Subnetting step by step, with worked examples
The one rule behind every subnetting question
Subnetting means splitting an address into a network part and a host part, and every question asks for the same few numbers: the network address, the broadcast address, the usable host range or the number of hosts. The fastest reliable method is the block size: find the octet where the mask stops being 255 or 0, subtract that mask value from 256, and the result is the step between subnets in that octet. Network addresses are the multiples of the block size, and the broadcast address is one below the next multiple.
Everything below is that one rule applied. All figures in the examples were checked with a script, so they can be used as a reference for practice.
The method in five steps
- Convert the prefix to a mask. A /26 has 26 network bits, so the mask is 255.255.255.192.
- Find the interesting octet, the one that is neither 255 nor 0. Here it is the fourth, value 192.
- Block size = 256 minus 192 = 64.
- List the multiples of 64 in that octet: 0, 64, 128, 192. The host address sits between two of them.
- The lower multiple is the network address. The next multiple minus 1 is the broadcast address. The usable range is everything in between. Usable hosts = 2^(host bits) minus 2.
The minus 2 removes the network address and the broadcast address. The exception is a /31, which RFC 3021 allows on point-to-point links with no network or broadcast address, so both addresses are usable. Network+ and CCNA questions on ordinary LANs still use the minus 2 rule.
Worked examples
Example 1: 192.168.10.77/26. Mask 255.255.255.192, block size 64. Multiples: 0, 64, 128, 192. The host .77 lies between 64 and 128. Network 192.168.10.64, broadcast 192.168.10.127, usable 192.168.10.65 to 192.168.10.126. Host bits are 6, so 2^6 - 2 = 62 usable hosts.
Example 2: 172.16.45.200/20. Mask 255.255.240.0. The interesting octet is the third: 256 - 240 = 16. Multiples of 16 in the third octet: … 32, 48. The value 45 lies between 32 and 48. Network 172.16.32.0, broadcast 172.16.47.255 (the fourth octet becomes all ones, the third is 48 minus 1), usable 172.16.32.1 to 172.16.47.254. Twelve host bits give 4094 usable hosts. The fourth octet (.200) did not matter at all, which is the point of the example.
Example 3: 10.20.133.9/21. Mask 255.255.248.0, block size 256 - 248 = 8 in the third octet. Multiples of 8: … 128, 136. The value 133 lies between 128 and 136. Network 10.20.128.0, broadcast 10.20.135.255, usable 10.20.128.1 to 10.20.135.254, 2046 hosts.
Example 4: planning with VLSM. A site has the block 10.0.0.0/24 and needs four segments of 100, 50, 25 and 10 hosts. Allocate from the largest to the smallest so the blocks stay aligned. Pick the smallest power of two that covers the hosts plus 2:
| Need | Prefix | Network | Usable range | Broadcast |
|---|---|---|---|---|
| 100 hosts | /25 | 10.0.0.0 | .1 to .126 | 10.0.0.127 |
| 50 hosts | /26 | 10.0.0.128 | .129 to .190 | 10.0.0.191 |
| 25 hosts | /27 | 10.0.0.192 | .193 to .222 | 10.0.0.223 |
| 10 hosts | /28 | 10.0.0.224 | .225 to .238 | 10.0.0.239 |
Each subnet starts where the previous broadcast ended. The space from 10.0.0.240 to 10.0.0.255 is still free. Allocating the small subnets first would waste space, because a /25 can only start at .0 or .128.
