IPv4 Subnetting – Network and Host Portions, CIDR, and Address Calculation
1. IPv4 Address Structure
An IPv4 address is a 32-bit number written as four decimal values separated by dots — each value representing 8 bits (one octet). Understanding the binary representation of an IP address is the foundation of all subnetting calculations.
Decimal: 192 . 168 . 10 . 5
Binary: 11000000 . 10101000 . 00001010 . 00000101
│ │ │ │
Octet 1 Octet 2 Octet 3 Octet 4
(8 bits) (8 bits) (8 bits) (8 bits)
└─────────────────────────────────────────┘
Total: 32 bits
Each octet ranges from 0 (00000000) to 255 (11111111).
Maximum IPv4 address: 255.255.255.255 = 11111111.11111111.11111111.11111111
Decimal-to-binary bit values per octet (memorise these!):
Bit position: 128 64 32 16 8 4 2 1
10 in binary: 0 0 0 0 1 0 1 0 = 8+2 = 10 ✓
192 in binary: 1 1 0 0 0 0 0 0 = 128+64 = 192 ✓
168 in binary: 1 0 1 0 1 0 0 0 = 128+32+8 = 168 ✓
Related pages: IP Addressing | IP Classes | Subnetting Basics | Subnetting | Wildcard Masks | Private vs Public IP | ipconfig & ifconfig | MAC vs IP | Static NAT | Dynamic NAT | Routers | Route Summarization | IPv6 Addressing
2. Network and Host Portions
Every IPv4 address is divided into two logical portions by the subnet mask: the network portion (which identifies the network the address belongs to) and the host portion (which identifies the specific device within that network). The subnet mask uses 1-bits to mark the network portion and 0-bits to mark the host portion.
IP address: 192.168.10.5 = 11000000.10101000.00001010.00000101
Subnet mask: 255.255.255.0 = 11111111.11111111.11111111.00000000
├──── Network portion ────┤├─ Host ─┤
24 bits of 1s 8 bits of 0s
Network portion: 192.168.10 (the first 24 bits — all devices sharing
this network portion are in the same subnet)
Host portion: 5 (the last 8 bits — identifies this specific
device within the 192.168.10.0 network)
The network mask "masks out" the host portion to reveal the network address.
Every device on the SAME subnet has the same network portion but a
different host portion.
Classful Addressing — Default Subnet Masks
Before CIDR (Classless Inter-Domain Routing), IPv4 addresses were assigned to three main classes with fixed default masks. Modern networks use CIDR but classful knowledge is still tested in the CCNA. See also IP Classes:
| Class | First Octet Range | Leading Bits | Default Mask | CIDR | Network / Host | Usable Hosts |
|---|---|---|---|---|---|---|
| A | 1 – 126 | 0xxx xxxx | 255.0.0.0 | /8 | N.H.H.H | 16,777,214 |
| B | 128 – 191 | 10xx xxxx | 255.255.0.0 | /16 | N.N.H.H | 65,534 |
| C | 192 – 223 | 110x xxxx | 255.255.255.0 | /24 | N.N.N.H | 254 |
| D | 224 – 239 | 1110 xxxx | N/A | N/A | Multicast (not assignable) | — |
| E | 240 – 255 | 1111 xxxx | N/A | N/A | Reserved/Experimental | — |
Note: 127.x.x.x (loopback range) is excluded from Class A assignable addresses. 127.0.0.1 is always the localhost loopback address. See Private vs Public IP for reserved ranges.
3. Subnet Masks and CIDR Notation
A subnet mask is a 32-bit value that uses consecutive 1-bits from the left to mark the network portion, followed by consecutive 0-bits for the host portion. There are no gaps — the 1-bits are always contiguous.
CIDR (Classless Inter-Domain Routing) notation expresses
the subnet mask as a prefix length — the number of leading 1-bits
— written after a slash: 192.168.10.5/24 means
the first 24 bits are the network portion.
