IPv4 Subnetting – Network and Host Portions, CIDR, and Address Calculation

1. IPv4 Address Structure

An IPv4 address is a 32-bit number written as four decimal values separated by dots — each value representing 8 bits (one octet). Understanding the binary representation of an IP address is the foundation of all subnetting calculations.

2. Network and Host Portions

Every IPv4 address is divided into two logical portions by the subnet mask: the network portion (which identifies the network the address belongs to) and the host portion (which identifies the specific device within that network). The subnet mask uses 1-bits to mark the network portion and 0-bits to mark the host portion.

Classful Addressing — Default Subnet Masks

Before CIDR (Classless Inter-Domain Routing), IPv4 addresses were assigned to three main classes with fixed default masks. Modern networks use CIDR but classful knowledge is still tested in the CCNA. See also IP Classes:

Class	First Octet Range	Leading Bits	Default Mask	CIDR	Network / Host	Usable Hosts
A	1 – 126	0xxx xxxx	255.0.0.0	/8	N.H.H.H	16,777,214
B	128 – 191	10xx xxxx	255.255.0.0	/16	N.N.H.H	65,534
C	192 – 223	110x xxxx	255.255.255.0	/24	N.N.N.H	254
D	224 – 239	1110 xxxx	N/A	N/A	Multicast (not assignable)	—
E	240 – 255	1111 xxxx	N/A	N/A	Reserved/Experimental	—

Note: 127.x.x.x (loopback range) is excluded from Class A assignable addresses. 127.0.0.1 is always the localhost loopback address. See Private vs Public IP for reserved ranges.

3. Subnet Masks and CIDR Notation

A subnet mask is a 32-bit value that uses consecutive 1-bits from the left to mark the network portion, followed by consecutive 0-bits for the host portion. There are no gaps — the 1-bits are always contiguous.

CIDR (Classless Inter-Domain Routing) notation expresses the subnet mask as a prefix length — the number of leading 1-bits — written after a slash: 192.168.10.5/24 means the first 24 bits are the network portion.

4. Finding the Network Address — Bitwise AND

The network address (also called the subnet address) is found by performing a bitwise AND operation between the IP address and the subnet mask. AND rules: 1 AND 1 = 1; 1 AND 0 = 0; 0 AND 0 = 0. The result has all host bits set to zero.

Worked Example — Non-Octet Boundary (/20)

5. Finding the Broadcast Address

The broadcast address is the last address in the subnet — all host bits are set to 1. Frames sent to the broadcast address are received by every device in the subnet. The broadcast address cannot be assigned to a device.

6. Usable Host Range and the 2^n − 2 Formula

The usable host range is the set of addresses that can be assigned to devices. The first address (all host bits = 0) is the network address; the last (all host bits = 1) is the broadcast address. Both are reserved and cannot be used for device assignment.

7. Subnetting — Borrowing Bits

Subnetting divides a larger network into smaller sub-networks by borrowing bits from the host portion and adding them to the network portion. Each borrowed bit doubles the number of subnets and halves the number of hosts per subnet.

Borrowed Bits	Subnets Created (2^n)	New CIDR (from /24)	Host Bits Left	Usable Hosts (2^h−2)	Block Size	Subnet Mask
1	2	/25	7	126	128	255.255.255.128
2	4	/26	6	62	64	255.255.255.192
3	8	/27	5	30	32	255.255.255.224
4	16	/28	4	14	16	255.255.255.240
5	32	/29	3	6	8	255.255.255.248
6	64	/30	2	2	4	255.255.255.252

8. The Block Size Method — Fast Subnetting

The block size method is the fastest way to find subnet boundaries without converting every octet to binary. The block size is the increment between consecutive subnet network addresses.

9. VLSM — Variable Length Subnet Masking

VLSM allows different subnets within the same network to use different prefix lengths — allocating exactly the right number of host addresses for each requirement rather than using the same size everywhere. This maximises efficient use of the address space.