CIDR table to memorise
| Prefix | Mask | Block size | Addresses | Usable hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 1 (first octet) | 16,777,216 | 16,777,214 |
| /16 | 255.255.0.0 | 1 (second octet) | 65,536 | 65,534 |
| /20 | 255.255.240.0 | 16 (third octet) | 4096 | 4094 |
| /22 | 255.255.252.0 | 4 (third octet) | 1024 | 1022 |
| /24 | 255.255.255.0 | 1 (third octet) | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 4 | 2 |
The mask values that appear in the interesting octet are 128, 192, 224, 240, 248, 252, 254, 255. Block sizes are 128, 64, 32, 16, 8, 4, 2, 1. Learn these as one list.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| CCNA 200-301 | v1.1 (until Feb 2, 2027): Network Fundamentals, configure and verify IPv4 addressing and subnetting. v2.0 (from Feb 3, 2027): Network Infrastructure and Connectivity, troubleshoot IPv4 address configuration, assignment and subnetting (public and private) | Network infrastructure explained |
| CompTIA Network+ N10-009 | Networking Concepts: use appropriate IPv4 addressing in a scenario, including subnetting with VLSM and CIDR. Network Troubleshooting adds an incorrect subnet mask or default gateway as a fault to find | Networking concepts explained |
| AZ-104 | Implement and manage virtual networking: create and configure virtual networks and subnets, which means choosing address spaces and subnet sizes. The five addresses Azure reserves per subnet are platform behaviour rather than a named objective | Virtual networking explained |
| 200-901 | A minor topic: Network Fundamentals asks you to describe the purpose and usage of IP addresses, routes, subnet mask or prefix and gateways, at conceptual level without subnet arithmetic | Network fundamentals explained |
How subnetting questions are built
The constraint words decide the answer. “Usable” excludes the network and broadcast addresses, “total addresses” does not. “At least 30 hosts” fits a /27 exactly, because a /27 has 30 usable addresses. “30 hosts plus a router interface” needs 31 and therefore a /26. Questions that say “most efficient” or “smallest subnet” reward the smallest block that still fits, so count the gateway and any reserved addresses before choosing. Read the arithmetic, not the intuition.
The usual traps are these:
- The wrong octet. A /20 or /21 changes the third octet, and candidates apply the block size to the fourth.
- The gateway outside the subnet. Troubleshooting questions give a host address, mask and gateway. If the gateway falls in a different block, the host cannot reach it. This is a very common CCNA scenario.
- Azure reserves five addresses in every subnet, so a /29 yields three usable addresses there, not six.
- Off by one. The broadcast address is the next network address minus one, not the next network address.
- Wildcard masks. ACLs and OSPF network statements use the inverse of the mask; a /26 becomes 0.0.0.63. Subnetting and wildcard questions often share a scenario.
Speed matters: a candidate who spends three minutes on one subnet loses time on the rest of the exam. Practise until the multiples of 64, 32, 16 and 8 come without thinking.
Practice questions
Question 1. A workstation has the address 10.20.133.9 with the mask 255.255.248.0. What is the broadcast address of its subnet?
- A. 10.20.133.255
- B. 10.20.136.0
- C. 10.20.135.255
- D. 10.20.255.255
Show answer
Answer: C
The mask 255.255.248.0 is a /21 with a block size of 8 in the third octet. The value 133 lies between the multiples 128 and 136, so the network is 10.20.128.0 and the broadcast is 10.20.135.255. 10.20.133.255 would only be right for a /24. 10.20.136.0 is the next network address, not a broadcast address. 10.20.255.255 would be the broadcast of a /16.
Question 2. A host is configured with 192.168.1.130, mask 255.255.255.224 and default gateway 192.168.1.97. It can reach other hosts in its own subnet but nothing beyond. What is the cause?
- A. The host address is the broadcast address of its subnet
- B. The default gateway is not in the same subnet as the host
- C. The subnet mask is not a valid mask
- D. The DNS server address is missing
Show answer
Answer: B
The mask is a /27 with a block size of 32. The host 192.168.1.130 is in the subnet 192.168.1.128/27, which covers .128 to .159. The gateway 192.168.1.97 belongs to 192.168.1.96/27, a different subnet, so the host cannot send traffic to it directly. The host address is a valid usable address, the mask is valid, and DNS is not involved because the symptom is lack of routing, not name resolution.