What Is a Subnet ID? Explained Simply

Our stake is in the second half of that: we are Geonode and we sell proxies. The honest point is that subnet diversity is a genuine quality signal and pool size is mostly a marketing number — and this cuts against the whole industry, ours included, because "150 million IPs" is far easier to put on a landing page than "our addresses span N distinct /24s in the countries you need". If you take one thing from this article, make it the question to ask a provider: not how many addresses, but how they are distributed. That is a harder question to answer and a more useful one.

The Basic Idea

Every IP address does two jobs at once. Part of it says which network the machine is on; the rest says which machine on that network.

192.168.10.42
└──────┘ └─┘
 network  host

Where the split falls is not fixed. It is defined by the subnet mask, or equivalently by the prefix length in CIDR notation. The network part is the subnet ID — sometimes called the network address or network prefix — and it is the same for every machine on that subnet.

Routers care about this because it lets them make decisions in bulk. A router does not need a rule per address; it needs a rule per network. That aggregation is the entire reason the internet's routing tables are a manageable size.

CIDR Notation, Which Is How This Is Actually Written

Modern practice writes the split explicitly. RFC 4632 defines the format:

a prefix is shown as a 4-octet quantity, just like a traditional IPv4 address or network number, followed by the "/" (slash) character, followed by a decimal value between 0 and 32 that describes the number of significant bits.

So 192.168.99.0/24 means the first 24 bits are the network and the remaining 8 identify hosts. The RFC gives the mapping from the older class system: the legacy "Class B" network 172.16.0.0 with mask 255.255.0.0 is 172.16.0.0/16, and the legacy "Class C" 192.168.99.0 is 192.168.99.0/24.

The advantage over the old fixed classes, in the RFC's words: "Using classless prefixes with explicit prefix lengths allows much more flexible matching of address space blocks according to actual need. Where formerly only three network sizes were available, prefixes may be defined to describe any power of two-sized block of between one and 2^32 end system addresses."

Two addresses in each ordinary subnet are not usable for hosts: the first is the subnet ID itself and the last is the broadcast address. Hence 254 rather than 256 in a /24.

The smaller the prefix number, the larger the block. A /8 is enormous — the RFC notes that IANA allocates to Regional Internet Registries "in contiguous bit-aligned blocks of 2^24 addresses (a.k.a. /8 prefixes)", which the RIRs then subdivide.

How to Calculate a Subnet ID

The mechanical answer: a bitwise AND of the address and the mask.

For 192.168.10.42/24:

address  11000000.10101000.00001010.00101010
mask     11111111.11111111.11111111.00000000
AND      11000000.10101000.00001010.00000000
       = 192.168.10.0

The subnet ID is 192.168.10.0, the broadcast address is 192.168.10.255, and usable hosts run from .1 to .254.

On a prefix that does not fall on an octet boundary the arithmetic is less obvious. For 192.168.10.42/26, the mask is 255.255.255.192, so the final octet is split with 2 network bits and 6 host bits. That gives four subnets of 64 addresses each, with boundaries at 0, 64, 128 and 192. Since 42 falls in the first block, the subnet ID is 192.168.10.0 and the broadcast is 192.168.10.63.

In practice, let a tool do it:

ipcalc 192.168.10.42/26

Or in Python:

import ipaddress
net = ipaddress.ip_network('192.168.10.42/26', strict=False)
print(net.network_address)    # 192.168.10.0
print(net.broadcast_address)  # 192.168.10.63
print(net.num_addresses)      # 64

The strict=False matters: it tells the library you are giving it a host address and want the containing network, rather than asserting that the address is a network.

Private Ranges and Why You See Them Everywhere

Three ranges never appear on the public internet. RFC 1918 reserves them:

10.0.0.0    - 10.255.255.255   (10/8 prefix)
172.16.0.0  - 172.31.255.255   (172.16/12 prefix)
192.168.0.0 - 192.168.255.255  (192.168/16 prefix)

The RFC describes these as the "24-bit block", the "20-bit block" and the "16-bit block", and notes that an enterprise using them "can do so without any coordination with IANA or an Internet registry."

Practical consequences worth knowing:

They are not routable across the internet. Every home router in the world hands out 192.168.x.x addresses, and none of them collide, because none of them leave the building.

A proxy returning one of these as your "external IP" is misconfigured. If a lookup service reports a 10.x or 192.168.x address, something in the path is reporting an internal address rather than a public one.