Subnet mask to CIDR conversion:
255.255.255.0 = 11111111.11111111.11111111.00000000 = /24 (24 ones)
255.255.255.128 = 11111111.11111111.11111111.10000000 = /25 (25 ones)
255.255.255.192 = 11111111.11111111.11111111.11000000 = /26 (26 ones)
255.255.255.224 = 11111111.11111111.11111111.11100000 = /27 (27 ones)
255.255.255.240 = 11111111.11111111.11111111.11110000 = /28 (28 ones)
255.255.255.248 = 11111111.11111111.11111111.11111000 = /29 (29 ones)
255.255.255.252 = 11111111.11111111.11111111.11111100 = /30 (30 ones)
255.255.0.0 = 11111111.11111111.00000000.00000000 = /16
255.0.0.0 = 11111111.00000000.00000000.00000000 = /8
Converting a fourth-octet mask value to bits:
The fourth octet can only hold these valid subnet mask values:
0, 128, 192, 224, 240, 248, 252, 254, 255
(Each is a consecutive run of 1s from the left: 0=0 bits, 128=1 bit,
192=2 bits, 224=3 bits, 240=4 bits, 248=5 bits, 252=6 bits,
254=7 bits, 255=8 bits)
4. Finding the Network Address — Bitwise AND
The network address (also called the subnet address) is found by performing a bitwise AND operation between the IP address and the subnet mask. AND rules: 1 AND 1 = 1; 1 AND 0 = 0; 0 AND 0 = 0. The result has all host bits set to zero.
Example: Find the network address for 192.168.10.5/24
IP address: 11000000 . 10101000 . 00001010 . 00000101
Subnet mask: 11111111 . 11111111 . 11111111 . 00000000
──────────────────────────────────────────
AND result: 11000000 . 10101000 . 00001010 . 00000000
= Network: 192 . 168 . 10 . 0
Network address: 192.168.10.0
The bitwise AND "wipes out" the host portion (AND with 0 = 0),
leaving the network portion unchanged (AND with 1 = original bit).
Worked Example — Non-Octet Boundary (/20)
Example: Find the network address for 172.16.50.123/20
Step 1: Write out the subnet mask for /20
/20 = 20 ones: 11111111.11111111.11110000.00000000 = 255.255.240.0
Step 2: Convert the third octet to binary (50 = 00110010)
IP: 172.16. 00110010.01111011 (50.123 in binary)
Mask: 255.255.11110000.00000000 (240.0)
─────────────────────────
AND: 172.16. 00110000.00000000 (48.0)
Network address: 172.16.48.0
Quick method (block size):
Third octet mask = 240.
Block size = 256 - 240 = 16.
Multiples of 16: 0, 16, 32, 48, 64...
50 falls between 48 and 64 → network starts at 48.
Network address: 172.16.48.0 ✓
5. Finding the Broadcast Address
The broadcast address is the last address in the subnet — all host bits are set to 1. Frames sent to the broadcast address are received by every device in the subnet. The broadcast address cannot be assigned to a device.
Method: Take the network address and set ALL host bits to 1.
Example: 192.168.10.0/24 (8 host bits)
Network: 11000000.10101000.00001010. 00000000
Set host: 11000000.10101000.00001010. 11111111
Broadcast: 192.168.10.255
Example: 172.16.48.0/20 (12 host bits)
Network: 172.16. 00110000.00000000
Set hosts: 172.16. 00111111.11111111 (last 12 bits → all 1s)
Broadcast: 172.16.63.255
Quick method (block size):
Block size = 256 - 240 = 16.
Network starts at 48 → next network starts at 64.
Broadcast = 64 - 1 = 63 (third octet), fourth octet = 255.
Broadcast: 172.16.63.255 ✓
6. Usable Host Range and the 2^n − 2 Formula
The usable host range is the set of addresses that can be assigned to devices. The first address (all host bits = 0) is the network address; the last (all host bits = 1) is the broadcast address. Both are reserved and cannot be used for device assignment.
Usable host range:
First usable = Network address + 1 (host bits: 00...001)
Last usable = Broadcast address - 1 (host bits: 11...110)
Number of usable hosts = 2^(host bits) - 2
The "- 2" accounts for: 1 network address + 1 broadcast address.
Example: 192.168.10.0/24
Host bits = 32 - 24 = 8
Usable hosts = 2^8 - 2 = 256 - 2 = 254
Range: 192.168.10.1 → 192.168.10.254
Example: 192.168.10.0/26
Host bits = 32 - 26 = 6
Usable hosts = 2^6 - 2 = 64 - 2 = 62
Range: 192.168.10.1 → 192.168.10.62
Broadcast: 192.168.10.63
Special case: /30 (point-to-point links)
Host bits = 2
Usable hosts = 2^2 - 2 = 4 - 2 = 2 ← just enough for two router interfaces
e.g., 192.168.1.0/30: usable = .1 and .2, broadcast = .3
Powers of 2 — memorise these:
2^1 = 2 2^5 = 32 2^9 = 512
2^2 = 4 2^6 = 64 2^10 = 1024
2^3 = 8 2^7 = 128 2^11 = 2048
2^4 = 16 2^8 = 256 2^12 = 4096
7. Subnetting — Borrowing Bits
Subnetting divides a larger network into smaller sub-networks by borrowing bits from the host portion and adding them to the network portion. Each borrowed bit doubles the number of subnets and halves the number of hosts per subnet.
