JavaScript (Node.js), 58 bytes

a=>a.split(/\D/).map(t=>[b=+t&&a>>>-t,a^=t<<8*i--],i=7)|!b

Try it online!

two args for compare

JavaScript (Node.js), 68 bytes

a=>b=>(i=7,a+!1+b).split(/\D/).map(t=>[b=+t&&a>>>-t,a^=t<<8*i--])|!b

Try it online!

Pip, 29 bytes

$=Z:Z J*TBg@XI+E8TM1,0Hb@XI@v

Returns 1 for matching, 0 for not matching. Attempt This Online!

Explanation

Hey, the operator precedence worked out nicely this time.

$=Z:Z J*TBg@XI+E8TM1,0Hb@XI@v
          g                    List of both command-line args
           @XI                 In each, find all regex matches of integers
              +E8              To each, add 256
        TB                     Convert to binary
                 TM1,0         Trim the leftmost character from each
                               (Add 256 and trim is necessary to pad each to 8 bits)
      J*                       Join each processed arg into a single bitstring
    Z                          Zip the two bitstrings together
                      H        Take this many of those pairs:
                       b         Second command-line arg
                        @XI      Find all regex matches of integers
                           @v    Get the last one
  Z:                           Zip again into a list of two lists of bits
$=                             Are both lists equal?

Note that the subnet also gets converted to binary with the second address, but the zipping step gets rid of it, so it doesn't matter.

Ruby (48 bytes)

require 'ipaddr'
lambda{|a,m|IPAddr.new(m)===a}

C# (Visual C# Interactive Compiler), 134 bytes

a=>a.Select(x=>x.Split('.','/').Take(4).Aggregate(0L,(y,z)=>y<<8|int.Parse(z))>>32-int.Parse(a[1].Split('/')[1])).Distinct().Count()<2

Try it online!

LINQ statement that takes a 2-element string array as input in [address, subnet] format.

Each dotted quad is converted into 32 bits of a long using bit manipulation. The bits are right shifted by the subnet size and elements are compared for equality.

There were a couple of C# answers at the time that this answer was posted, but none that used pure bit manipulation.

// a: input array containing address and subnet
a=>a
  // iterate over input elements
  .Select(x=>x
    // split element on . and /
    .Split('.','/')
    // the subnet will have 5 elements,
    // we only want the parts before the /
    .Take(4)
    // use an aggregate function to convert dotted quad to 32 bits
    .Aggregate(0L,(y,z)=>y<<8|int.Parse(z))
    // shift bits of aggregate to the right
    >>
    // shift amount determined by subnet size
    32-int.Parse(a[1].Split('/')[1])
  )
  // test for equality by checking if number
  // of unique values is equal to 1
  .Distinct()
  .Count()<2

Japt, 26 bytes

Ëq'/
ËÎq. Ë°¤ù8ì¯Ug1,1Ãr¶

Try it

-3 bytes thanks to @Shaggy!

Input is an array with 2 elements [address, subnet]. Transpiled JS below:

// U: implicit input array
// split elements in U on the / and
// save back to U using a map function
U = U.m(function(D, E, F) {
  return D.q("/")
});
// map the result of the previous operation
// through another function
U.m(function(D, E, F) {
  return D
    // get the address portion of the / split
    // value and split again on .
    .g().q(".")
    // map each octet through another function
    .m(function(D, E, F) {
      // convert the octet to a base 2 string
      // left padded to a length of 8
      return (D++).s(2).ù(8)
    })
    // join the base 2 octets
    .q()
    // take the left bits of the joined octets
    // determined by subnet size
    .s(0, U.g(1, 1))
})
  // at this point, the intermediate result
  // contains 2 masked values, reduce
  // using === to check for equality
  .r("===")

Charcoal, 36 bytes

≔⪪Ｓ/θ≔Ｉ⊟θζ⊞θＳＵＭθ÷↨Ｉ⪪ι.²⁵⁶Ｘ²⁻³²ζ⁼⊟θ⊟θ

Try it online! Link is to verbose version of code. Takes the subnet as the first parameter and and outputs - only if the address lies within the subnet. Explanation:

≔⪪Ｓ/θ

Split the subnet on /.

