LUNAROPS · OPERATIONAL UPLINK 100% UPTIME 1,247d POSTS 893 JEFF.MOON@LUNAROPS.DEV UTC --:--:--

CCNA: IPv4 Addressing and Subnetting

37 min read Networking Deep Dives
ccnanetworkingipv4subnettingciscoaddressingvlsm
Contents

Subnetting is the skill that separates engineers who passed the CCNA from engineers who understand networking. It shows up on every version of the exam, it shows up in every real network job, and it is the one topic where a methodical, practiced approach completely overcomes the time pressure. This post is long because subnetting deserves the full treatment: the math, the shortcuts, the worked examples, the exam traps, and the production context that makes it all make sense.

Work through every example with a pencil. Do not just read. The method described here is fast enough that under exam pressure, a well-practiced candidate can answer most subnetting questions in under ninety seconds. That speed comes entirely from repetition, not from memorizing tables.

1. Binary and Decimal — The Foundation

Every IP address is a 32-bit binary number. Everything about subnetting — masks, network boundaries, broadcast addresses — follows directly from binary arithmetic. You cannot shortcut your way past this. You can, however, make binary-to-decimal conversion fast enough that it stops being a bottleneck.

The 8-Bit Octet

An IPv4 address is written as four decimal numbers separated by dots. Each decimal number represents 8 bits — an octet. Eight bits can represent values from 0 (00000000) to 255 (11111111). There are exactly 256 possible values per octet.

The eight bit positions in an octet each carry a power of 2, arranged from left (most significant) to right (least significant):

Bit position:  7    6    5    4    3    2    1    0
Power of 2:   128   64   32   16    8    4    2    1

This row is worth memorizing cold: 128, 64, 32, 16, 8, 4, 2, 1. Every subnetting shortcut derives from these eight numbers.

Decimal to Binary

To convert a decimal number to binary, work left to right through the powers of 2. Ask: does 128 fit? If yes, write 1, subtract it, continue with the remainder. If no, write 0, continue.

Example: Convert 192 to binary.

192 >= 128?  Yes  ->  1, remainder = 192 - 128 = 64
 64 >=  64?  Yes  ->  1, remainder =  64 -  64 =  0
  0 >=  32?  No   ->  0
  0 >=  16?  No   ->  0
  0 >=   8?  No   ->  0
  0 >=   4?  No   ->  0
  0 >=   2?  No   ->  0
  0 >=   1?  No   ->  0

192 = 11000000

Example: Convert 172 to binary.

172 >= 128?  Yes  ->  1, remainder = 44
 44 >=  64?  No   ->  0
 44 >=  32?  Yes  ->  1, remainder = 12
 12 >=  16?  No   ->  0
 12 >=   8?  Yes  ->  1, remainder =  4
  4 >=   4?  Yes  ->  1, remainder =  0
  0 >=   2?  No   ->  0
  0 >=   1?  No   ->  0

172 = 10101100

Example: Convert 255 to binary.

All eight bits are 1. 128+64+32+16+8+4+2+1 = 255. Every 255 in an IP address means all host bits in that octet are set. You will see this constantly in subnet masks.

Binary to Decimal

Work right to left (or left to right — pick a direction and keep it). For each bit that is 1, add its positional value.

Example: Convert 00111000 to decimal.

Position:    7    6    5    4    3    2    1    0
Bit:         0    0    1    1    1    0    0    0
Value:     128   64   32   16    8    4    2    1
Add if 1:        --   32   16    8   --   --   --

32 + 16 + 8 = 56

Fast Conversion Practice Method

The exam does not give you extra time. The fastest practitioners use a two-step shortcut for common values:

  1. Recognize half-values: 128 = 10000000, 192 = 11000000, 224 = 11100000, 240 = 11110000, 248 = 11111000, 252 = 11111100, 254 = 11111110, 255 = 11111111. These are the exact octet values that appear in subnet masks. Memorize all eight.

  2. For arbitrary values, sum the two largest fitting powers: 172 = 128+32+8+4 is easier to see if you first spot 128 leaves 44, 44 = 32 leaves 12, 12 = 8 leaves 4, done.

Drill this daily for a week. Shoot for under three seconds per octet. When you can convert any octet in three seconds, subnetting questions become algebra, not arithmetic.

Why Binary Matters for Masks

A subnet mask is always contiguous 1-bits followed by contiguous 0-bits. Never alternating, never scattered. This is not a convention — it is a protocol requirement. The network portion of an address is identified by ANDing the address with the mask. AND works bit by bit: 1 AND 1 = 1, anything AND 0 = 0. The result preserves the network bits and zeros out the host bits.

IP address:   11000000.10101000.00000001.01100100   (192.168.1.100)
Subnet mask:  11111111.11111111.11111111.00000000   (255.255.255.0)
AND result:   11000000.10101000.00000001.00000000   (192.168.1.0)

The AND result is the network address. This is how every router on earth determines which subnet a packet belongs to. The contiguous-1s rule means you only need to track how many 1-bits there are — the prefix length.

2. IPv4 Address Structure

An IPv4 address is 32 bits, written in four octets of dotted-decimal notation. The address is logically divided into two parts:

  • Network portion: identifies which subnet the address belongs to
  • Host portion: identifies a specific device within that subnet

The prefix length (written as /N after the address) determines where the split happens. A /24 means the first 24 bits are the network portion and the last 8 bits are the host portion.

192.168.1.100/24

11000000 . 10101000 . 00000001 . 01100100
|-------- network (24 bits) ----------| |-- host (8 bits) --|

Changing the prefix length changes the balance between network bits and host bits. A /25 gives you two subnets from what was one /24, each with 126 usable hosts. A /16 gives you a single massive network with 65,534 usable hosts. A /30 gives you a tiny subnet with 2 usable hosts — exactly right for a point-to-point link.

