Two devices on the same physical network may still be unable to communicate if they're on different logical subnets. This same subnet checker tells you instantly whether two IP addresses fall within the same network given a subnet mask or CIDR prefix. Enter both IPs and the mask below, and the tool performs a bitwise AND to derive each network address and compare them. This is the same operation routers and operating systems perform internally every time a packet is sent. For deeper context on how subnets work, also see the subnet calculator for full network calculations, or read our guide on what an IP address is and how addressing works.
A subnet (short for subnetwork) is a logical subdivision of an IP network. Subnetting divides a large network into smaller, more manageable segments. Each subnet is identified by a network address and a subnet mask. The subnet mask tells devices and routers which portion of an IP address identifies the network and which portion identifies the individual host within that network.
For example, in the address 192.168.1.100/24, the /24 means the first 24 bits identify the network (192.168.1) and the remaining 8 bits identify the host (.100). Any address from 192.168.1.1 to 192.168.1.254 is on the same subnet. An address like 192.168.2.100 is on a different subnet, even if it's plugged into the same switch.
Subnets serve several important purposes. They improve security by isolating groups of devices — traffic between subnets must pass through a router, where firewall rules can be applied. They reduce broadcast traffic: broadcasts only propagate within a subnet, not across routers. They also simplify network management by grouping devices logically (all printers on one subnet, all servers on another, all guest devices on a third).
Understanding subnets is foundational to configuring DHCP correctly, setting up port forwarding, and troubleshooting why devices that appear to be on the same network can't communicate. The default gateway is the router that connects subnets together — without it, devices on different subnets have no path to each other.
When a device wants to send a packet to another IP address, the very first thing it does is determine whether the destination is on the same subnet or a different one. This decision is made using the bitwise AND operation described below, and it determines whether the packet is sent directly to the destination or to the default gateway.
If the destination is on the same subnet, the device uses ARP (Address Resolution Protocol) to find the destination's MAC address and sends the frame directly. No router is involved. If the destination is on a different subnet, the device sends the packet to the default gateway, which then routes it toward the correct network.
This matters in practice because if two devices have mismatched subnet masks, their perception of "what's on my subnet" differs. Device A may think Device B is local and try to ARP for it directly, while Device B thinks Device A is remote and sends replies to the gateway — which then discards them. The result is a one-way communication failure or complete inability to communicate, even though both devices appear connected.
Common scenarios where this causes problems include manually configured static IP addresses with wrong subnet masks, DHCP servers configured with incorrect pool settings, and VLANs misconfigured on managed switches. You can access your router's admin panel to verify the DHCP scope and subnet mask your router is handing out.
The subnet check is performed using a bitwise AND between the IP address and the subnet mask. Here is a step-by-step example with two IP addresses and a /24 mask:
IP Address 1: 192.168.1.10 = 11000000.10101000.00000001.00001010 Subnet Mask: 255.255.255.0 = 11111111.11111111.11111111.00000000 AND Result: 192.168.1.0 = 11000000.10101000.00000001.00000000 IP Address 2: 192.168.1.200 = 11000000.10101000.00000001.11001000 Subnet Mask: 255.255.255.0 = 11111111.11111111.11111111.00000000 AND Result: 192.168.1.0 = 11000000.10101000.00000001.00000000 Both network addresses = 192.168.1.0 → SAME SUBNET ✓
Now with two addresses on different subnets:
IP Address 1: 192.168.1.10 → Network: 192.168.1.0 IP Address 2: 192.168.2.10 → Network: 192.168.2.0 192.168.1.0 ≠ 192.168.2.0 → DIFFERENT SUBNETS ✗
The AND operation works because the subnet mask has 1-bits in the network portion and 0-bits in the host portion. AND-ing with 1 preserves the bit; AND-ing with 0 clears it. The result retains only the network bits, zeroing out the host-specific bits. If two IPs produce the same result after AND-ing with the same mask, they're on the same network. If not, they're not.
