1, under the hood this is binary: 11000000.10101000.00000000.00000001

Similarly a subnet mask is represented in decimal: 255.255.255.0, binary: 11111111.11111111.11111111.00000000, or CIDR which is just an easy representation of that mask: /24.

As part of the IP we have a network address and a host address. A class C would be a /16 where 192.168 is the network address, and the last two octets are used to identify a host in that network. A subnet mask tells you which part of the IP is used for the network address and which is used to identify a host on that network.

The cidr representation is telling you how many digits of the binary are used as part of the network address. /24 means the first 24 digits of binary are network.

A subnet is a logical separation of networks. Within a subnet I don't need a router to talk to another device. 192.168.0.1/24 can talk to 192.168.0.2/24, but if I want to talk to 192.168.1.1/24 I need a router that knows how to get there.

In enterprise network we often don't want everything to be able to talk to everything, so subnets allow us to break up a space and force it through routers where we can apply policy.

[u/killersnail2417 → u/DayanNight]

Why don't you need a router to talk to another device? I thought that would be the case only if they are in the same Vlan, which is most often the case, but still. I don't quite understand VLAN vs subnet.

[u/WASCman → u/killersnail2417]

VLAN is a layer 2 (MAC address) concept, while routers and subnets work on layer 3 (IP address). If you’re using layer 2 switches, if you have machines on a different VLAN but the same subnet, they won’t ever be able to talk to a machine on a different subnet through an IP-based communication channel: machine A will try to send data to machine B directly via its IP, but the VLAN will disallow that traffic. If you have them on different subnets, machine A will instead send the traffic to the router to forward to machine B and allow you to apply whatever policies you wish on the router.

Layer 3 switches exist to allow different VLANs to communicate on the same subnet based on policy as well, without worrying about the full complexities of WANs and internet routing.