The prefix length simultaneously tells you:

  • How many bits identify the network
  • How many bits are available for hosts
  • How many devices can share that subnet
  • What the subnet mask looks like in dotted-decimal

3. Subnet Masks — Notation, Relationship, and the Magic Number

Traditional vs CIDR Notation

The same mask can be written two ways. Both appear on the exam; both appear in Cisco IOS configuration.

CIDR Dotted-Decimal Binary Mask
/8 255.0.0.0 11111111.00000000.00000000.00000000
/16 255.255.0.0 11111111.11111111.00000000.00000000
/24 255.255.255.0 11111111.11111111.11111111.00000000
/25 255.255.255.128 11111111.11111111.11111111.10000000
/26 255.255.255.192 11111111.11111111.11111111.11000000
/27 255.255.255.224 11111111.11111111.11111111.11100000
/28 255.255.255.240 11111111.11111111.11111111.11110000
/29 255.255.255.248 11111111.11111111.11111111.11111000
/30 255.255.255.252 11111111.11111111.11111111.11111100
/31 255.255.255.254 11111111.11111111.11111111.11111110
/32 255.255.255.255 11111111.11111111.11111111.11111111

Complete Prefix Reference Table

The table below covers every prefix length relevant to CCNA. “Subnets from /24” means the number of subnets you get if you start with a /24 block. “Usable hosts” is 2^(host bits) - 2.

Prefix Dotted-Decimal Host Bits Usable Hosts Subnets from /24 Typical Use
/8 255.0.0.0 24 16,777,214 – Class A networks
/9 255.128.0.0 23 8,388,606 – Large ISP blocks
/10 255.192.0.0 22 4,194,302 – Large ISP blocks
/16 255.255.0.0 16 65,534 – Class B networks
/17 255.255.128.0 15 32,766 – Large campus
/18 255.255.192.0 14 16,382 – Large campus
/19 255.255.224.0 13 8,190 – Medium campus
/20 255.255.240.0 12 4,094 – Medium campus
/21 255.255.248.0 11 2,046 – Medium campus
/22 255.255.252.0 10 1,022 – Building-level
/23 255.255.254.0 9 510 – Large department
/24 255.255.255.0 8 254 1 Standard LAN
/25 255.255.255.128 7 126 2 Large VLAN
/26 255.255.255.192 6 62 4 Medium VLAN
/27 255.255.255.224 5 30 8 Small VLAN
/28 255.255.255.240 4 14 16 Small department
/29 255.255.255.248 3 6 32 Very small group
/30 255.255.255.252 2 2 64 Point-to-point link
/31 255.255.255.254 1 2 (no N/B) 128 P2P (RFC 3021)
/32 255.255.255.255 0 1 (host route) 256 Loopback/host route

The Magic Number (Block Size)

The magic number is the core concept behind fast subnetting. It is simply:

Magic number = 256 - (value of subnet mask in the interesting octet)

The “interesting octet” is the octet where the prefix boundary falls — the octet that is neither all 1s (255) nor all 0s (0) in the subnet mask. That is the octet where subnets increment.

For /24: mask is 255.255.255.0. Interesting octet is the fourth. Magic = 256 - 0 = 256. But /24 has no interesting octet (the fourth octet is 0, meaning all host bits) — the boundary falls exactly on the octet boundary, making the math trivial.

For /25: mask is 255.255.255.128. Interesting octet is the fourth. Magic = 256 - 128 = 128. Subnets start at 0, 128.

For /26: mask is 255.255.255.192. Interesting octet is the fourth. Magic = 256 - 192 = 64. Subnets start at 0, 64, 128, 192.

For /28: mask is 255.255.255.240. Interesting octet is the fourth. Magic = 256 - 240 = 16. Subnets start at 0, 16, 32, 48, 64 … 240.

For /20: mask is 255.255.240.0. Interesting octet is the third. Magic = 256 - 240 = 16. Subnets in the third octet start at 0, 16, 32, 48 … The fourth octet cycles completely within each subnet.

The magic number is the block size — the distance between consecutive subnet starting addresses in the interesting octet.

4. Address Classes — Legacy but Exam-Tested

Before CIDR existed, IPv4 addresses were divided into classes. The class of an address determined its default subnet mask. Classful addressing was officially retired in 1993 with RFC 1519, but Cisco still tests it because classful defaults still appear in some IOS behaviors, and understanding classes helps you recognize address ranges quickly.

Class Definitions

Class First Octet Range Default Mask Network Bits Host Bits Notes
A 1 – 126 /8 (255.0.0.0) 8 24 126 networks, 16M hosts each
B 128 – 191 /16 (255.255.0.0) 16 16 16K networks, 65K hosts each
C 192 – 223 /24 (255.255.255.0) 24 8 2M networks, 254 hosts each
D 224 – 239 N/A (multicast) – – Multicast groups
E 240 – 255 N/A (experimental) – – Reserved, not routed

The 127.x.x.x Gap

You will notice Class A jumps from 1 to 126, skipping 127. The entire 127.0.0.0/8 block is reserved for loopback. Traffic sent to any 127.x.x.x address is processed locally and never leaves the host. The canonical loopback address is 127.0.0.1. Cisco IOS uses the loopback interface (software-only, always up) for router ID selection and management traffic — this is separate from the 127.0.0.0/8 block, but the concept is related.

Why Classful Is Obsolete

A Class B address gave you one /16 block — far too large for most organizations. Companies were being assigned /8s (16 million addresses) because of Class A allocation, while the address space was exhausted rapidly. CIDR allowed any prefix length, enabling address conservation through exact-fit allocation. Despite being obsolete, classful ranges appear in:

  • The ip classless vs ip no classless IOS behavior
  • Auto-summarization in EIGRP and RIP (which summarizes to classful boundaries by default)
  • Questions asking you to identify the “class” of a given address
  • Default mask assumptions when no mask is specified

On the exam: memorize the class ranges and default masks. Recognize that any address with a first octet 1-126 is Class A, 128-191 is Class B, 192-223 is Class C.