10. Common Subnet Reference Table

CIDR	Subnet Mask	Network Bits	Host Bits	Block Size	Addresses	Usable Hosts	Typical Use
/8	255.0.0.0	8	24	—	16,777,216	16,777,214	Class A network
/16	255.255.0.0	16	16	—	65,536	65,534	Class B / large enterprise
/24	255.255.255.0	24	8	1 (in octet 3)	256	254	Standard office LAN
/25	255.255.255.128	25	7	128	128	126	Medium LAN
/26	255.255.255.192	26	6	64	64	62	Department subnet
/27	255.255.255.224	27	5	32	32	30	Small department
/28	255.255.255.240	28	4	16	16	14	Small workgroup
/29	255.255.255.248	29	3	8	8	6	Very small segment
/30	255.255.255.252	30	2	4	4	2	Point-to-point WAN links
/31	255.255.255.254	31	1	2	2	2*	P2P links (RFC 3021 — no broadcast)
/32	255.255.255.255	32	0	1	1	1*	Host route, loopback

* /31 and /32 are special cases: /31 is used for point-to-point links (RFC 3021) with no network or broadcast address; /32 is a host route (identifies a single specific address — used for loopback interfaces and static host routes).

11. Fully Worked Exam Example

Work through this example completely without a calculator — the method used here matches the speed needed for CCNA exam conditions.

12. Common Subnetting Mistakes

Mistake	Example of the Error	Correct Approach
Forgetting to subtract 2 for network and broadcast	/24 → says 256 hosts instead of 254	Always apply 2^(host bits) − 2
Using the IP address as the network address	Saying network = 172.16.50.123 when it is 172.16.48.0	Perform bitwise AND or use block size to find the correct network address
Confusing subnet mask with wildcard mask	Wildcard mask 0.0.0.255 is NOT the same as subnet mask 255.255.255.0 — wildcards are used in ACLs and OSPF network statements (inverse of the subnet mask)	Wildcard = 255.255.255.255 − subnet mask
Forgetting that /31 and /32 are special cases	Applying the 2^n−2 formula to /30 and getting 2, then using the same formula for /31 and getting 0	/30 gives 2 usable hosts; /31 (RFC 3021) gives 2 usable on P2P links with no reserved addresses; /32 is a host route
Miscounting borrowed bits	Starting with /24, borrowing 3 bits, and thinking the new prefix is /27 but calculating hosts using 5 host bits instead of 5 (32-27=5 — this one is actually correct, but confusion about which number to use is common)	Host bits = 32 − new prefix length. New prefix = old prefix + borrowed bits
Not aligning to block boundaries	Assuming 172.16.50.123/20 has network address 172.16.50.0 instead of 172.16.48.0	Find the nearest multiple of the block size in the interesting octet that is ≤ the IP's octet value

13. Exam Tips & Key Points

An IPv4 address is 32 bits, divided into four 8-bit octets. IPv6 is 128 bits — do not confuse the two.
The subnet mask uses consecutive 1-bits (network portion) followed by consecutive 0-bits (host portion). The prefix length (/n) counts the 1-bits.
The network address = IP AND subnet mask (all host bits = 0). The broadcast address = network address with all host bits = 1.
Usable hosts per subnet = 2^(host bits) − 2. The "−2" accounts for the network address and broadcast address.
The block size method is the fastest exam technique: block size = 256 − interesting octet. Find the nearest multiple of block size ≤ the IP's octet.
Number of subnets when borrowing bits = 2^(borrowed bits). Hosts per new subnet = 2^(remaining host bits) −2.
Know the critical prefix lengths by memory: /30 = 2 usable (P2P links), /29 = 6 usable, /28 = 14 usable, /27 = 30 usable, /26 = 62 usable, /25 = 126 usable, /24 = 254 usable.
Wildcard mask = 255.255.255.255 − subnet mask. A /24 wildcard = 0.0.0.255 (used in OSPF network statements and ACLs).
VLSM allocates differently-sized subnets from a single block — assign largest subnets first to avoid fragmentation. Essential for route summarization.
Class A = first octet 1–126; Class B = 128–191; Class C = 192–223. 127.x.x.x is the loopback range. See also Private vs Public IP.