Subnetting formulas:
Number of subnets = 2^(borrowed bits)
Hosts per subnet = 2^(remaining host bits) - 2
Example: Divide 192.168.20.0/24 into 4 subnets.
Need 4 subnets → 2^2 = 4 → borrow 2 bits
New prefix = /24 + 2 = /26
Remaining host bits = 8 - 2 = 6
Hosts per subnet = 2^6 - 2 = 62
Block size for /26 = 256 - 192 = 64 (fourth octet mask = 192)
The 4 subnets of 192.168.20.0/26:
Subnet 1: Network 192.168.20.0 Broadcast 192.168.20.63 Hosts .1–.62
Subnet 2: Network 192.168.20.64 Broadcast 192.168.20.127 Hosts .65–.126
Subnet 3: Network 192.168.20.128 Broadcast 192.168.20.191 Hosts .129–.190
Subnet 4: Network 192.168.20.192 Broadcast 192.168.20.255 Hosts .193–.254
| Borrowed Bits | Subnets Created (2^n) | New CIDR (from /24) | Host Bits Left | Usable Hosts (2^h−2) | Block Size | Subnet Mask |
|---|---|---|---|---|---|---|
| 1 | 2 | /25 | 7 | 126 | 128 | 255.255.255.128 |
| 2 | 4 | /26 | 6 | 62 | 64 | 255.255.255.192 |
| 3 | 8 | /27 | 5 | 30 | 32 | 255.255.255.224 |
| 4 | 16 | /28 | 4 | 14 | 16 | 255.255.255.240 |
| 5 | 32 | /29 | 3 | 6 | 8 | 255.255.255.248 |
| 6 | 64 | /30 | 2 | 2 | 4 | 255.255.255.252 |
8. The Block Size Method — Fast Subnetting
The block size method is the fastest way to find subnet boundaries without converting every octet to binary. The block size is the increment between consecutive subnet network addresses.
Block size formula:
Block size = 256 - (interesting octet value of subnet mask)
The "interesting octet" is the last non-255 octet of the mask.
Examples:
/26 → mask = 255.255.255.192 → interesting octet = 192 → block = 256-192 = 64
/27 → mask = 255.255.255.224 → interesting octet = 224 → block = 256-224 = 32
/28 → mask = 255.255.255.240 → interesting octet = 240 → block = 256-240 = 16
/20 → mask = 255.255.240.0 → interesting octet = 240 → block = 256-240 = 16
Using block size to find which subnet an IP belongs to:
IP: 10.10.55.200/22
Mask = 255.255.252.0 → interesting octet = third → 252 → block = 256-252 = 4
Third octet multiples of 4: 0, 4, 8, ..., 52, 56, 60...
55 is between 52 and 56 → network starts at 52 (third octet)
Network: 10.10.52.0
Broadcast: 10.10.55.255 (next network is 10.10.56.0 → subtract 1 → .55.255)
Usable: 10.10.52.1 → 10.10.55.254
Check: 10.10.55.200 falls in this range ✓
9. VLSM — Variable Length Subnet Masking
VLSM allows different subnets within the same network to use different prefix lengths — allocating exactly the right number of host addresses for each requirement rather than using the same size everywhere. This maximises efficient use of the address space.