5. Special Addresses

Private Address Ranges (RFC 1918)

RFC 1918 designated three address blocks for private use. These addresses are routable within your organization but are not forwarded by ISP routers across the public internet. NAT translates between private and public addresses at the network boundary.

Block Range Class
10.0.0.0/8 10.0.0.0 – 10.255.255.255 A
172.16.0.0/12 172.16.0.0 – 172.31.255.255 B
192.168.0.0/16 192.168.0.0 – 192.168.255.255 C

The 172.16.0.0/12 range trips up many candidates. It is not a single /12 subnet — it means the private range spans 172.16.x.x through 172.31.x.x. In binary, the first 12 bits of 172.16.0.0 are 10101100 0001, and the range extends as long as those 12 bits match.

Loopback: 127.0.0.0/8

The entire /8 block is reserved for host-local loopback. Only 127.0.0.1 is commonly used, but any address in the range is valid. Traffic to 127.x.x.x is handled by the TCP/IP stack and never reaches the physical interface.

APIPA: 169.254.0.0/16

Automatic Private IP Addressing (APIPA) is the block a host assigns itself when it cannot reach a DHCP server. Defined in RFC 3927. If you see a host with a 169.254.x.x address, it means DHCP failed. This range is link-local: it is not routed off the local segment.

Limited Broadcast: 255.255.255.255

The limited broadcast address sends to all hosts on the local segment. Routers do not forward it. Used by DHCP discovery packets (the client doesn’t yet know its network, so it broadcasts to 255.255.255.255).

Directed Broadcast

A directed broadcast is sent to all hosts in a specific subnet. The address is the subnet’s broadcast address — the one with all host bits set to 1. For example, 192.168.1.255 is the directed broadcast for 192.168.1.0/24. By default, Cisco IOS does not forward directed broadcasts (the ip directed-broadcast command is disabled by default for security reasons — Smurf attacks used directed broadcasts).

Network Address and Broadcast Address

Within any subnet:

  • Network address: all host bits = 0. Not assignable to a host. Identifies the subnet.
  • Broadcast address: all host bits = 1. Not assignable to a host. Sends to all hosts in the subnet.
  • Usable hosts: everything in between. This is why usable count = 2^(host bits) - 2.

The subtraction of 2 is one of the most common errors on the exam. If asked for the number of usable hosts, always subtract 2. If asked for the total number of addresses (not hosts), do not subtract 2.

6. The Subnetting Method That Works Under Exam Pressure

There are several subnetting methods. The one described here — the magic number method — is the fastest for exam conditions because it eliminates binary conversion entirely for the common cases. You only need binary when summarizing routes (covered later).

The Four Steps

Step 1: Identify the interesting octet.

Find the octet where the prefix boundary falls. This is the octet that has a value other than 255 or 0 in the subnet mask.

  • /24 (255.255.255.0): boundary is at the fourth octet (value 0 means all host bits — this is a trivial case)
  • /25 (255.255.255.128): interesting octet is fourth (value 128)
  • /20 (255.255.240.0): interesting octet is third (value 240)
  • /22 (255.255.252.0): interesting octet is third (value 252)
  • /10 (255.192.0.0): interesting octet is second (value 192)

Step 2: Calculate the magic number.

Magic number = 256 - (mask value in interesting octet)

Step 3: List subnet starting addresses.

Subnets begin at 0 in the interesting octet and increment by the magic number. Stop when you reach 256 (you’ve wrapped — that was the last subnet). All octets before the interesting octet stay fixed (copied from the original network). All octets after the interesting octet start at 0 for the network address.

Step 4: For any given subnet, identify:

  • Network address: the starting address (all host bits = 0)
  • First usable host: network address + 1
  • Last usable host: broadcast address - 1
  • Broadcast address: one less than the next subnet’s starting address (all host bits = 1)

This is the entire method. Let us work through examples.

Example Set 1: Subnetting 192.168.1.0/24 into Smaller Subnets

/25 (255.255.255.128) — Magic Number 128

Mask: 255.255.255.128. Interesting octet: fourth. Magic = 256 - 128 = 128.

Subnet starting addresses: 0, 128. Two subnets total (2^1 = 2, one borrowed bit).

Subnet 1: 192.168.1.0/25
  Network:          192.168.1.0
  First host:       192.168.1.1
  Last host:        192.168.1.126
  Broadcast:        192.168.1.127   (128 - 1 = 127)

Subnet 2: 192.168.1.128/25
  Network:          192.168.1.128
  First host:       192.168.1.129
  Last host:        192.168.1.254
  Broadcast:        192.168.1.255   (256 - 1 = 255, or "end of octet")

Each subnet has 126 usable hosts (2^7 - 2 = 128 - 2 = 126).

/26 (255.255.255.192) — Magic Number 64

Mask: 255.255.255.192. Magic = 256 - 192 = 64. Four subnets (2^2 = 4).

Subnet starting addresses: 0, 64, 128, 192.

Subnet 1: 192.168.1.0/26
  Network:    192.168.1.0
  First host: 192.168.1.1
  Last host:  192.168.1.62
  Broadcast:  192.168.1.63

Subnet 2: 192.168.1.64/26
  Network:    192.168.1.64
  First host: 192.168.1.65
  Last host:  192.168.1.126
  Broadcast:  192.168.1.127

Subnet 3: 192.168.1.128/26
  Network:    192.168.1.128
  First host: 192.168.1.129
  Last host:  192.168.1.190
  Broadcast:  192.168.1.191

Subnet 4: 192.168.1.192/26
  Network:    192.168.1.192
  First host: 192.168.1.193
  Last host:  192.168.1.254
  Broadcast:  192.168.1.255

Each subnet has 62 usable hosts (2^6 - 2 = 64 - 2 = 62).

/27 (255.255.255.224) — Magic Number 32

Mask: 255.255.255.224. Magic = 256 - 224 = 32. Eight subnets (2^3 = 8).

Subnet starting addresses: 0, 32, 64, 96, 128, 160, 192, 224.