≔Ｉ⊟θζ

Remove the mask and cast it to integer.

⊞θＳ

Push the address to the array.

ＵＭθ÷↨Ｉ⪪ι.²⁵⁶Ｘ²⁻³²ζ

Split both addresses on ., convert them to integers, interpret as base 256, and discard the masked bits.

⁼⊟θ⊟θ

Compare the two values.

x86-64 machine code function, 53 48 bytes

changelog:

• -2 jz over the shift instead of using a 64-bit shift to handle the >>(32-0) special case.
• -3 return in ZF instead of AL, saving 3 bytes for a setnz al.

(See also Daniel Schepler's 32-bit machine code answer based on this, which then evolved to use some other ideas we had. I'm including my latest version of that at the bottom of this answer.)

Returns ZF=0 for host not in subnet, ZF=1 for in subnet, so you can branch on the result with je host_matches_subnet

Callable with the x86-64 System V calling convention as
bool not_in_subnet(int dummy_rdi, const char *input_rsi); if you add in setnz al.

The input string contains both the host and network, separated by exactly 1 non-digit character. The memory following the end of the CIDR width must contain at least 3 non-digit bytes before the end of a page. (Shouldn't be a problem in most cases, like for a cmdline arg.) Daniel's 32-bit version doesn't have this limitation.

We run the same dotted-quad parse loop 3 times, getting the two IPv4 addresses, and getting the /mask as an integer in the high byte of a dword. (This is why there has to be readable memory after the /mask, but it doesn't matter if there are ASCII digits.)

We do (host ^ subnet) >> (32-mask) to shift out the host bits (the ones allowed to mismatch), leaving only the difference between the subnet and the host. To solve the /0 special case where we need to shift by 32, we jump over the shift on count=0. (neg cl sets ZF, which we can branch on and leave as the return value if we don't shift.) Note that 32-mask mod 32 = -mask, and x86 scalar shifts mask their count by & 31 or & 63.

    line  addr   machine                NASM source.  (from nasm -felf64 -l/dev/stdout)
    num          code bytes

     1                             %use smartalign
     2                             
     3                                 ;10.4.1.33 10.4.0.0/23         true
     4                                 ;10.4.1.33 10.4.0.0/24         false
     5                             
     6                             ;; https://codegolf.stackexchange.com/questions/185005/im-in-your-subnets-golfing-your-code
     7                             %ifidn __OUTPUT_FORMAT__, elf64
     8                             in_subnet:
     9                             
    10 00000000 6A03                   push 3
    11 00000002 5F                     pop  rdi                    ; edi = 3 dotted-quads to parse, sort of.
    12                             .parseloop:
    13                             
    14                                 ;xor  ebx,ebx             ; doesn't need to be zeroed first; we end up shifting out the original contents
    15                                 ;lea  ecx, [rbx+4]
    16 00000003 6A04                   push   4
    17 00000005 59                     pop    rcx                  ; rcx = 4 integers in a dotted-quad
    18                             .quadloop:
    19                             
    20 00000006 31D2                   xor   edx,edx               ; standard edx=atoi(rdi) loop terminated by a non-digit char
    21 00000008 EB05                   jmp  .digit_entry
    22                              .digitloop:
    23 0000000A 6BD20A                 imul   edx, 10
    24 0000000D 00C2                   add    dl, al
    25                              .digit_entry:
    26 0000000F AC                     lodsb
    27 00000010 2C30                   sub    al, '0'
    28 00000012 3C09                   cmp    al, 9
    29 00000014 76F4                   jbe   .digitloop
    30                                 ; al=non-digit character - '0'
    31                                 ; RDI pointing to the next character.
    32                                 ; EDX = integer
    33                             
    34 00000016 C1E308                 shl    ebx, 8
    35 00000019 88D3                   mov    bl, dl               ; build a quad 1 byte at a time, ending with the lowest byte
    36 0000001B E2E9                   loop .quadloop
    37                             
    38 0000001D 53                     push   rbx          ; push result to be collected after parsing 3 times
    39 0000001E FFCF                   dec    edi
    40 00000020 75E1                   jnz   .parseloop
    41                             
    42 00000022 59                     pop    rcx   ; /mask  (at the top of a dword)
    43 00000023 5A                     pop    rdx   ; subnet
    44 00000024 58                     pop    rax   ; host
    45 00000025 0FC9                   bswap  ecx   ; cl=network bits  (reusing the quad parse loop left it in the high byte)

