CCNA guide

Subnetting Step by Step (IPv4, CIDR and VLSM Explained)

Subnetting scares almost everyone at first, and then it turns into a mental-math game. You don't need advanced math: just a little binary, one rule (the magic number) and practice.

In this guide you start from zero and finish able to solve any CCNA subnetting question: the network address, the broadcast address, the first and last host, how many hosts fit, how to split a network into N subnets and how to build a VLSM plan. Every example is fully worked out, and at the end you get 5 practice questions with answers.

What subnetting is and why it matters

An IPv4 address is 32 bits long, written as four numbers (octets) from 0 to 255, for example 192.168.10.77. Some of those bits say which network the device is on (the network part), and the rest say which device it is within that network (the host part).

Subnetting means taking one network and splitting it into smaller networks called subnets. Why would you do that?

• Organization: each department, floor or VLAN gets its own subnet.
• Less broadcast traffic: a broadcast stays inside its own subnet (VLAN) instead of flooding the whole network.
• Security: traffic between subnets passes through a router or firewall, where you can apply rules (ACLs).
• No wasted addresses: you don't hand 254 addresses to a router-to-router link that needs 2.

Binary refresher (just what you need)

Each octet has 8 bits. Each bit position has a fixed value:

Position:  bit7  bit6  bit5  bit4  bit3  bit2  bit1  bit0
Value:      128    64    32    16     8     4     2     1

A decimal number is the sum of the positions set to 1. For example:

77  = 64 + 8 + 4 + 1          = 01001101
192 = 128 + 64                = 11000000
240 = 128 + 64 + 32 + 16      = 11110000

For subnetting, it pays to memorize the values a mask octet can take. These are the only possible values, because the 1 bits always fill in from left to right:

If you can recognize the sequence 128, 192, 224, 240, 248, 252, 254, 255 instantly, you're already halfway there. To drill decimal-to-binary conversions, use the binary converter.

Network bits, host bits and the subnet mask

The subnet mask tells you which bits of the address belong to the network. The rule is simple: network bits are 1 in the mask, host bits are 0. The 1 bits are always contiguous, on the left.

Address: 192.168.10.77    11000000.10101000.00001010.01|001101
Mask:    255.255.255.192  11111111.11111111.11111111.11|000000
                          <------ 26 network bits ---->|6 host

Dotted-decimal mask vs. prefix length (CIDR notation)

The same mask can be written two ways:

• dotted decimal: 255.255.255.192
• prefix (CIDR): /26, meaning "the first 26 bits are network bits"

To go from prefix to mask: every 8 bits make a 255, and you read the remainder from the table above. /26 = 8 + 8 + 8 + 2 → 255.255.255.192. /20 = 8 + 8 + 4 → 255.255.240.0.

The other way around, just count the 1 bits. 255.255.252.0 = 8 + 8 + 6 + 0 = /22.

CIDR (Classless Inter-Domain Routing) is also the rule behind the notation: a prefix can be any length from /0 to /32. The old classes (A = /8, B = /16, C = /24) still show up as vocabulary ("a class B address"), but modern networks are no longer tied to them.

The core formulas

If you have h host bits (h = 32 − prefix):

• number of addresses in the subnet = 2^h
• number of usable hosts = 2^h − 2 (subtract the network and broadcast addresses)

If you borrow s bits for subnets from a larger network:

• number of subnets = 2^s

The magic number method (block size)

This is the trick that saves you from converting to binary on every question. The steps:

1. Find the interesting octet: the octet where the mask is neither 255 nor 0 (that's where the network part ends). If the mask only contains 255s and 0s (/8, /16, /24), the boundary falls exactly between octets: the 255 octets are copied from the address, and the 0 octets become 0 in the network address and 255 in the broadcast (equivalently, a block of 256 in the first 0 octet). With /32 there's nothing to calculate: it's a single host.
2. Work out the block size (the magic number): 256 − mask value in the interesting octet.
3. Find where the subnet starts: the largest multiple of the block size that is ≤ the address value in the interesting octet. That's the network address (octets to the left stay the same, octets to the right become 0).
4. Broadcast address: the start of the next subnet minus 1 (in the interesting octet), with the octets to the right set to 255.
5. First host = network address + 1. Last host = broadcast − 1.