Subnet 1: 192.168.1.0/27     Network .0    Broadcast .31
Subnet 2: 192.168.1.32/27    Network .32   Broadcast .63
Subnet 3: 192.168.1.64/27    Network .64   Broadcast .95
Subnet 4: 192.168.1.96/27    Network .96   Broadcast .127
Subnet 5: 192.168.1.128/27   Network .128  Broadcast .159
Subnet 6: 192.168.1.160/27   Network .160  Broadcast .191
Subnet 7: 192.168.1.192/27   Network .192  Broadcast .223
Subnet 8: 192.168.1.224/27   Network .224  Broadcast .255

Each subnet has 30 usable hosts (2^5 - 2 = 32 - 2 = 30).

/28 (255.255.255.240) — Magic Number 16

Mask: 255.255.255.240. Magic = 256 - 240 = 16. Sixteen subnets (2^4 = 16).

Subnet starting addresses: 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, 240.

Subnet 1:  192.168.1.0/28    Network .0    Broadcast .15
Subnet 2:  192.168.1.16/28   Network .16   Broadcast .31
Subnet 3:  192.168.1.32/28   Network .32   Broadcast .47
Subnet 4:  192.168.1.48/28   Network .48   Broadcast .63
Subnet 5:  192.168.1.64/28   Network .64   Broadcast .79
Subnet 6:  192.168.1.80/28   Network .80   Broadcast .95
Subnet 7:  192.168.1.96/28   Network .96   Broadcast .111
Subnet 8:  192.168.1.112/28  Network .112  Broadcast .127
Subnet 9:  192.168.1.128/28  Network .128  Broadcast .143
Subnet 10: 192.168.1.144/28  Network .144  Broadcast .159
Subnet 11: 192.168.1.160/28  Network .160  Broadcast .175
Subnet 12: 192.168.1.176/28  Network .176  Broadcast .191
Subnet 13: 192.168.1.192/28  Network .192  Broadcast .207
Subnet 14: 192.168.1.208/28  Network .208  Broadcast .223
Subnet 15: 192.168.1.224/28  Network .224  Broadcast .239
Subnet 16: 192.168.1.240/28  Network .240  Broadcast .255

Each subnet has 14 usable hosts (2^4 - 2 = 16 - 2 = 14).

Example Set 2: Third-Octet Boundary Cases

When the prefix falls in the third octet, the interesting octet is the third. The fourth octet now cycles through all 256 values (0–255) within each subnet. The broadcast address for any subnet is: (next subnet’s third octet value - 1).255.

/20 (255.255.240.0) — Magic Number 16 in Third Octet

Starting network: 172.16.0.0/20.

Mask: 255.255.240.0. Magic = 256 - 240 = 16 (applied to the third octet).

Subnet 1:  172.16.0.0/20    Network 172.16.0.0    Broadcast 172.16.15.255
Subnet 2:  172.16.16.0/20   Network 172.16.16.0   Broadcast 172.16.31.255
Subnet 3:  172.16.32.0/20   Network 172.16.32.0   Broadcast 172.16.47.255
Subnet 4:  172.16.48.0/20   Network 172.16.48.0   Broadcast 172.16.63.255
...
Subnet 16: 172.16.240.0/20  Network 172.16.240.0  Broadcast 172.16.255.255

The broadcast address for 172.16.0.0/20 is 172.16.15.255 because the next subnet starts at 172.16.16.0, so the previous subnet ends at 172.16.15.255. Each subnet has 4,094 usable hosts.

/22 (255.255.252.0) — Magic Number 4 in Third Octet

Starting network: 10.0.0.0/22.

Mask: 255.255.252.0. Magic = 256 - 252 = 4 (applied to the third octet).

Subnet 1:  10.0.0.0/22    Network 10.0.0.0    Broadcast 10.0.3.255
Subnet 2:  10.0.4.0/22    Network 10.0.4.0    Broadcast 10.0.7.255
Subnet 3:  10.0.8.0/22    Network 10.0.8.0    Broadcast 10.0.11.255
Subnet 4:  10.0.12.0/22   Network 10.0.12.0   Broadcast 10.0.15.255

Broadcast for 10.0.0.0/22 is 10.0.3.255 (next subnet at 10.0.4.0, subtract 1 from the third octet, set fourth to 255). Each subnet has 1,022 usable hosts.

Determining Which Subnet a Host Belongs To

Given a host IP and a subnet mask, find the subnet it belongs to. This is a common exam question type.

Question: What subnet does 192.168.1.100 belong to if the mask is 255.255.255.192 (/26)?

Magic number = 256 - 192 = 64. Subnet boundaries in the fourth octet: 0, 64, 128, 192.

100 falls between 64 and 128. Therefore the host is in the 192.168.1.64/26 subnet.

  • Network address: 192.168.1.64
  • Broadcast address: 192.168.1.127
  • First host: 192.168.1.65
  • Last host: 192.168.1.126

Question: What subnet does 10.1.87.50 belong to if the mask is 255.255.240.0 (/20)?

Interesting octet: third. Magic = 256 - 240 = 16. Subnet boundaries in third octet: 0, 16, 32, 48, 64, 80, 96…

87 falls between 80 and 96. The subnet starts at third octet = 80.

  • Network address: 10.1.80.0
  • Broadcast address: 10.1.95.255
  • 10.1.87.50 is a valid host in 10.1.80.0/20.

The general algorithm: divide the interesting octet value by the magic number using integer division. Multiply the result by the magic number. That is the starting value for the interesting octet in the network address.

87 / 16 = 5 (integer division, discard remainder)
5 x 16  = 80

Network address third octet = 80
Next subnet third octet     = 80 + 16 = 96
Broadcast third octet       = 96 - 1  = 95

7. Key Formulas

The Two Formulas You Must Know Cold

Number of subnets created (when borrowing bits from a classful network):

Subnets = 2^(borrowed bits)

Borrowed bits = new prefix length - original (classful) prefix length.

Example: Subnetting a Class C (/24) into /27s: borrowed = 27 - 24 = 3. Subnets = 2^3 = 8.

