What Is a Subnet?

A subnet, short for subnetwork, is a logical slice of a larger IP network defined by a network address and a mask or CIDR prefix. It groups addresses so routers can keep local traffic inside one segment. Advertisers see subnets when fraud tools or Google Ads exclusions refer to whole IP ranges instead of one address at a time.

Subnetting is how IPv4 blocks are divided into smaller pieces, and how office, cloud, and hosting networks stay organized. You do not need to design subnets to run ads, but the idea explains why bad clicks often arrive in clusters from the same block.

How subnetting works

An IPv4 address has a network part and a host part. A subnet mask (for example 255.255.255.0) or a CIDR prefix such as /24 marks where that split sits. Devices on the same subnet can talk directly. Traffic to another subnet goes through a router.

CIDR notation states how many bits identify the network. A /24 leaves 8 bits for hosts, which is up to 254 usable addresses in common private ranges. A /16 is much larger. Variable-length masks let operators size segments differently: a point-to-point link might be /30 while a user VLAN is /23.

IPv6 still uses subnets for structure even though address exhaustion is less of a driver than in IPv4. The same idea applies: a prefix defines a group of addresses that belong together for routing and policy.

A simple subnet example

Take 192.168.1.0/24. The network address is 192.168.1.0. Hosts might be 192.168.1.10 and 192.168.1.50. The broadcast address sits at the end of the block. From outside, that whole /24 looks like one neighborhood on the internet, even when dozens of devices sit behind it.

Public internet blocks work the same way at larger scale. A hosting provider or mobile carrier publishes prefixes. Scrapers, proxies, and click farms often rent or compromise many addresses inside one of those prefixes, so the pattern shows up as a subnet, not as a lone IP.

Why subnets matter for click fraud and bot traffic

Fraud and bot traffic often cluster by network. Detection systems combine IP data with ASN and ISP context. A compromised hosting slice or a residential proxy pool can share timing, user agents, or suspicious behavior across many addresses in the same range.

That is why exclusion and scoring talk about ranges. Blocking one IP after a bad click can miss the next address two hops away in the same /24. Understanding subnets clarifies reports that list CIDR blocks next to invalid-click volume, and why click fraud defense looks at neighborhoods as well as single hosts.

How advertisers use subnet patterns day to day

Most marketers never configure a router. They meet subnets in exclusion lists, fraud dashboards, and Google Ads IP tools. When a protection platform flags a range, the practical step is often to exclude or monitor that block, then check whether conversions or lead quality improve. Guides such as how to exclude IP addresses in Google Ads show the account-side mechanics.

Treat range exclusions carefully. A large consumer ISP subnet can hold real customers next to a few bad actors. Prefer evidence from multi-signal scoring over a single bad click, and document why a block was added so agency teams can revisit it later. Related reading: ad fraud and how we detect fraud.