Scenario: Allocate addresses from 192.168.1.0/24 for:
- Site A: 50 hosts needed
- Site B: 25 hosts needed
- Site C: 10 hosts needed
- WAN link between routers: 2 hosts needed
Step 1 — largest requirement first (50 hosts):
Need: 50 hosts → need at least 52 addresses (50+2) → /26 gives 62 hosts ✓
Site A: 192.168.1.0/26 (hosts .1–.62, broadcast .63)
Step 2 — next largest (25 hosts):
Need: 25 hosts → need 27 addresses → /27 gives 30 hosts ✓
Site B: 192.168.1.64/27 (hosts .65–.94, broadcast .95)
Step 3 — next (10 hosts):
Need: 10 hosts → need 12 addresses → /28 gives 14 hosts ✓
Site C: 192.168.1.96/28 (hosts .97–.110, broadcast .111)
Step 4 — WAN link (2 hosts):
Need: 2 hosts → /30 gives exactly 2 usable ✓
WAN: 192.168.1.112/30 (hosts .113–.114, broadcast .115)
VLSM wastes far fewer addresses than using /26 for everything:
All /26: 4 × 64 = 256 addresses used (entire /24 consumed for 87 hosts)
VLSM: 192 addresses allocated, leaving 192.168.1.116/? still available
10. Common Subnet Reference Table
| CIDR | Subnet Mask | Network Bits | Host Bits | Block Size | Addresses | Usable Hosts | Typical Use |
|---|---|---|---|---|---|---|---|
| /8 | 255.0.0.0 | 8 | 24 | — | 16,777,216 | 16,777,214 | Class A network |
| /16 | 255.255.0.0 | 16 | 16 | — | 65,536 | 65,534 | Class B / large enterprise |
| /24 | 255.255.255.0 | 24 | 8 | 1 (in octet 3) | 256 | 254 | Standard office LAN |
| /25 | 255.255.255.128 | 25 | 7 | 128 | 128 | 126 | Medium LAN |
| /26 | 255.255.255.192 | 26 | 6 | 64 | 64 | 62 | Department subnet |
| /27 | 255.255.255.224 | 27 | 5 | 32 | 32 | 30 | Small department |
| /28 | 255.255.255.240 | 28 | 4 | 16 | 16 | 14 | Small workgroup |
| /29 | 255.255.255.248 | 29 | 3 | 8 | 8 | 6 | Very small segment |
| /30 | 255.255.255.252 | 30 | 2 | 4 | 4 | 2 | Point-to-point WAN links |
| /31 | 255.255.255.254 | 31 | 1 | 2 | 2 | 2* | P2P links (RFC 3021 — no broadcast) |
| /32 | 255.255.255.255 | 32 | 0 | 1 | 1 | 1* | Host route, loopback |
* /31 and /32 are special cases: /31 is used for point-to-point links (RFC 3021) with no network or broadcast address; /32 is a host route (identifies a single specific address — used for loopback interfaces and static host routes).
11. Fully Worked Exam Example
Work through this example completely without a calculator — the method used here matches the speed needed for CCNA exam conditions.
Given: 172.16.50.123/20
Find: Network address, broadcast address, first usable, last usable,
number of usable hosts.
Step 1 — Identify the subnet mask for /20:
/20 = 255.255.240.0
Interesting octet = third (240)
Step 2 — Calculate block size:
Block size = 256 - 240 = 16
Step 3 — Find the network address:
Third octet of IP = 50
Multiples of 16 ≤ 50: 0, 16, 32, 48 (next is 64 which exceeds 50)
50 belongs to the block starting at 48
Network address = 172.16.48.0
Step 4 — Find the broadcast address:
Next network starts at 172.16.64.0 (48 + 16 = 64)
Broadcast = 172.16.64.0 - 1 address = 172.16.63.255
Step 5 — Usable host range:
First usable = 172.16.48.1
Last usable = 172.16.63.254
Step 6 — Number of usable hosts:
Host bits = 32 - 20 = 12
Usable hosts = 2^12 - 2 = 4096 - 2 = 4094
Summary:
Network address: 172.16.48.0
Subnet mask: 255.255.240.0 (/20)
First usable host: 172.16.48.1
Last usable host: 172.16.63.254
Broadcast address: 172.16.63.255
Usable hosts: 4094
Verify: 172.16.50.123 is between .48.1 and .63.254 ✓
12. Common Subnetting Mistakes
| Mistake | Example of the Error | Correct Approach |
|---|---|---|
| Forgetting to subtract 2 for network and broadcast | /24 → says 256 hosts instead of 254 | Always apply 2^(host bits) − 2 |
| Using the IP address as the network address | Saying network = 172.16.50.123 when it is 172.16.48.0 | Perform bitwise AND or use block size to find the correct network address |
| Confusing subnet mask with wildcard mask | Wildcard mask 0.0.0.255 is NOT the same as subnet mask 255.255.255.0 — wildcards are used in ACLs and OSPF network statements (inverse of the subnet mask) | Wildcard = 255.255.255.255 − subnet mask |
| Forgetting that /31 and /32 are special cases | Applying the 2^n−2 formula to /30 and getting 2, then using the same formula for /31 and getting 0 | /30 gives 2 usable hosts; /31 (RFC 3021) gives 2 usable on P2P links with no reserved addresses; /32 is a host route |
| Miscounting borrowed bits | Starting with /24, borrowing 3 bits, and thinking the new prefix is /27 but calculating hosts using 5 host bits instead of 5 (32-27=5 — this one is actually correct, but confusion about which number to use is common) | Host bits = 32 − new prefix length. New prefix = old prefix + borrowed bits |
| Not aligning to block boundaries | Assuming 172.16.50.123/20 has network address 172.16.50.0 instead of 172.16.48.0 | Find the nearest multiple of the block size in the interesting octet that is ≤ the IP's octet value |
13. Exam Tips & Key Points
- An IPv4 address is 32 bits, divided into four 8-bit octets. IPv6 is 128 bits — do not confuse the two.