Number of usable hosts per subnet:

Usable hosts = 2^(host bits) - 2

Host bits = 32 - prefix length.

Example: /27 has 32 - 27 = 5 host bits. Usable = 2^5 - 2 = 32 - 2 = 30.

Quick Reference: Common Prefix Lengths

Prefix Host Bits Total Addresses Usable Hosts Magic # (4th oct) Subnets from /24
/24 8 256 254 256 (trivial) 1
/25 7 128 126 128 2
/26 6 64 62 64 4
/27 5 32 30 32 8
/28 4 16 14 16 16
/29 3 8 6 8 32
/30 2 4 2 4 64
/31 1 2 2 (RFC 3021) 2 128
/32 0 1 0 (host) 1 256

/31 and /32 — The Special Cases

/31 (RFC 3021): Normally, a 2-address subnet has 0 usable hosts (the two addresses are the network and broadcast addresses, leaving nothing). RFC 3021 redefines /31 subnets for point-to-point links: with only two addresses, there is no useful network or broadcast address, so both addresses are assigned to the endpoints. IOS supports this with no ip subnet-zero and explicit configuration. Cisco supports /31 for P2P links but many engineers still use /30 for maximum compatibility.

/32: A single host address. Used for loopback interfaces on routers (e.g., interface Loopback0 gets a /32), for host-specific routes in routing tables, and for identifying router IDs in OSPF/EIGRP. No network address, no broadcast, no subnetting — it is a single point.

8. Given an IP and Mask — The Complete Algorithm

This is the exam question that appears most often: given an IP address and subnet mask, find the network address, broadcast address, first usable host, and last usable host. Here is the complete algorithm for every case.

The Algorithm

  1. Identify the interesting octet (the one that is neither 255 nor 0 in the mask)
  2. Calculate the magic number: 256 - mask value in that octet
  3. Find the network address in the interesting octet: (floor division of that octet / magic) * magic
  4. Network address: replace the interesting octet value with the result from step 3; set all subsequent octets to 0
  5. Broadcast address: set the interesting octet to (network octet value + magic - 1); set all subsequent octets to 255
  6. First usable host: network address + 1 (increment the last octet)
  7. Last usable host: broadcast address - 1 (decrement the last octet)

When the prefix falls exactly on an octet boundary (/8, /16, /24), there is no interesting octet. The network address is trivially the prefix, broadcast is the prefix with all remaining octets set to 255.

Worked Examples

Example: 172.22.119.40 /19 (255.255.224.0)

Mask: 255.255.224.0. Interesting octet: third (value 224). Magic = 256 - 224 = 32.

Third octet of IP: 119
119 / 32 = 3 (integer division)
3 * 32   = 96

Network address:   172.22.96.0
Broadcast:         172.22.127.255   (96 + 32 - 1 = 127, fourth octet = 255)
First host:        172.22.96.1
Last host:         172.22.127.254

Host bits: 32 - 19 = 13
Usable hosts: 2^13 - 2 = 8192 - 2 = 8,190

Verify: 119 is between 96 and 128. Correct subnet.

Example: 10.5.62.200 /21 (255.255.248.0)

Mask: 255.255.248.0. Interesting octet: third (value 248). Magic = 256 - 248 = 8.

Third octet of IP: 62
62 / 8 = 7 (integer division)
7 * 8  = 56

Network address:   10.5.56.0
Broadcast:         10.5.63.255   (56 + 8 - 1 = 63, fourth octet = 255)
First host:        10.5.56.1
Last host:         10.5.63.254

Host bits: 32 - 21 = 11
Usable hosts: 2^11 - 2 = 2048 - 2 = 2,046

Verify: 62 is between 56 and 64. Correct subnet.

Example: 192.168.10.77 /27 (255.255.255.224)

Mask: 255.255.255.224. Interesting octet: fourth (value 224). Magic = 256 - 224 = 32.

Fourth octet of IP: 77
77 / 32 = 2 (integer division)
2 * 32  = 64

Network address:   192.168.10.64
Broadcast:         192.168.10.95   (64 + 32 - 1 = 95)
First host:        192.168.10.65
Last host:         192.168.10.94

Host bits: 32 - 27 = 5
Usable hosts: 2^5 - 2 = 32 - 2 = 30

Example: 192.168.5.201 /29 (255.255.255.248)

Mask: 255.255.255.248. Interesting octet: fourth (value 248). Magic = 256 - 248 = 8.

Fourth octet of IP: 201
201 / 8 = 25 (integer division)
25 * 8  = 200

Network address:   192.168.5.200
Broadcast:         192.168.5.207   (200 + 8 - 1 = 207)
First host:        192.168.5.201
Last host:         192.168.5.206

Usable hosts: 2^3 - 2 = 8 - 2 = 6

Example: 10.0.0.1 /30 (255.255.255.252) — Point-to-Point Link

Mask: 255.255.255.252. Magic = 256 - 252 = 4.

Fourth octet of IP: 1
1 / 4 = 0 (integer division)
0 * 4 = 0

Network address:   10.0.0.0
Broadcast:         10.0.0.3   (0 + 4 - 1 = 3)
First host:        10.0.0.1
Last host:         10.0.0.2

Usable hosts: 2^2 - 2 = 4 - 2 = 2

/30 subnets are the standard for point-to-point WAN links and router-to-router connections. One address for each end of the link, one wasted as network, one wasted as broadcast. You will allocate many of these in real network designs.

/31 and /32 as Point-to-Point and Host Routes

A /31 link between two routers would look like:

Router A: 10.0.0.0/31   (one of the two addresses)
Router B: 10.0.0.1/31   (the other)
No network address, no broadcast address per RFC 3021.

A /32 is a host route. When you see 172.16.1.1/32 in a routing table, it matches exactly one IP address. Used for loopback interfaces and for injecting specific host reachability into routing protocols.