They matter for NO_PROXY configuration. Excluding private ranges from proxying is standard practice, and getting it wrong is a common cause of internal services mysteriously routing through an external proxy.

Why Subnets Matter for Proxies

Here is where a networking concept becomes a purchasing decision.

Blocking happens at subnet level. When a site decides an address is a problem, blocking the single address is often pointless, because the operator has 253 more in the same block. So the practical response is to block the range — commonly the /24, sometimes larger. This is standard defensive practice and it is entirely rational from the site's perspective.

The consequence for you: if your proxy pool consists of many addresses within a few subnets, it behaves like a very small pool. Fifty addresses in 203.0.113.0/24 are, from a blocking perspective, closer to one address than to fifty. You can burn all of them with a single misjudged request rate.

Which is why pool size is a poor metric. "10 million IPs" tells you nothing about distribution. A pool of ten thousand addresses spread across four thousand distinct /24s is more resilient than a pool of a million concentrated in a few hundred. Consecutive addresses are cheap for a provider to acquire and correlated in exactly the way that matters.

Datacentre and residential differ structurally here. Datacentre addresses are allocated to hosting providers in contiguous blocks, which is why they are both cheap and easy to identify and block wholesale — a site can block a hosting provider's entire allocation with a handful of rules. Residential addresses come from consumer ISPs, distributed across many blocks, assigned dynamically, and mixed in with ordinary users. That distribution is a substantial part of what you pay extra for.

Subnet diversity also affects how you should rotate. Rotating through addresses within one /24 is not really rotating. If your provider gives you visibility into the blocks, spread your requests across them rather than through them sequentially.

Checking Subnet Diversity in a Pool

Worth doing during a trial, before committing.

Collect a sample of exit addresses and count the distinct /24s:

for i in $(seq 1 200); do
  curl -s -x "$PROXY" https://api.ipify.org
  echo
done | sort -u > ips.txt

wc -l < ips.txt                                   # distinct addresses
cut -d. -f1-3 ips.txt | sort -u | wc -l           # distinct /24 blocks

The ratio is the number you care about. Two hundred unique addresses across one hundred and eighty /24s is a well-distributed pool. Two hundred addresses across six /24s is a much smaller pool than it appears.

Extend it to /16s for a coarser view:

cut -d. -f1-2 ips.txt | sort -u | wc -l

And check the autonomous system numbers if you can, since a pool spread across many /24s that all belong to one operator is less diverse than the subnet count suggests. whois on a sample of addresses will tell you.

Do this per country, not in aggregate. A pool with excellent diversity globally may be concentrated in the one location you actually need — and an aggregate figure hides that completely, which is the same silent-failure problem we described in why testing proxies matters.

Above the Subnet: ASNs, WHOIS and Geofeeds

Subnets are one level of a hierarchy, and the levels above them matter just as much for how an address is judged.

Regional registries allocate downward. RFC 4632 describes the chain: IANA allocates /8 blocks to Regional Internet Registries, and the RIRs "in turn, allocate or assign smaller address blocks" onward. So every public address sits inside a nested set of allocations, and each level is a matter of public record.

WHOIS tells you who holds a block. Querying an address returns the allocation it belongs to, the organisation, the country and usually a contact. This is how anyone determines whether an address belongs to a hosting provider or a consumer ISP — it is not inference, it is a lookup:

whois 203.0.113.10 | grep -iE 'netname|orgname|country|cidr'

Autonomous System Numbers group blocks by operator. An AS is a set of prefixes under one routing policy, and a single operator may announce hundreds of separate blocks under one ASN. This is the level at which wholesale blocking usually happens for datacentre traffic: a site does not enumerate a hosting provider's /24s, it blocks the ASN.

The practical implication for pool assessment is that /24 diversity is necessary and not sufficient. Four hundred distinct /24s that all sit under one hosting ASN can be blocked with a single rule. Checking the ASN spread of a sample is a second, coarser test worth running alongside the subnet count:

for ip in $(head -50 ips.txt); do
  whois "$ip" | grep -iom1 'AS[0-9]\+'
done | sort | uniq -c | sort -rn

Geofeeds are how location data gets corrected. Network operators can publish a machine-readable file mapping their prefixes to locations, standardised in RFC 8805, and geolocation vendors ingest them. This explains a phenomenon that otherwise looks like vendor incompetence: two geolocation databases disagreeing about the same address, because one has ingested a recent geofeed update and the other has not. Since geolocation is per-prefix rather than per-address, a whole subnet moves location at once when a correction lands.