    49 00000027 F6D9                   neg    cl
    50 00000029 7404                   jz   .all_net     ; skip the count=32 special case
    51                             
    52 0000002B 31D0                   xor    eax, edx   ; host ^ subnet
    53 0000002D D3E8                   shr    eax, cl    ; shift out the host bits, keeping only the diff of subnet bits
    54                             
    55                             .all_net:
    56                                ; setnz  al         ; return ZF=1 match,  ZF=0 not in subnet
    57 0000002F C3                     ret
    58 00000030 30                 .size:      db $ - in_subnet

              0x30 = 48 bytes

(not updated with latest version) Try it online!

including a _start that calls it on argv[1] and returns an exit status.

## on my desktop
$ ./ipv4-subnet "10.4.1.33 10.4.0.0/24"    && echo "$? : in subnet" || echo "$? : not in subnet"
not in subnet

$ ./ipv4-subnet "10.4.1.33 10.4.0.0/23"    && echo "$? : in subnet" || echo "$? : not in subnet"
in subnet

It works fine if you pass a command line arg containing a newline instead of a space. But it has to be instead, not as well.

x86 32-bit machine code function, 38 bytes

Do 9 integer -> uint8_t parses and "push" them on the stack, where we pop them off as dwords or use the last one still in CL. Avoids reading past the end of the string at all.

Also, dec is only 1 byte in 32-bit mode.

    72                             in_subnet:
    73 00000000 89E7                   mov   edi, esp
    74 00000002 51                     push  ecx
    75 00000003 51                     push  ecx                   ; sub esp,8
    76                             .byteloop:
    77                             
    78 00000004 31C9                   xor   ecx,ecx               ; standard ecx=atoi(rdi) loop terminated by a non-digit char
    79                                                             ; runs 9 times: 8 in two dotted-quads, 1 mask length
    80 00000006 EB05                   jmp  .digit_entry
    81                              .digitloop:
    82 00000008 6BC90A                 imul   ecx, 10
    83 0000000B 00C1                   add    cl, al
    84                              .digit_entry:
    85 0000000D AC                     lodsb
    86 0000000E 2C30                   sub    al, '0'
    87 00000010 3C09                   cmp    al, 9
    88 00000012 76F4                   jbe   .digitloop
    89                                 ; RDI pointing to the next character.
    90                                 ; EDX = integer
    91                             
    92 00000014 4F                     dec    edi
    93 00000015 880F                   mov    [edi], cl           ; /mask store goes below ESP but we don't reload it
    94 00000017 39E7                   cmp    edi, esp
    95 00000019 73E9                   jae   .byteloop
    96                             
    97                                 ;; CL = /mask still there from the last conversion
    98                                 ;; ESP pointing at subnet and host on the stack, EDI = ESP-1
    99                             
   100 0000001B 5A                     pop    edx   ; subnet
   101 0000001C 58                     pop    eax   ; host
   102                             
   103 0000001D 31D0                   xor    eax, edx             ; host ^ subnet
   104 0000001F F6D9                   neg    cl                   ; -mask = (32-mask) mod 32;  x86 shifts mask their count
   105 00000021 7402                   jz     .end                 ; 32-n = 32 special case
   106 00000023 D3E8                   shr    eax, cl
   107                             .end:
   108                                 ; setz  al                  ; just return in ZF
   109 00000025 C3                     ret