9. VLSM — Variable Length Subnet Masking

The Problem with Fixed-Size Subnets

Suppose you have 192.168.10.0/24 and you need to support these networks:

  • Department A: 60 hosts
  • Department B: 28 hosts
  • Department C: 12 hosts
  • Link 1 (router-to-router): 2 hosts
  • Link 2 (router-to-router): 2 hosts

If you use fixed /26 subnets (62 usable hosts each), you need five subnets. That works for departments A and B. But department C wastes 50 addresses. The two point-to-point links each waste 60 addresses. Total waste: 50 + 60 + 60 = 170 addresses — more than half your /24.

VLSM lets you use different prefix lengths for different subnets. You allocate each subnet according to actual need, conserving address space and keeping the design cleaner.

The VLSM Design Process

The cardinal rule: allocate the largest subnet first. If you allocate small subnets first, you may fragment the address space and fail to fit a large subnet in a contiguous block.

Process:

  1. Sort requirements from largest to smallest
  2. For each requirement, find the smallest subnet mask that provides enough hosts (smallest mask = shortest prefix = most hosts)
  3. Allocate the subnet starting from the next available address
  4. Record network address, mask, broadcast, range
  5. Move the starting pointer to the address after the broadcast
  6. Repeat until all subnets are allocated

Worked Example: 192.168.10.0/24

Requirements (sorted largest to smallest):

Subnet Hosts Needed Required Prefix Usable Hosts Block Size
Dept A 60 /26 62 64
Dept B 28 /27 30 32
Dept C 12 /28 14 16
Link 1 2 /30 2 4
Link 2 2 /30 2 4

Starting address: 192.168.10.0

Allocation 1: Dept A — 60 hosts, /26 (magic number 64)

Network:    192.168.10.0/26
First host: 192.168.10.1
Last host:  192.168.10.62
Broadcast:  192.168.10.63
Next start: 192.168.10.64

Allocation 2: Dept B — 28 hosts, /27 (magic number 32)

Network:    192.168.10.64/27
First host: 192.168.10.65
Last host:  192.168.10.94
Broadcast:  192.168.10.95
Next start: 192.168.10.96

Allocation 3: Dept C — 12 hosts, /28 (magic number 16)

Network:    192.168.10.96/28
First host: 192.168.10.97
Last host:  192.168.10.110
Broadcast:  192.168.10.111
Next start: 192.168.10.112

Allocation 4: Link 1 — 2 hosts, /30 (magic number 4)

Network:    192.168.10.112/30
First host: 192.168.10.113
Last host:  192.168.10.114
Broadcast:  192.168.10.115
Next start: 192.168.10.116

Allocation 5: Link 2 — 2 hosts, /30 (magic number 4)

Network:    192.168.10.116/30
First host: 192.168.10.117
Last host:  192.168.10.118
Broadcast:  192.168.10.119
Next start: 192.168.10.120

Summary of Allocations:

192.168.10.0/26    Dept A      .0   –  .63    62 usable hosts
192.168.10.64/27   Dept B      .64  –  .95    30 usable hosts
192.168.10.96/28   Dept C      .96  –  .111   14 usable hosts
192.168.10.112/30  Link 1      .112 –  .115    2 usable hosts
192.168.10.116/30  Link 2      .116 –  .119    2 usable hosts
192.168.10.120 – 192.168.10.255 = 136 addresses unallocated (reserved for growth)

Total allocated: 64 + 32 + 16 + 4 + 4 = 120 addresses. Total wasted (overhead): 5 subnets × 2 (network + broadcast) = 10 addresses. Usable but unused: 136.

Compare to fixed /26: 5 × 64 = 320 addresses required. VLSM saved 200 addresses — and you still fit everything in a single /24.

Address Space Diagram

192.168.10.0
|-- [0 - 63]    /26   Dept A (60 hosts needed, 62 usable)
|-- [64 - 95]   /27   Dept B (28 hosts needed, 30 usable)
|-- [96 - 111]  /28   Dept C (12 hosts needed, 14 usable)
|-- [112 - 115] /30   Link 1 (2 hosts)
|-- [116 - 119] /30   Link 2 (2 hosts)
|-- [120 - 255]       Unallocated (available for future subnets)

10. Route Summarization (Supernetting)

What Summarization Does

Route summarization (also called supernetting or aggregation) combines multiple specific routes into a single less-specific route. Instead of advertising four /24 routes to a neighbor, you advertise one /22 that covers all four. This reduces routing table size, decreases routing protocol overhead, and hides internal topology changes from external networks.

When a more-specific subnet flaps or changes, the summarized route stays stable as long as at least one component network remains reachable. This is a significant stability benefit.

Finding the Summary Route

Given a group of networks, find the single route that covers all of them with the least additional coverage.

Process:

  1. Write all network addresses in binary
  2. Find the common leading bits (the bits that are identical across all networks)
  3. The summary prefix length = number of common bits
  4. The summary network address = the common bits with remaining bits set to 0

Worked Example: Summarize Four /24s into a /22

Networks to summarize:

  • 192.168.0.0/24
  • 192.168.1.0/24
  • 192.168.2.0/24
  • 192.168.3.0/24

Step 1: Write the third octets in binary (the first two octets are identical — 192.168 — so focus on where they differ):

192.168.0.0   third octet: 0 = 00000000
192.168.1.0   third octet: 1 = 00000001
192.168.2.0   third octet: 2 = 00000010
192.168.3.0   third octet: 3 = 00000011

Step 2: Find common leading bits in the third octet:

00000000
00000001
00000010
00000011

The first 6 bits are all 00000. The 7th bit varies (0,0,1,1) and the 8th bit varies (0,1,0,1). Common bits: 000000 — the first 6 bits of the third octet.

Step 3: Count total common bits.

  • First octet: all 8 bits common (192)
  • Second octet: all 8 bits common (168)
  • Third octet: first 6 bits common
  • Total: 8 + 8 + 6 = 22 bits

Step 4: Summary route = common bits + zeros for the rest.

Third octet common bits: 000000 followed by 00 = 00000000 = 0.