Subnets "step through in blocks": if the block size is 64, subnets start at 0, 64, 128 and 192. That's really all there is to it. Let's see the method in action.

Worked subnetting examples

Example 1: 192.168.10.77/26

Step 1. /26 → mask 255.255.255.192. The interesting octet is the fourth one (192).

Step 2. Block size = 256 − 192 = 64. Subnets start at .0, .64, .128, .192.

Step 3. 77 falls between 64 and 128, so the subnet starts at 64.

Checking it in binary (a bitwise AND of address and mask, in the interesting octet only):

77   = 01001101
192  = 11000000
AND  = 01000000 = 64

Steps 4–5. The next subnet starts at 128, so the broadcast is 127.

Example 2: 10.20.45.200/20

Here the interesting octet is no longer the last one, and this is where many people get confused. Take it slowly.

Step 1. /20 = 8 + 8 + 4 → mask 255.255.240.0. The interesting octet is the third one (240).

Step 2. Block size = 256 − 240 = 16. In the third octet, subnets start at 0, 16, 32, 48, 64…

Step 3. The address value in the third octet is 45. The largest multiple of 16 that doesn't exceed 45 is 32.

45   = 00101101
240  = 11110000
AND  = 00100000 = 32

The fourth octet is in the host part, so it becomes 0 in the network address.

Step 4. The next subnet starts at 10.20.48.0, so the broadcast is one address lower: 10.20.47.255.

Notice: when the interesting octet isn't the last one, the broadcast has 255 in the octets to the right, and the last host ends in .254. Addresses such as 10.20.40.0 or 10.20.40.255 are perfectly valid hosts in this subnet, even though they "look like" a network or broadcast address.

Example 3: 10.1.1.9/30

/30 is the classic mask for router-to-router links: exactly 2 usable addresses.

Step 1. /30 → 255.255.255.252. Interesting octet: the fourth.

Step 2. Block size = 256 − 252 = 4. Subnets: .0, .4, .8, .12…

Step 3. 9 is between 8 and 12 → the subnet starts at 8.

Example 4 (class B address): 172.18.77.10/22

172.18.x.x is in the old class B range, where the default mask was /16. Here the network has been subnetted: 6 bits were borrowed (from /16 to /22).

Step 1. /22 = 8 + 8 + 6 → 255.255.252.0. Interesting octet: the third (252).

Step 2. Block size = 256 − 252 = 4. In the third octet: 0, 4, 8… 72, 76, 80…

Step 3. 77 is between 76 and 80 → the subnet starts at 76.

77   = 01001101
252  = 11111100
AND  = 01001100 = 76

How to subnet a network

In real life (and in the exam) you usually get a requirement: "I need N subnets" or "each subnet must have at least H hosts". Both are solved with powers of 2.

Option A: you need a certain number of subnets

Requirement: you have 192.168.1.0/24 and need 6 subnets.

1. The smallest s with 2^s ≥ 6 is s = 3 (2^3 = 8 subnets).
2. New prefix: /24 + 3 = /27 → mask 255.255.255.224.
3. Block size: 256 − 224 = 32. Each subnet has 2^5 − 2 = 30 hosts.

You use 6 and keep 2 spare for later.

Option B: you need a certain number of hosts per subnet

Requirement: you have 172.16.0.0/16 and every subnet needs at least 500 hosts.

1. The smallest h with 2^h − 2 ≥ 500 is h = 9 (2^9 − 2 = 510). With h = 8 you only get 254, which is too few.
2. Prefix: 32 − 9 = /23 → mask 255.255.254.0.
3. How many subnets you get: going from /16 to /23 you borrowed 7 bits → 2^7 = 128 subnets, each with 510 hosts.
4. The block size is 256 − 254 = 2 in the third octet: 172.16.0.0/23, 172.16.2.0/23, 172.16.4.0/23 and so on.

The golden rule: more subnet bits = fewer hosts per subnet, and vice versa. It's always the same 32 bits; you're just moving the boundary.