- The subnet mask uses consecutive 1-bits (network portion) followed by consecutive 0-bits (host portion). The prefix length (/n) counts the 1-bits.
- The network address = IP AND subnet mask (all host bits = 0). The broadcast address = network address with all host bits = 1.
- Usable hosts per subnet = 2^(host bits) − 2. The "−2" accounts for the network address and broadcast address.
- The block size method is the fastest exam technique: block size = 256 − interesting octet. Find the nearest multiple of block size ≤ the IP's octet.
- Number of subnets when borrowing bits = 2^(borrowed bits). Hosts per new subnet = 2^(remaining host bits) −2.
- Know the critical prefix lengths by memory: /30 = 2 usable (P2P links), /29 = 6 usable, /28 = 14 usable, /27 = 30 usable, /26 = 62 usable, /25 = 126 usable, /24 = 254 usable.
- Wildcard mask = 255.255.255.255 − subnet mask.
A /24 wildcard = 0.0.0.255 (used in OSPF
networkstatements and ACLs). - VLSM allocates differently-sized subnets from a single block — assign largest subnets first to avoid fragmentation. Essential for route summarization.
- Class A = first octet 1–126; Class B = 128–191; Class C = 192–223. 127.x.x.x is the loopback range. See also Private vs Public IP.
14. Summary Reference Table
| Concept | Formula / Rule |
|---|---|
| IPv4 address size | 32 bits (4 octets × 8 bits) |
| Network address | IP AND subnet mask (all host bits = 0) |
| Broadcast address | Network address with all host bits set to 1 |
| First usable host | Network address + 1 |
| Last usable host | Broadcast address − 1 |
| Usable hosts per subnet | 2^(host bits) − 2 |
| Host bits | 32 − prefix length |
| Number of subnets | 2^(borrowed bits) |
| Block size | 256 − interesting octet of subnet mask |
| Wildcard mask | 255.255.255.255 − subnet mask |
| Class A default mask | 255.0.0.0 (/8) |
| Class B default mask | 255.255.0.0 (/16) |
| Class C default mask | 255.255.255.0 (/24) |
IPv4 Subnetting Quiz
Related Topics & Step-by-Step Tutorials
Continue building your subnetting and addressing knowledge:
- Subnetting Basics — conceptual intro before diving into calculations
- Subnetting — additional subnetting practice and methods
- IP Addressing — full IPv4 address structure and assignment
- IP Classes — Class A, B, C, D, E ranges and default masks
- Wildcard Masks — used in OSPF and ACLs; inverse of subnet masks
- Private vs Public IP — RFC 1918 reserved ranges (10.x, 172.16–31.x, 192.168.x)
- Private vs Public IP (detailed)
- Route Summarization — applying VLSM knowledge to aggregate routes
- NAT Overview — how private subnets reach the internet
- Dynamic NAT — pool-based translation of subnets
- Static NAT — one-to-one host mapping
- PAT — many-to-one overloading (most common in home/office)
- DHCP Overview — automatic IP assignment within subnets
- DHCP Server Configuration — configuring scopes aligned to your subnets
- OSPF Overview — uses subnet masks and wildcard masks extensively
- OSPF Single-Area Configuration
- ACL Overview — ACLs use wildcard masks derived from subnet masks
- IPv6 Addressing — the 128-bit successor to IPv4 subnetting
- IPv6 Basic Configuration
- Route Summarization & Aggregation — VLSM in practice
- ipconfig / ifconfig — verify subnet mask and IP on a host
- show ip interface brief — verify IP assignments on router interfaces