   110 00000026 26                 .size:      db $ - in_subnet
      0x26 = 38 bytes

Test caller

   113                             global _start
   114                             _start:
   115 00000027 8B742408               mov    esi, [esp+8]   ; argv[1]
   116 0000002B E8D0FFFFFF             call   in_subnet
   117 00000030 0F95C3                 setnz  bl
   118 00000033 B801000000             mov    eax, 1         ; _exit syscall
   119 00000038 CD80                   int    0x80

Java 215 211 207 202 200 199 198 190 180 bytes

Long k,c;boolean a(String i,String s){return(b(i)^b(s))>>32-k.decode(s.split("/")[1])==0;}long b(String i){for(c=k=0l;c<4;k+=k.decode(i.split("[./]")[3+(int)-c])<<8*c++);return k;}

Outputs true for truthy and false for falsy.

Note: This uses long instead of int for the potential right shift of 32.

Try it online!

Saved 1 byte thanks to ceilingcat

Saved 10 bytes thanks to Peter Cordes

x86 assembly function, 49 43 bytes

This is mostly posted to satisfy Peter Cordes's request for the revised version I created. It can probably go away once/if he incorporates it into his answer.

This function expects esi to point to an input string, with the address and subnet parts separated either by a space or a newline character, and the return value is in the ZF flag (which by definition has only two possible values).

 1                                  %use smartalign
 2                                  
 3                                      ;10.4.1.33 10.4.0.0/23         true
 4                                      ;10.4.1.33 10.4.0.0/24         false
 5                                  
 6                                  ;; https://codegolf.stackexchange.com/questions/185005/im-in-your-subnets-golfing-your-code
 7                                  in_subnet:
 8                                  
 9                                      ;xor  ebx,ebx             ; doesn't need to be zeroed first; we end up shifting out the original contents
10                                      ;lea  ecx, [rbx+4]
11 00000000 6A09                        push   9
12 00000002 59                          pop    ecx                  ; ecx = 9 integers (8 in two dotted-quads,
13                                                                  ; 1 mask length)
14                                  
15 00000003 89E7                        mov   edi, esp
16 00000005 83EC0C                      sub   esp, 12
17                                  .quadloop:
18                                  
19 00000008 31D2                        xor   edx,edx               ; standard edx=atoi(rdi) loop terminated by a non-digit char
20 0000000A EB05                        jmp  .digit_entry
21                                   .digitloop:
22 0000000C 6BD20A                      imul   edx, 10
23 0000000F 00C2                        add    dl, al
24                                   .digit_entry:
25 00000011 AC                          lodsb
26 00000012 2C30                        sub    al, '0'
27 00000014 3C09                        cmp    al, 9
28 00000016 76F4                        jbe   .digitloop
29                                      ; al=non-digit character - '0'
30                                      ; RDI pointing to the next character.
31                                      ; EDX = integer
32                                  
33 00000018 4F                          dec    edi
34 00000019 8817                        mov    [edi], dl
35 0000001B E2EB                        loop .quadloop
36                                  
37 0000001D 59                          pop    ecx   ; /mask  (at the top of a dword)
38 0000001E 5A                          pop    edx   ; subnet
39 0000001F 58                          pop    eax   ; host
40 00000020 0FC9                        bswap  ecx   ; cl=network bits  (reusing the quad parse loop left it in the high byte)
41                                  
42                                  ;    xor    cl, -32    ; I think there's some trick like this for 32-n or 31-n, but maybe only if we're masking to &31?  Then neg or not work.
43                                  
44 00000022 31D0                        xor    eax, edx   ; host ^ subnet
45                                  ;    xor    edx, edx   ; edx = 0
46 00000024 F6D9                        neg    cl
47 00000026 7402                        jz     .end
48 00000028 D3E8                        shr    eax, cl    ; count=32 special case isn't special for a 64-bit shift
49                                  .end:    
50 0000002A C3                          ret
51 0000002B 2B                      .size:      db $ - in_subnet