Summary route: 192.168.0.0/22

Verify: 192.168.0.0/22 covers 192.168.0.0 through 192.168.3.255. All four /24s fall within this range.

When Summarization Fails

Summarization fails to produce a tight summary when networks are non-contiguous. Consider:

  • 192.168.0.0/24
  • 192.168.1.0/24
  • 192.168.4.0/24
  • 192.168.5.0/24

Third octets: 0 (00000000), 1 (00000001), 4 (00000100), 5 (00000101). Common bits: only the first 5 bits (00000) are common. Summary would be 192.168.0.0/21, which covers 0–7 in the third octet and includes 192.168.2.0/24, 192.168.3.0/24, and 192.168.6.0/24, 192.168.7.0/24 — networks that do not actually exist on this router. Advertising that summary would cause black-holing of traffic to those non-existent networks if this router is the summarizing point.

The rule: only summarize networks that are actually contiguous and that you originate or own. Never summarize across networks you don’t control.

Cisco IOS Summarization Configuration

In EIGRP, manual summarization is applied on the outbound interface:

interface GigabitEthernet0/1
 ip summary-address eigrp 100 192.168.0.0 255.255.252.0

In OSPF, inter-area summarization is applied on the ABR (Area Border Router):

router ospf 1
 area 1 range 192.168.0.0 255.255.252.0

In BGP, you advertise a summary network:

router bgp 65001
 network 192.168.0.0 mask 255.255.252.0
 aggregate-address 192.168.0.0 255.255.252.0 summary-only

The summary-only keyword suppresses the more-specific routes. Without it, both the summary and the specifics are advertised.

11. IPv4 Header Fields Relevant to Addressing

Understanding how routers use IPv4 header fields clarifies why addressing matters for forwarding behavior.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|          Total Length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |         Header Checksum       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source Address                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination Address                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Destination Address (32 bits): This is what the router actually uses to make the forwarding decision. The router performs a longest-prefix match against its routing table. The route with the most specific matching prefix wins. If 10.0.0.5 matches both a /8 and a /24 route, the /24 wins.

Source Address (32 bits): Used by the receiving end to send replies. Also used by access control lists (ACLs) and firewall rules. Spoofed source addresses are the basis of many DDoS attacks.

Time to Live (TTL, 8 bits): Decremented by 1 at each router hop. When TTL reaches 0, the packet is dropped and an ICMP Time Exceeded message is sent back to the source. Prevents routing loops from circulating packets indefinitely. Initial TTL values are OS-dependent: Linux uses 64, Windows uses 128, Cisco IOS uses 255 for packets it originates. Traceroute uses TTL to map the path hop by hop.

Protocol (8 bits): Identifies the upper-layer protocol carried in the IP payload. Key values:

Value Protocol
1 ICMP
6 TCP
17 UDP
47 GRE
50 ESP (IPsec)
89 OSPF
88 EIGRP

Routers use the Protocol field when processing locally destined packets (punted to the CPU) and for ACL matching. Access lists can filter by protocol number in addition to source/destination addresses.

The Forwarding Decision in Detail:

When a router receives a packet:

  1. Check destination IP
  2. Look up in routing table: find all matching prefixes, select the most specific (longest match)
  3. If a match exists: forward out the associated interface to the next-hop address
  4. If no match exists: drop the packet (and send ICMP Destination Unreachable to source if possible)
  5. Decrement TTL; if TTL == 0, drop and send ICMP Time Exceeded

The routing table entry for a default route is 0.0.0.0/0 — it matches every destination with a prefix length of 0. Any more-specific route beats it. This is the “gateway of last resort.”

12. Cisco IOS Addressing Commands

Assigning an IP Address to an Interface

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# no shutdown

no shutdown is required — interfaces are administratively down by default. Forgetting it is a classic lab mistake.

Secondary IP Addresses

A single interface can carry multiple IP addresses. The first is the primary; subsequent ones are secondary:

Router(config-if)# ip address 10.0.0.1 255.0.0.0 secondary

Secondary addresses are useful when migrating address schemes or when a segment serves two logical networks.

Assigning an Address via DHCP

Router(config-if)# ip address dhcp
Router(config-if)# no shutdown

The interface requests an IP address, mask, default gateway, and DNS from a DHCP server. Useful on WAN interfaces pointing toward an ISP.

show ip interface brief

The most-used verification command. Shows all interfaces with their IP addresses and line/protocol status:

Router# show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     192.168.1.1     YES manual up                    up
GigabitEthernet0/1     10.0.0.1        YES manual up                    up
GigabitEthernet0/2     unassigned      YES unset  administratively down down
Loopback0              172.16.1.1      YES manual up                    up

Column meanings:

  • IP-Address: configured address, or “unassigned” if none
  • OK?: YES if the address is valid; NO indicates a problem
  • Method: how the address was set (manual, DHCP, TFTP, etc.)
  • Status: physical layer state. “up” = connected. “administratively down” = shutdown applied. “down” = physical problem (cable, link partner)
  • Protocol: Layer 2 state. “up” = functioning. “down” usually means the status is also down, or there is a keepalive/encapsulation mismatch

On the exam: “Status up / Protocol down” on a serial interface often means a keepalive mismatch or encapsulation mismatch. “Status down / Protocol down” is a physical layer problem.

show interfaces GigabitEthernet0/0

More verbose than show ip interface brief. IP-relevant fields:

Router# show interfaces GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Hardware is iGbE, address is 0050.56a4.1234 (bia 0050.56a4.1234)
  Internet address is 192.168.1.1/24
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ...
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec

Key fields:

  • Internet address: IP and prefix in CIDR notation
  • MTU: maximum transmission unit — 1500 bytes for Ethernet. Relevant for fragmentation behavior
  • BW: bandwidth in Kbps — used by EIGRP and OSPF for metric calculations
  • input/output rate: traffic statistics — useful for basic troubleshooting

show ip interface GigabitEthernet0/0

Shows IP-specific settings including ACLs, proxy ARP, helper addresses:

Router# show ip interface GigabitEthernet0/0

GigabitEthernet0/0 is up, line protocol is up
  Internet address is 192.168.1.1/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Local Proxy ARP is disabled
  Security level is default
  Split horizon is enabled
  ...