VLSM: subnets of different sizes (full example)

With one fixed mask for every subnet you waste addresses: a link between two routers doesn't need 30 addresses. VLSM (Variable Length Subnet Masking) lets you give each subnet exactly what it needs.

Requirement: you have 192.168.50.0/24 and need to address:

• LAN A: 100 hosts
• LAN B: 50 hosts
• LAN C: 25 hosts
• LAN D: 10 hosts
• two WAN links between routers (2 hosts each)

The VLSM rule: allocate the largest subnet first, then work your way down. That way every block starts on a proper boundary and you don't end up with unusable "holes".

For each requirement, pick the smallest block that fits:

• 100 hosts → 2^7 − 2 = 126 → /25 (block 128)
• 50 → 2^6 − 2 = 62 → /26 (block 64)
• 25 → 2^5 − 2 = 30 → /27 (block 32)
• 10 → 2^4 − 2 = 14 → /28 (block 16)
• 2 → 2^2 − 2 = 2 → /30 (block 4)

Then lay them out one after another, each starting where the previous one ended:

The block 192.168.50.248/29 (.248 – .255) is left free, handy for one or two more links later.

What if you had started with the WAN links? You'd have put the /30s at .0 and .4, and LAN A (a block of 128) could no longer start at .8, only at .128. The .8 – .127 range would be fragmented and would have to be filled carefully (here B still fits at .64, C at .32 and D at .16), but in a tighter plan a large block may have nowhere left to go. Hence: largest to smallest.

Common mistakes (and how to avoid them)

1. Forgetting to subtract 2. A /27 has 32 addresses but 30 hosts. For "how many hosts" questions, you almost always need the −2.
2. Calculating the block size in the wrong octet. With /20 the block of 16 is in the third octet, not the fourth. Find the interesting octet first.
3. Rounding up for the network address. The network address is the multiple of the block size that is less than or equal to your value, not the next one up.
4. Mixing up .0 and .255 when the interesting octet isn't the last one. With /20 the last host is x.x.47.254 (not .255), but x.x.40.255 is a normal host.
5. Choosing a block that's too small. 30 hosts fit in a /27 (30), but 31 don't: you need a /26. Always check 2^h − 2 ≥ the requirement.
6. Not sorting largest to smallest in VLSM. The result is overlapping subnets or wasted addresses.
7. Confusing the mask with the wildcard mask. The wildcard (used in ACLs and OSPF) is the inverse of the mask: for 255.255.255.192 it's 0.0.0.63. It's a separate topic; you calculate it octet by octet as 255 − mask (careful: not 256 −, as with the block size).

Subnet mask cheat sheet: /24 to /30

Learn this by heart; in the exam it saves you whole minutes.

The same pattern repeats in the third octet: /16–/23 have block sizes of 256, 128, 64, 32, 16, 8, 4, 2, except that there each "step" is worth 256 addresses.

Two special cases worth knowing: /31 can be used on point-to-point links (two addresses, no network or broadcast address, per RFC 3021), and /32 identifies a single host (for example a loopback interface or a static route to one device).

Practice questions (try them without a calculator)

1. For 192.168.100.200/27: what are the network address, broadcast address, first host and last host?
2. For 172.16.99.5/21: what are the mask, network address, broadcast address and number of hosts?
3. You need a subnet with at least 300 hosts. Which prefix and mask do you choose?
4. Are 10.10.10.62/26 and 10.10.10.66/26 in the same subnet?
5. Build a VLSM plan from 192.168.20.0/24 for: a LAN with 60 hosts, one with 28, one with 12 and a link between two routers.

How to get fast at subnetting

You can understand the theory in an evening; speed only comes from repetition. A few tips that actually work:

• 10 minutes a day beats 2 hours once a week. Do 5–10 addresses daily, with mixed prefixes.
• Write the cheat sheet above from memory at the start of every study session, until you no longer need to.
• Time yourself. Target: network + broadcast + host range in under a minute.
• Vary the interesting octet. Most people only practice /24–/30 and then freeze on /19 or /22.

Frequently asked questions

Routerel is an independent app and is not affiliated with, sponsored by or endorsed by Cisco Systems, Inc. Cisco and CCNA are trademarks of Cisco Systems, Inc.