corrected subnet containment checking