Key items: verify the IP is correct, check for ACLs applied, verify proxy ARP and directed broadcast settings in environments where they matter.

Extended Ping

Standard ping uses the closest interface as the source. Extended ping lets you specify the source interface or address, which is essential for testing specific network paths:

Router# ping 192.168.1.1 source GigabitEthernet0/1

Or interactively:

Router# ping
Protocol [ip]:
Target IP address: 192.168.2.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: GigabitEthernet0/1
Type of service [0]:
Set DF bit in IP header? [no]:
...

When troubleshooting, always ping with a specific source to verify that both directions of the path work. A ping from the router’s closest interface tests only one outbound path. Pinging from a loopback or specific interface tests the return path through that source address.

13. Exam Tips and Common Mistakes

The Most Common Mistakes, Ranked by Frequency

1. Forgetting to subtract 2 for network and broadcast.

The question asks for usable hosts, not total addresses. /29 has 8 total addresses, 6 usable. If you answer 8, you are wrong. Build the habit: after every host calculation, subtract 2. The only exceptions are /31 (subtract 0, per RFC 3021) and /32 (not a subnet at all).

2. Getting the interesting octet wrong for third-octet masks.

For /20 (255.255.240.0), the interesting octet is the third, not the fourth. The fourth is all zeros — it is entirely in the host portion. The exam often uses /18, /19, /20, /21, /22, /23 precisely because these require working in the third octet, and candidates who only practice /24-and-below get these wrong. The giveaway: if the mask has a non-255, non-0 value in the third octet (like 240, 248, 252), your interesting octet is the third, and your subnet boundaries span values in the third octet with the fourth octet cycling 0–255 within each subnet.

3. Confusing /30 and /31.

/30 gives you 4 addresses, 2 usable. /31 gives you 2 addresses with special RFC 3021 rules. If the exam asks for a point-to-point link and does not specify, use /30. If it asks specifically about RFC 3021 or minimum waste, use /31. Know which is which.

4. Selecting the wrong subnet for a given host.

When asked “which subnet does host X belong to?” — do the integer division properly. 77/32 = 2 remainder 13. The subnet starts at 2*32 = 64. If you round up instead of down, you get 96 instead of 64. Always floor-divide: keep the quotient, discard the remainder, multiply back.

5. Off-by-one on broadcast addresses.

The broadcast address is (next subnet’s network address - 1), not the next subnet’s network address itself. If subnets start at 64 and 128, the broadcast for the first subnet is 127, not 128. 128 is the network address of the next subnet — assigning it as a broadcast means you are wrong on two counts.

6. VLSM allocation order.

Always largest subnet first. If you allocate small subnets from the start of the block, you may fragment the space and the large subnet no longer fits in a contiguous range. Some exam scenarios are specifically designed to fail if you allocate in the wrong order.

7. Confusing “number of subnets” with “number of hosts.”

The formula for subnets is 2^(borrowed bits). The formula for hosts is 2^(host bits) - 2. These are different variables. Borrowed bits = new prefix - original prefix. Host bits = 32 - new prefix. Do not substitute one for the other.

“Which Address Is in the Same Subnet?” Question Type

This question type gives you a host IP/mask and asks which of four choices is in the same subnet. The method:

  1. Find the subnet for the given host (magic number method)
  2. Note the network address and broadcast address
  3. Check each answer: is it between network+1 and broadcast-1 (inclusive)? If yes, it is in the same subnet.

Example: Host is 192.168.1.68/26. Magic = 64. Network = 192.168.1.64. Broadcast = 192.168.1.127. Valid hosts: .65 through .126.

If the choices are .127, .64, .100, .128:

  • .127 is the broadcast address — not a valid host, but technically in the subnet range. The exam may accept it as “in the subnet” depending on the wording. Read the question carefully.
  • .64 is the network address — same note.
  • .100 is a valid host in the subnet. Correct answer if asking for a host in the same subnet.
  • .128 is in the next subnet (192.168.1.128/26). Wrong.

Time Management for Subnetting Questions

CCNA exam questions are 90–120 minutes for 100+ questions. Budget 30–45 seconds for simple subnetting questions and up to 90 seconds for VLSM design questions. If a question is taking longer:

  1. Skip it and come back. Flagging and returning is faster than grinding.
  2. Eliminate obviously wrong answers. If you know the network address starts at .64, any answer in .0-.63 or .128+ is wrong for a /26.
  3. Do not recalculate from scratch if you are uncertain — trust the method. The magic number method gives the right answer every time if applied correctly.

The key to speed is not a calculator or memorized tables — it is having practiced the method enough that each step is automatic. Aim to do 10 subnetting problems per day for two weeks before the exam. By the time you sit down to test, it should feel like addition.

Final Review: The Mental Checklist

Before answering any subnetting question, run this checklist:

1. What is the prefix length?          -> Find the mask
2. What is the mask in dotted-decimal? -> Identify interesting octet
3. What is the magic number?           -> 256 - interesting octet value
4. What subnet does the IP fall in?    -> Floor(IP_octet / magic) * magic
5. Network address?                    -> Start of subnet, host bits = 0
6. Broadcast address?                  -> End of subnet, host bits = 1
7. First host?                         -> Network + 1
8. Last host?                          -> Broadcast - 1
9. How many usable hosts?              -> 2^(host bits) - 2
10. How many subnets?                  -> 2^(borrowed bits)

Internalize this checklist. On exam day, you will not need to think about the process — you will only need to execute it.

Subnetting rewards practice more than any other CCNA topic. The concepts are not complex, but the execution under time pressure requires muscle memory. Every example in this post is worth working through independently, with paper and pencil, until the answers come without hesitation. When you reach that point, subnetting questions stop being something you dread and become the easiest points on the exam.

Comments