For a visual tool that shows all network details, use the subnet calculator, which also shows the broadcast address, usable host range, and wildcard mask. To convert IPs to binary for manual verification, try the IP to binary converter.
CIDR Notation Quick Reference
| CIDR | Subnet Mask | Hosts per Subnet | Common Use |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,214 | Large ISP/enterprise |
| /16 | 255.255.0.0 | 65,534 | Mid-size enterprise |
| /24 | 255.255.255.0 | 254 | Home networks, small offices |
| /25 | 255.255.255.128 | 126 | Half a /24 |
| /28 | 255.255.255.240 | 14 | Small server subnet |
| /30 | 255.255.255.252 | 2 | Point-to-point links |
ARP (Address Resolution Protocol) is the mechanism by which devices discover each other's MAC addresses on a local network. When Device A wants to communicate with Device B and determines they're on the same subnet, it broadcasts an ARP request: "Who has IP 192.168.1.200? Tell 192.168.1.10." Device B responds with its MAC address, and Device A can then send frames directly.
However, ARP broadcasts do not cross routers. If Device A incorrectly believes Device B is on its local subnet when it isn't, it will ARP for Device B's MAC address — but Device B will never receive that broadcast because a router separates them. The ARP request goes unanswered, and the connection fails.
Conversely, when devices are correctly configured and know they're on different subnets, they send packets to the default gateway's MAC address (resolved via ARP for the gateway's IP). The router then forwards the packet toward the destination subnet. This is normal routed traffic — it works as long as the gateway knows a route to the destination network.
This is why the default gateway setting on every device must point to a router that is actually on the same subnet as that device. If a device has a gateway IP outside its own subnet, it cannot ARP for the gateway and has no path to any other network. The device will be isolated to its local subnet only. You can verify your router's subnet configuration by logging in at 192.168.1.1 or 10.0.0.1.
Subnet misconfiguration is one of the most common causes of networking problems that "should work but don't." Here are the most frequent scenarios and their fixes:
| Symptom | Likely Subnet Issue | Fix |
|---|---|---|
| Can't ping the default gateway | Device's subnet mask doesn't include the gateway IP in its network range | Correct the subnet mask on the device to match the router's network; verify via router admin panel |
| Device gets 169.254.x.x address (APIPA) | DHCP server unreachable — often because device is on wrong subnet or DHCP server is down | Check if device can reach DHCP server; verify subnet matches; restart DHCP service |
| Two devices can't ping each other | Devices on different subnets with no route between them | Put on same subnet, add static route on router, or configure inter-VLAN routing |
| Intermittent connectivity to one device | Duplicate IP or overlapping subnet causing ARP conflicts | Use this tool to verify no subnet overlaps; check for duplicate IPs with ARP scan |
| Device can reach internet but not local resources | Correct gateway but wrong local subnet mask — routes external traffic OK but fails local ARP | Correct subnet mask to match local network; /24 is typical for home networks |
| VPN users can't reach local LAN resources | VPN subnet overlaps with local subnet (e.g., both use 192.168.1.0/24) | Change VPN subnet assignment pool to a non-conflicting range |
The 169.254.x.x address range (APIPA — Automatic Private IP Addressing) deserves special mention. When Windows or macOS can't reach a DHCP server, they self-assign an address in this range with a /16 mask. Two devices both stuck on 169.254.x.x can actually talk to each other (they're on the same /16 subnet), but neither can reach the internet or a router since no gateway is configured. If you see this address, the primary problem is DHCP failure, not a subnet mismatch per se.
For networks using dynamic DNS, subnet changes can also break DDNS records — remember to update DNS entries if you renumber a subnet.
Once you've identified a subnet mismatch using this tool, here are the steps to resolve it:
ipconfig (Windows) or ip addr (Linux/Mac) to confirm the new settings, then ping the gateway to verify connectivity.If devices are in different physical locations and subnets need to remain separate, you'll need routing between them. The NAT and routing features of your router handle inter-subnet traffic, but only if both subnets are reachable from the router's perspective. Static routes or dynamic routing protocols (RIP, OSPF) are used in more complex multi-subnet environments. You can also check your router's admin password and security settings while you're configuring subnets.