14. Summary Reference Table

Concept	Formula / Rule
IPv4 address size	32 bits (4 octets × 8 bits)
Network address	IP AND subnet mask (all host bits = 0)
Broadcast address	Network address with all host bits set to 1
First usable host	Network address + 1
Last usable host	Broadcast address − 1
Usable hosts per subnet	2^(host bits) − 2
Host bits	32 − prefix length
Number of subnets	2^(borrowed bits)
Block size	256 − interesting octet of subnet mask
Wildcard mask	255.255.255.255 − subnet mask
Class A default mask	255.0.0.0 (/8)
Class B default mask	255.255.0.0 (/16)
Class C default mask	255.255.255.0 (/24)

IPv4 Subnetting Quiz

How many bits are in an IPv4 address, and how is it structured?

A. 16 bits — two groups of 8 bits separated by a colon, like 192:168 B. 32 bits — four octets (groups of 8 bits) separated by dots, e.g. 192.168.10.5; each octet can range from 0 (00000000) to 255 (11111111) C. 64 bits — eight groups of 8 bits; used for both IPv4 and IPv6 D. 128 bits — the same size as IPv6; modern IPv4 systems use the full 128-bit address space

Correct answer is B. An IPv4 address is exactly 32 bits long, written as four decimal numbers separated by dots — each number representing one 8-bit octet. For example, 192.168.10.5 in binary is 11000000.10101000.00001010.00000101. Each octet can hold values from 0 (00000000 binary) to 255 (11111111 binary). The total address space of IPv4 is 2^32 = approximately 4.3 billion addresses. IPv6 uses 128 bits — exactly four times larger — written in hexadecimal as eight groups of four hex digits separated by colons.

What is the default subnet mask for a Class C network, and what address range identifies a Class C IP?

A. 255.0.0.0 (/8) — first octet range 1–126; used by the earliest large internet organisations B. 255.255.0.0 (/16) — first octet range 128–191; allocated for medium-sized enterprises C. 255.255.255.255 (/32) — the entire address space; used for all Class C assignments D. 255.255.255.0 (/24) — first octet range 192–223; a /24 provides 254 usable host addresses in the last octet

Correct answer is D. Class C networks are identified by a first octet between 192 and 223. The default subnet mask is 255.255.255.0 (/24 in CIDR notation), meaning the first 24 bits identify the network and the last 8 bits identify hosts. A /24 network has 2^8 = 256 total addresses, with 254 usable for devices (256 − 2 for the network address and broadcast address). The three main classes: Class A (1–126, /8, 16M+ hosts), Class B (128–191, /16, 65K+ hosts), Class C (192–223, /24, 254 hosts). Note that 127.x.x.x is reserved for loopback and is excluded from the Class A assignable range.

What is the purpose of the subnet mask, and what operation uses it to find the network address?

A. The subnet mask defines the boundary between network and host portions of an IP address — performing a bitwise AND between the IP address and the subnet mask reveals the network address (host bits zeroed out) B. The subnet mask encrypts IP addresses before transmission — the AND operation decrypts the address for routing C. The subnet mask assigns IP addresses dynamically to hosts — the AND operation calculates which address to assign next D. The subnet mask converts IP addresses to MAC addresses — the AND operation is part of the ARP resolution process

Correct answer is A. The subnet mask is a 32-bit value of consecutive 1-bits (network portion) followed by 0-bits (host portion). It defines exactly how many bits of an IP address identify the network versus the individual host. To find the network address, the router performs a bitwise AND between each bit of the IP address and the corresponding bit of the subnet mask. AND rules: 1 AND 1 = 1; anything AND 0 = 0. The result: bits in the network portion are preserved unchanged (ANDed with 1), while bits in the host portion are zeroed (ANDed with 0). This produces the network address. For example: 192.168.10.5 AND 255.255.255.0 = 192.168.10.0.

Perform the bitwise AND: IP address 192.168.10.5 with subnet mask 255.255.255.0. What is the network address?