And the x86 Linux wrapper part:

53                                  global _start
54                                  _start:
55 0000002C 8B742408                    mov    esi, [esp+8]   ; argv[1]
56 00000030 E8CBFFFFFF                  call   in_subnet
57 00000035 0F95C0                      setnz  al
58 00000038 0FB6D8                      movzx  ebx, al
59 0000003B B801000000                  mov    eax, 1         ; _exit syscall
60 00000040 CD80                        int    0x80

-6 bytes due to suggestion from Peter Cordes to return the value in ZF.

PowerPC/PPC64 C, 116 114 bytes

#include<stdio.h>
main(){unsigned u[4];char*p=u;for(;p<u+3;)scanf("%hhu%c",p++,u+3);return!((*u^u[1])>>32-p[-4]);}

(Tested on x86_64 Ubuntu 18.04 using powerpc64-linux-gnu-gcc -static and qemu-user.)

The program takes the two lines on standard input, and as its exit code it returns 1 if the address matches and 0 if it does not. (So this does depend on the specification not requiring a truthy value for a match and a falsey value for a mismatch.) Note that if you're running interactively, you will need to signal EOF (^D) three times after entering the second line.

This relies on PowerPC being big-endian, and also on that platform returning 0 for right-shifting a 32-bit unsigned value by 32. It reads the octets into unsigned values one-by-one, along with the netmask length in another byte; then it takes the xor of the two unsigned 32-bit addresses and shifts out the irrelevant bits. Finally, it applies ! to satisfy the requirement of returning only two distinct values.

Note: It might be possible to shave off two bytes by replacing u+3 with p and requiring compilation with -O0. That's living more dangerously than I care to, though.

Thanks to Peter Cordes for the inspiration for this solution.

More portable C, 186 171 167 bytes

Here I'll preserve a more portable version which runs 167 bytes.

#include<stdio.h>
main(){unsigned a,b,c,d,e,f,g,h,n;scanf("%u.%u.%u.%u %u.%u.%u.%u/%u",&a,&b,&c,&d,&e,&f,&g,&h,&n);return!(n&&((((a^e)<<8|b^f)<<8|c^g)<<8|d^h)>>32-n);}

This program takes the two lines on standard input, and returns exit code 1 if the address is in the subnet, and 0 if it isn't. (So this does rely on the specification not requiring a truthy value for matches and a falsey value for non matches.)

A breakdown of the core expression:

• a^e, b^f, c^g, d^h calculates the xor of the address and the mask byte-by-byte.
• (((a^e)<<8|b^f)<<8|c^g)<<8|d^h then combines them into a single unsigned 32-bit value by a Horner-like method.
• ...>>32-n then shifts off the bits of the xor difference that are not relevant to the subnet mask (keeping in mind that - has higher precedence in C than <<)
• There is one gotcha, though: if n=0 then ~0U<<32 will give undefined behavior assuming unsigned is 32 bits (which it is on virtually all current platforms). On the other hand, if n=0 then any address will match, so n&&... will give the correct result (taking advantage of the short-circuiting behavior of &&).
• Finally, to meet the requirement that the output can only be one of two values, we apply ! to output 0 or 1.

-15 bytes due to comments by ceilingcat and AdmBorkBork

-4 bytes due to comment by Peter Cordes

Linux POSIX shell (with net-tools/iputils) (34 bytes non-terminating, 47 bytes terminating)

What is best suited to parse network masks and addresses than the network utilities themselves? :)

route add -net $2 reject;! ping $1

Warning: the script is potentially damaging to your Internet connectivity, please run with care.