Pro Tip: When troubleshooting network connectivity, always start by checking the subnet mask — not just the IP address. Two devices can have IPs that look similar (192.168.1.100 and 192.168.1.200) but be on completely different subnets if one has a /25 mask (255.255.255.128). The /25 mask splits the 192.168.1.0/24 network into two halves: .0–.127 and .128–.255. Those two IPs are on different halves and cannot communicate without a router.
Key Takeaways
Two IP addresses are on the same subnet when they share the same network address — the result of AND-ing each IP with the subnet mask. For example, 192.168.1.10 and 192.168.1.200 with a /24 mask both yield network address 192.168.1.0, so they're on the same subnet. Devices on the same subnet can communicate directly without a router. Devices on different subnets must route through a gateway.
Devices on different subnets cannot communicate directly. When Device A sends a packet to Device B on a different subnet, the OS detects the subnet difference and sends the packet to the default gateway (router) instead. The router then forwards it toward Device B's subnet. If no route exists between the subnets, or the gateway is misconfigured, the packet is dropped and communication fails. This is why the default gateway and subnet mask settings must be correct on every device.
A subnet mask is a 32-bit number that defines which portion of an IP address identifies the network and which portion identifies the host. It always consists of a contiguous block of 1-bits followed by 0-bits. Written in dotted decimal: 255.255.255.0 (for a /24 network). The 1-bits "mask" the network portion; the 0-bits reveal the host portion. When written as a CIDR prefix (e.g., /24), the number indicates how many leading 1-bits are in the mask.
Yes — through routing. A router or Layer 3 switch with interfaces (or sub-interfaces for VLANs) on both subnets can forward traffic between them. This is called inter-subnet routing or, for VLANs, inter-VLAN routing. The router applies firewall rules and access control lists to this traffic. Without a router connecting the subnets, the devices cannot exchange packets at all, regardless of how close they are physically.
A routing table is a database in a router (or host OS) that lists known networks and the next-hop path to reach them. When a packet arrives, the router looks up the destination IP in the routing table and forwards the packet to the appropriate interface or next-hop router. Home routers typically have a default route (0.0.0.0/0) pointing to the ISP gateway and a direct route for the local LAN subnet. More complex networks use static routes or dynamic routing protocols like OSPF or BGP to populate the table.
The 169.254.x.x range is APIPA (Automatic Private IP Addressing). Windows and macOS assign an APIPA address when DHCP fails — the device sent DHCP discovery broadcasts and received no response. Common causes: the DHCP server is down or unreachable, the device is on a different VLAN than the DHCP server with no DHCP relay configured, or the DHCP address pool is exhausted. Fix by restarting the router, checking DHCP pool settings, or assigning a static IP temporarily to diagnose the issue.
A VLAN (Virtual LAN) is a Layer 2 concept — it logically separates traffic on a switch into isolated broadcast domains, regardless of physical port. A subnet is a Layer 3 concept — it defines a range of IP addresses that share a network prefix. In practice, VLANs and subnets are typically paired: each VLAN gets its own subnet. Traffic within a VLAN/subnet is bridged (Layer 2); traffic between VLANs/subnets is routed (Layer 3) through a router or Layer 3 switch. VLANs without corresponding subnet separation, or subnets without VLAN isolation, can create security and routing issues.
 |
 |
 |
 |
About Tommy N.
Tommy is the founder of RouterHax and a network engineer with 10+ years of experience in home and enterprise networking. He specializes in router configuration, WiFi optimization, and network security. When not writing guides, he's testing the latest mesh WiFi systems and helping readers troubleshoot their home networks.
Promotion for FREE Gifts. Moreover, Free Items here. Disable Ad Blocker to get them all.
Once done, hit any button as below
|
|
|
|