A. 192.168.10.5 — the IP address itself is always the network address when the host bits are not all zero B. 192.168.0.0 — the AND operation zeros out the last two octets when the mask is 255.255.255.0 C. 192.168.10.0 — the AND zeros out only the fourth octet (the host portion for /24), leaving the first three octets (the network portion) unchanged D. 192.168.255.255 — the AND inverts the host bits to produce the broadcast address

Correct answer is C. The bitwise AND operation works bit by bit. For 192.168.10.5 AND 255.255.255.0: The mask 255.255.255.0 means the first three octets (192.168.10) are all 1-bits — these are preserved unchanged. The fourth octet mask is 0 (00000000 binary) — every bit ANDed with 0 becomes 0, regardless of the original IP bit. The fourth octet of the IP is 5 (00000101) AND 0 (00000000) = 0 (00000000). So the network address is 192.168.10.0. This is the address that identifies the entire 192.168.10.0/24 subnet. Option B is wrong because the mask 255.255.255.0 only zeroes the fourth octet, not the third. Option D describes a different operation (setting bits to 1) used for finding the broadcast address.

What is the formula for the number of usable hosts per subnet, and why are 2 addresses always subtracted?

A. 2^(network bits) — the number of usable hosts equals the number of network bits raised to the power of 2 B. 2^(host bits) − 2 — the total addresses in the subnet is 2^(host bits), but 2 are always reserved: the network address (all host bits = 0) and the broadcast address (all host bits = 1) C. 2^(total 32 bits) − 2 — all 32 bits determine the size; the −2 removes the default and broadcast D. Host bits × 2 — multiply the host bit count by 2 to get the usable address count

Correct answer is B. The formula is 2^(host bits) − 2. The host bits are all the bits in the IP address that are NOT in the network portion: host bits = 32 − prefix length. The total number of combinations those bits can represent is 2^(host bits). However, two specific combinations are reserved and cannot be assigned to devices: (1) all host bits = 0 — this is the network address, used to identify the subnet itself in routing tables and configurations; (2) all host bits = 1 — this is the broadcast address, used to send a frame to every device in the subnet simultaneously. Subtracting these two reserved addresses gives the count of assignable addresses. Example: /26 → host bits = 32−26 = 6 → 2^6 = 64 → 64−2 = 62 usable.

A /26 subnet is used. How many host bits remain, how many usable hosts does it provide, and what is the block size?

A. 6 host bits — 62 usable hosts (2^6 − 2 = 62) — block size = 64 (256 − 192 = 64, where 192 is the fourth-octet mask value) B. 26 bits — the prefix length itself is the host bit count for /26 C. 8 bits — /26 still uses a full octet for host addressing giving 254 hosts D. 24 bits — the host portion spans the entire fourth octet unchanged from /24

Correct answer is A. For a /26 subnet: host bits = 32 − 26 = 6. The subnet mask is 255.255.255.192 (11111111.11111111.11111111.11000000 — 26 consecutive ones). Usable hosts = 2^6 − 2 = 64 − 2 = 62. Block size = 256 − 192 = 64. This means /26 subnets start at multiples of 64 in the fourth octet: 0, 64, 128, 192. Each /26 block contains 64 addresses: network (.0, .64, .128, or .192), 62 usable hosts, and a broadcast (.63, .127, .191, or .255 respectively). The /26 is a very common subnet size for department networks that need fewer than 62 hosts but more than 30.

What is the broadcast address for the network 192.168.10.0/24, and how is it calculated?

A. 192.168.10.0 — this is the network address, which is also used as the broadcast in some configurations B. 192.168.10.1 — the first assignable address is treated as the broadcast for compatibility with older systems C. 192.168.10.254 — the last usable host address is the broadcast D. 192.168.10.255 — the broadcast is the network address with all host bits set to 1; for /24 the host portion is the fourth octet, so 11111111 binary = 255 decimal

Correct answer is D. The broadcast address is found by taking the network address and setting all host bits to 1. For 192.168.10.0/24: the host portion is the fourth octet (8 bits), so all 8 host bits set to 1 = 11111111 binary = 255 decimal. The broadcast address is 192.168.10.255. Any frame sent to 192.168.10.255 is received by every device in the 192.168.10.0/24 subnet. The usable host range is from .1 (network + 1) to .254 (broadcast − 1). The broadcast address cannot be assigned to any device — it is reserved for subnet-wide broadcast frames (DHCP discovery, ARP requests, etc.).

