Subnet

All computers on the same network can directly send packets to eachother. When one sends a broadcast packet, all the rest get that packet (that is to say, they're all on the same "broadcast domain" -- aka "VLAN").

Routers connect networks together.

Typcially, a bunch of computers connected to eachother in one room form a network. Also typical is to assign them rfc1918 "reserved" addresses (look up that RFC for more info on those special IP addresses). Perhaps one computer on that network connects that network to the rest of the internet -- this computer is the so-called "gateway". It's performing routing, and is a router. Note, it's configured to not forward packets addressed to an rfc1918 address.

A subnet is a network, and is the set of all network interfaces which have the same network address. You usually have one subnet per VLAN. If a machine on that subnet needs to talk to another machine on the subnet, it delivers the packet directly. Packets destined for other machines need to go through the gateway.

Determining the network address

To determine the network address we use a subnet mask, or "netmask". This is a binary number that is used to "mask" an IP address into network and host address portions.

For example, an IPv4 IP address and subnet mask are both 32 bits long. Take an address such as:

209.152.163.16

In binary this is:

11010001 10011000 10100011 00010000

The subnet mask is given as either a dotted decimal or in CIDR notation (using a bit count). For example, the Class B subnet mask is:

255.255.0.0

In binary this is

11111111 11111111 00000000 00000000

i.e. a string of 16 1's, followed by 0's. The CIDR representation is given as a forward-slash followed by the number of 1's:

/16

It is often appended to the end of the IP address.

209.152.163.16/16

The subnet mask is used to determine the network and host portions of an IP address in the following ways:

To determine the network address, apply a binary AND operation to the IP address and the subnet mask:

11010001 10011000 10100011 00010000
11111111 11111111 00000000 00000000
-----------------------------------
11011001 10011000 00000000 00000000

Converting this back to dotted decimal gives us a network address of:

209.152.0.0

All network interfaces and computers that have this network address can be said to share the same subnet.

More complex subnets

Whilst this is a fairly trivial example, more complex subnets can be created by using a subnet mask that does not end on a margin between dotted decimal numbers.

A subnet mask of:

11111111 11111111 11100000 00000000

is

255.255.224.0

in dotted decimal, or

/19

as a bit count. This type of subnetting is usually done by network administrators to create a number of subnetworks within a single class.