1.5 IPv4 Addressing and Subnetting
Key Takeaways
- An IPv4 address is 32 bits split into network and host portions by the subnet mask.
- Usable hosts per subnet = 2^h - 2, subtracting the network and broadcast addresses.
- Number of subnets created by borrowing b bits = 2^b; the block size is 256 minus the interesting octet value.
- RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
- VLSM applies different mask lengths within one network to size each subnet to its host count and save addresses.
Why subnetting wins exams
Subnetting appears in every CCNA domain and you must do it fast and in your head because there is no calculator. Master the block-size method below and you save minutes.
IPv4 structure
An IPv4 address is a 32-bit number written as four 8-bit octets in dotted decimal (e.g., 192.168.1.100). The subnet mask marks which bits are network (1s) and which are host (0s). In CIDR, /24 means 24 network bits and 8 host bits.
The two key formulas
- Usable hosts per subnet = 2^h - 2, where h is the number of host bits. You subtract two because the all-zeros host = network address and the all-ones host = broadcast address, neither is assignable.
- Number of subnets = 2^b, where b is the bits borrowed from the host portion.
| CIDR | Mask | Host bits | Usable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 8 | 254 |
| /25 | 255.255.255.128 | 7 | 126 |
| /26 | 255.255.255.192 | 6 | 62 |
| /27 | 255.255.255.224 | 5 | 30 |
| /28 | 255.255.255.240 | 4 | 14 |
| /30 | 255.255.255.252 | 2 | 2 |
The block-size shortcut
Block size = 256 - the mask value in the interesting octet. For /27 the mask is 224, so block size = 256 - 224 = 32. Subnets in that octet therefore start at 0, 32, 64, 96, 128, 160, 192, 224. The network address is the start of a block, the broadcast is one below the next block, and usable hosts are everything in between.
Worked example: 172.20.5.100 /22
- /22 mask = 255.255.252.0, the interesting octet is the third.
- Block size = 256 - 252 = 4, so third-octet networks step 0, 4, 8 ...
- 5 falls in the 4-8 block, so the network address is 172.20.4.0.
- Broadcast = 172.20.7.255; usable range = 172.20.4.1 to 172.20.7.254 (2^10 - 2 = 1022 hosts).
RFC 1918 private addresses
| Range | CIDR | Class |
|---|---|---|
| 10.0.0.0 - 10.255.255.255 | 10.0.0.0/8 | A |
| 172.16.0.0 - 172.31.255.255 | 172.16.0.0/12 | B |
| 192.168.0.0 - 192.168.255.255 | 192.168.0.0/16 | C |
Private addresses are not routable on the Internet and must be translated with NAT. Also know 169.254.0.0/16 (APIPA/link-local) and 127.0.0.0/8 (loopback).
VLSM
Variable Length Subnet Masking lets you use different mask lengths inside one network so each subnet is sized to its host count. A point-to-point WAN link needs only 2 hosts, so a /30 wastes nothing, while a 100-user LAN needs a /25. Always allocate largest subnets first to avoid overlap.
Legacy classful ranges (still tested)
Before CIDR, addresses were classful by their first octet, and the exam still references the classes:
| Class | First octet | Default mask | Purpose |
|---|---|---|---|
| A | 1-126 | /8 | Very large networks |
| B | 128-191 | /16 | Medium networks |
| C | 192-223 | /24 | Small networks |
| D | 224-239 | n/a | Multicast |
| E | 240-255 | n/a | Experimental |
Note that 127 is reserved for loopback, which is why Class A stops at 126. Modern networks ignore class boundaries and use classless CIDR, but you must still recognize the ranges.
A full VLSM worked example
Given 192.168.10.0/24, design subnets for a 100-host LAN, a 50-host LAN, and two point-to-point WAN links:
- 100 hosts needs 2^7 - 2 = 126 usable, so a /25: 192.168.10.0/25 (hosts .1-.126).
- 50 hosts needs 2^6 - 2 = 62 usable, so a /26 from the next free block: 192.168.10.128/26 (.129-.190).
- Two WAN links need 2 hosts each, so /30 blocks: 192.168.10.192/30 and 192.168.10.196/30.
Always allocate the largest subnet first; allocating small ones first fragments the space and causes overlap. This largest-first discipline is the most common VLSM exam pitfall.
NAT and why private addressing exists
Because RFC 1918 addresses are not Internet-routable, a router running Network Address Translation (NAT) maps many inside private hosts to one or a few public addresses (PAT/overload uses port numbers to share a single public IP among thousands of sessions). This conserved the dwindling IPv4 space and is why your home and office both use 192.168.x.x without conflict.
Common traps
- A /31 is a special point-to-point case (RFC 3021) with 2 usable addresses and no broadcast, but standard CCNA math still says 2^h - 2.
- The host portion all-zeros is the network, all-ones is the broadcast, never assign them.
- Watch the interesting octet, /22 changes the third octet, not the fourth.
- 127.x.x.x is loopback, not a usable Class A network, which is why Class A ends at 126.
The fast subnetting workflow
Under time pressure, follow this repeatable process for any subnetting question:
- Find the interesting octet (where the mask transitions from 255 to a non-255 value).
- Compute block size = 256 - that octet's mask value.
- Count up by the block size to find which block the host falls into; the block start is the network address.
- The broadcast is one less than the next block start; usable hosts lie between.
- Confirm host count with 2^h - 2.
Practice until step 1-4 takes seconds. A /28 has mask 240, block size 16, so networks step 0, 16, 32, 48...; a host at .50 sits in the .48 block (broadcast .63, hosts .49-.62, 14 usable).
Determining how many bits to borrow
Given a requirement, work backwards. "Need at least 6 subnets" -> 2^b >= 6 means b = 3 borrowed bits. "Need at least 60 hosts per subnet" -> 2^h - 2 >= 60 means h = 6 host bits, leaving a /26 in a Class C. Always pick the smallest mask that satisfies the requirement so you waste the least address space and preserve room to grow. This trade between subnet count and host count is the heart of subnet design and appears repeatedly across the exam.
How many usable host addresses are available in a /27 subnet?
A host is configured with 172.20.5.100/22. What is its network address?
Which of the following is a private IPv4 range defined by RFC 1918?