Using the block size method, what is the network address for IP 172.16.50.123/20?

A. 172.16.50.0 — the network address uses the exact value of the third octet B. 172.16.32.0 — /20 aligns to the nearest multiple of 32 in the third octet C. 172.16.48.0 — /20 gives mask 255.255.240.0, block size = 256−240 = 16; multiples of 16 in the third octet: 0,16,32,48,64; 50 falls between 48 and 64, so network starts at 48 D. 172.16.63.255 — this is the broadcast address for the subnet, not the network address

Correct answer is C. Applying the block size method to 172.16.50.123/20: the mask for /20 is 255.255.240.0; the interesting octet is the third (240). Block size = 256 − 240 = 16. List multiples of 16 in the third octet: 0, 16, 32, 48, 64, 80... The third octet of the IP is 50. The largest multiple of 16 that is ≤ 50 is 48 (next is 64 which exceeds 50). Therefore the network address is 172.16.48.0. The broadcast address is 172.16.63.255 (48 + 16 − 1 = 63 in the third octet, 255 in the fourth). The usable range is 172.16.48.1 through 172.16.63.254. 172.16.50.123 falls within this range, confirming the calculation is correct.

What is the full usable IP range for 192.168.1.0/24, and why do .0 and .255 not qualify as usable?

A. 192.168.1.0 to 192.168.1.255 — all 256 addresses in the /24 are usable for device assignment B. 192.168.1.1 to 192.168.1.254 — .0 is the network address (all host bits = 0, reserved to identify the subnet) and .255 is the broadcast address (all host bits = 1, reserved for subnet-wide broadcasts) C. 192.168.1.1 to 192.168.1.255 — .255 is a valid host address in modern networking D. 192.168.1.0 to 192.168.1.254 — .0 is a valid host address but .255 is reserved

Correct answer is B. The usable IP range for 192.168.1.0/24 is 192.168.1.1 through 192.168.1.254 — exactly 254 usable addresses. Two addresses are reserved: 192.168.1.0 (the network address — all host bits are 0; this address identifies the subnet in routing tables and cannot be assigned to a host) and 192.168.1.255 (the broadcast address — all host bits are 1; a frame sent here is delivered to every device in the subnet simultaneously and cannot be assigned to a host). The general rules: first usable = network address + 1; last usable = broadcast address − 1. These rules apply to every subnet, regardless of prefix length.

A network administrator needs to divide 192.168.20.0/24 into exactly 4 equal subnets. How many bits must be borrowed, what is the new prefix length, and what are the four network addresses?

A. Borrow 2 bits (2^2 = 4 subnets), new prefix = /26, block size = 64; the four networks are 192.168.20.0/26, 192.168.20.64/26, 192.168.20.128/26, 192.168.20.192/26 B. Borrow 4 bits (2^4 = 16 subnets), new prefix = /28; 4 subnets would only require 1 borrowed bit C. Borrow 2 bits, new prefix = /25; /24 + 2 borrowed bits = /25 is not correct arithmetic — /24 + 2 = /26 D. Borrow 1 bit (2^1 = 2 subnets); to get 4 subnets only 1 bit is needed

Correct answer is A. To create exactly 4 subnets: 2^n = 4 → n = 2 borrowed bits. New prefix = /24 + 2 = /26. The subnet mask for /26 is 255.255.255.192. Block size = 256 − 192 = 64. Starting at 0 and incrementing by 64: the four subnets are: Subnet 1: 192.168.20.0/26 — hosts .1–.62, broadcast .63; Subnet 2: 192.168.20.64/26 — hosts .65–.126, broadcast .127; Subnet 3: 192.168.20.128/26 — hosts .129–.190, broadcast .191; Subnet 4: 192.168.20.192/26 — hosts .193–.254, broadcast .255. Each subnet provides 62 usable host addresses (2^6 − 2 = 62). Total: 4 subnets × 64 addresses = 256 addresses = entire /24 ✓