Input: the script takes the tested IP address as first argument, and the tested subnet. as second argument.

Output: the script returns a truthy value (0) if the first argument of the script belongs to the subnet indicated in the second argument. Otherwise, it will never terminate.

Assumptions: the script must be run as a root user, in a clean environment (i.e., no other blackhole route has been set by the administrator, and if a previous instance of the script has been run, the blackhole route it created has been removed). The script also assumes a "working Internet connection" (i.e., a valid default route is present).

Explanation:

We create a blackhole route to the specified subnet. We then test connectivity to the provided IP address by using ping. If the address doesn't belong to the subnet (and since we assume a properly set Internet connection), ping will try to send packets to that address. Note that whether this address actually responds does not matter, as ping will keep trying forever. Conversely, if the address does belong to the subnet, ping will fail with ENETUNREACH and return 2, and since we negated the command, the script will succeed.

Example

Test whether 5.5.5.5 belongs to 8.8.8.0/24

$ sudo ./a.sh 5.5.5.5 8.8.8.0/24
PING 5.5.5.5 (5.5.5.5) 56(84) bytes of data.
[...runs forever...]

(Clean with sudo ip route del 8.8.8.0/24 after running the command).

Test whether 5.5.5.5 belongs to 5.5.5.0/24:

$ sudo ./a.sh 5.5.5.5 5.5.5.0/24
connect: Network is unreachable
$ echo $?
0

(Clean with sudo ip route del 5.5.5.0/24 after running the command).

Test whether 8.8.8.8 belongs to 5.5.5.0/24:

$ sudo ./a.sh 8.8.8.8 5.5.5.0/24
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=122 time=2.27 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=122 time=1.95 ms
[...runs forever...]

(Clean with sudo ip route del 5.5.5.0/24 after running the command).

47-byte version if we disallow non-terminating scripts

route add -net $2 reject;ping -c1 $1;[ $? = 2 ]

As per @Grimy's comment, here's the version which always terminates, and returns 0 (truthy) if the address is in the subnet, and 1 (falsy) otherwise. We make ping terminate with the -c1 flag which limits the number of sent packets to 1. If the address responded, ping will return 0, and if not, ping will return 1. Only if the address belongs to the blackholed subnet will ping return 2, which is thus what we test against in the last command.

PHP, 75 73, 71 bytes

<?=strtok($argv[2],'/')==long2ip(ip2long($argv[1])&1+~1<<32-strtok(_));

A fork of @Luis felipe De jesus Munoz's answer, as a standalone taking input from command line args. Outputs '1' for Truthy, '' (empty string) for Fasley.

$ php ipsn.php 127.0.0.1 127.0.0.0/24
1
$ php ipsn.php 127.1.2.3 127.0.0.0/24

Try it online!

-2 bytes borrowing @Christoph's little trick for strtok(). His answer is still shorter though!

R 120 bytes

a function - I pasted ".32" to first term

w=function(a,b){f=function(x)as.double(el(strsplit(x,"[./]")));t=f(paste0(a,".32"))-f(b);sum(t[-5]*c(256^(3:0)))<2^t[5]}

and just for fun:

require("iptools");w=function(a,b)ips_in_cidrs(a,b)[[2]]

which is 56 bytes

05AB1E, 21 bytes

'/¡`U‚ε'.¡b8jð0:JX£}Ë

Takes the subnet before the address.

Try it online or verify all test cases.