Reputation is inherited both ways. An address inherits from its /24, its larger allocation and its ASN. It also contributes back. This is why a well-behaved user on a shared residential pool can be affected by someone else's behaviour hours earlier, and why "the proxy stopped working" is so often nothing the user did.

For anyone assessing a pool, the resulting checklist is short: count distinct /24s in a sample, count distinct ASNs, check that the WHOIS entries look like consumer ISPs rather than hosting companies if you are paying for residential, and repeat all of it per country rather than in aggregate.

IPv6 Changes the Arithmetic

Briefly, because it is increasingly relevant.

IPv6 uses the same CIDR notation with prefix lengths up to 128. The conventional allocations are much larger: a single end site typically receives a /48 or /56, and a single network segment is conventionally a /64 — which contains more addresses than the entire IPv4 internet.

Two consequences for anything involving reputation:

A /64 is the meaningful unit, not a single address. Because one subscriber controls the whole /64, blocking a single IPv6 address accomplishes nothing. Sites that handle IPv6 sensibly track reputation at /64 or coarser.

Vast address counts mean nothing on their own. A provider advertising an enormous number of IPv6 addresses may be advertising a single /64. The relevant question is how many distinct /64s, or better /48s, the pool spans.

People Also Ask

What is a subnet ID?

The portion of an IP address that identifies the network rather than the individual host. It is obtained by applying the subnet mask to the address, and every machine on that subnet shares it. In CIDR notation it is written with a prefix length, as in 192.168.10.0/24.

How do I calculate the subnet ID from an IP address?

Perform a bitwise AND between the address and the subnet mask. For 192.168.10.42/24 the mask is 255.255.255.0, giving 192.168.10.0. For non-octet-aligned prefixes, use a tool — ipcalc, or Python's ipaddress.ip_network(addr, strict=False).

What does /24 mean in an IP address?

That the first 24 bits are the network prefix, leaving 8 bits for hosts. A /24 contains 256 addresses of which 254 are usable, since the first is the subnet ID and the last is the broadcast address. It corresponds to the mask 255.255.255.0.

Why do websites block whole subnets?

Because blocking a single address rarely helps when the operator controls the other 253 in the same block. Blocking the range is the effective response and it is standard practice. This is exactly why concentrated proxy pools behave like much smaller pools than their address count suggests.

How many subnets should a proxy pool cover?

There is no single number, but the ratio is what matters: sample a few hundred exit addresses and count distinct /24s. A high ratio of blocks to addresses indicates genuine diversity. Measure it per country rather than in aggregate, because a pool can be diverse globally and concentrated exactly where you need it.

Is subnet diversity more important than pool size?

For resilience against blocking, yes. Addresses in the same /24 are correlated — one block can take out all of them. Consecutive addresses are also the cheapest kind for a provider to acquire, so a large pool with poor diversity is both easy to advertise and less useful than it looks.

What are private IP ranges?

10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, reserved by RFC 1918 for internal use and never routed on the public internet. Any organisation may use them without coordination. If a proxy reports one of these as your external address, something in the configuration is wrong.

Does subnetting work differently with IPv6?

The notation is identical but the scale is not. End sites typically get a /48 or /56 and a single segment is a /64, which is larger than the whole IPv4 internet. Because one subscriber controls an entire /64, reputation and blocking operate at /64 or coarser — so raw IPv6 address counts are close to meaningless.

Wrapping Up

The subnet ID is the network half of an IP address, determined by the mask or the CIDR prefix length. That is a small idea, and the arithmetic behind it is a bitwise AND you can do with a one-line script.

What makes it worth understanding outside a networking course is that the internet treats subnets as units. Routers aggregate by them, registries allocate by them, and — the part that matters commercially — sites block by them. An address is rarely judged entirely on its own merits; it inherits the reputation of its neighbours.

So when you are evaluating addresses to buy, the question that separates a good pool from a padded one is distribution rather than count. Sample a few hundred exits, count the distinct /24s, do it per country, and compare that ratio across providers. It takes ten minutes, it is the number vendors do not put on landing pages, and it predicts how the pool will behave far better than the headline figure does.