A subnet is a block of consecutive IP addresses that share the same starting bits, written like 208.65.152.0/22, and routed or filtered as one unit.
Explanation
IP addresses are handed out and routed in blocks, not one at a time. The block is written in CIDR notation: an address followed by a slash and the number of fixed leading bits. A /24 fixes 24 of IPv4's 32 bits and leaves 8 free, which gives 256 addresses. A /22 gives 1,024, a /16 65,536. Routers, firewalls and reputation systems work on these blocks. One rule can cover a whole /24, and if one address in a datacenter range misbehaves, the whole range often gets flagged. Two real cases show why subnets matter. In February 2008 Pakistan Telecom announced 208.65.153.0/24, a narrower slice of YouTube's 208.65.152.0/22, to block YouTube at home. Routers prefer the most specific route, so the announcement leaked and drew much of the world's YouTube traffic to Pakistan for about two hours. In 2025, OONI proved throttling in Turkiye by comparing hosts on the same IP prefixes. Handshakes to twitter.com were far slower than to 19 other hostnames in the same blocks, so the slowdown could not be a problem with the addresses themselves. For proxy users, subnet reputation is why a whole range of datacenter addresses can meet the same CAPTCHA or firewall block.
In practice
OONI's November 2025 Turkiye report used subnets as a control group. Hosts in the same IP prefix share the same routes and links, so they should perform alike. When TLS handshakes to twitter.com were much slower than to 19 other hostnames in the same prefixes, the address range was ruled out as the cause. The filter had to be picking out the name. Comparing a site with its subnet neighbours is a simple way to tell throttling from congestion.
Sources: RIPE NCC — YouTube hijacking case study (2008) · OONI — Throttling of social media in Turkiye (20 Nov 2025)
Questions about Subnet
Related terms