Explanation:

'/¡              '# Split the first subnet-input by "/"
   `              # Push both values separated to the stack
    U             # Pop and store the trailing number in variable `X`
    ‚             # Pair the subnet-IP with the second address-input
     ε            # Map both to:
      '.¡        '#  Split on "."
         b        #  Convert each integer to binary
          8j      #  Add leading spaces to make them size 8
          ð0:     #  And replace those spaces with "0"
             J    #  Join the four parts together to a single string
              X£  #  And only leave the first `X` binary digits as substring
     }Ë           # After the map: check if both mapped values are the same
                  # (which is output implicitly as result)

Python 3 (62 bytes)

Very straightforward:

from ipaddress import*
lambda i,m:ip_address(i)in ip_network(m)

Perl 5 -Mbigint -MSocket=:all -p, 72 bytes

sub c{unpack N,inet_aton pop}<>=~/(.*)\/(.*)/;$_=c($_)-&c($1)<2**(32-$2)

Try it online!

C# (Visual C# Interactive Compiler), 187 bytes

a=>{var b=a.Select(x=>x.Split(".").SelectMany(g=>Convert.ToString(int.Parse(g.Split("/")[0]),2).PadLeft(8)).Take(int.Parse(a[1].Split("/")[1])));return b.First().SequenceEqual(b.Last());}

I can definitely golf this down more.

Try it online!

Jelly, 23 bytes

ṣ”/ṣ€”.Vḅ⁹s2+Ø%BḊ€ḣ€ʋ/E

Try it online!

Monadic link that takes a the address and subnet separated by a slash and returns 1 for true and 0 for false.

Thanks to @gwaugh for pointing out a flaw in the original - it failed to ensure the binary list was 32 long.

Stax, 22 bytes

é.○▄╗jF⌐§╥§I╓☻lw«ç┴║╫┼

Run and debug it

It takes the input parameters space-separated on standard input.

Unpacked, ungolfed, and commented, it looks like this.

'/:/~       split on slash and push the last group back to the input stack
j{          split on space; for each group, run this code block
  './       split on period
  {emVB|E   evaluate integers and decode integer as base-256
  ;e|<      peek from input stack and shift left
  Vu/       integer divide by 2^32
F           end of for-each
=           two values left on stack are equal?

Run this one

PHP, 101 92 88 bytes

-13 bytes from @gwaugh

function($i,$r){[$r,$n]=explode('/',$r);return(ip2long($i)&~(1<<32-$n)+1)==ip2long($r);}

Try it online!

C# (Visual C# Compiler), 250+31=281 bytes

(a,b)=>{Func<string,string>h=g=>string.Join("",g.Split('.').Select(x=>{var e=Convert.ToString(int.Parse(x),2);while(e.Length<8)e='0'+e;return e;}));a=h(a);var c=b.Split('/');b=h(c[0]);var d=int.Parse(c[1]);return a.Substring(0,d)==b.Substring(0,d);};

Bytecount includes using System;using System.Linq;

Try it online!

I wrote this in JS as soon as the challenge was posted, but Arnauld beat me to the punch with a much better answer, so here it is in C# instead.

Definitely a lot of room for golfing.

Explanation:

The function consists of a sub-function called h:

h=g=>string.Join("",
    g.Split('.').Select(x => {
        var e = Convert.ToString(int.Parse(x), 2);
        while (e.Length < 8) e = '0' + e;
        return e;
    }
);

This sub-function splits the IP Address on ., converts each number to a binary string, left-pads each string with 0 to be 8 bits long, then concatenates the strings into one 32-bit binary string.

This is immediately done in-place with a=h(a); on the given IP Address.
We then split the Subnet mask into an IP Address and a mask number with c=b.Split('/');

The IP Address component is also passed through our sub-function: b=h(c[0]); and the mask number is parsed to an integer: var d=int.Parse(c[1]);

Finally we take the first d bits of both binary strings (where d is the mask number) and compare them: return a.Substring(0,d)==b.Substring(0,d);

JavaScript (ES6), 82 bytes

Takes input as (address)(subnet). Returns a Boolean value.

a=>s=>!([s,v]=s.split`/`,+v&&(g=s=>s.split`.`.map(k=v=>k=k<<8|v)|k>>32-v)(a)^g(s))

Try it online!