Subnetting divides a network into smaller ranges by applying a subnet mask to an address. Each subnet becomes its own broadcast domain, so traffic inside it stays local and traffic between subnets passes through a router where rules and logging can be applied.
Subnetting is the original way to separate cameras from office computers, and it remains the layer underneath almost every segmentation design. It is also a setting that breaks camera installations, because a mask that does not match the rest of the network keeps a device from reaching its gateway.
Masks and address ranges
A mask such as 255.255.255.0 places the first three octets in the network portion and leaves the last for hosts. A longer mask allows more subnets with fewer hosts in each.
Why camera systems are separated
A camera subnet limits broadcast traffic and confines what an infected device can reach. Traffic between subnets then passes the firewall, where access rules belong.