Subnetting Without a Calculator: A Method for CCNA and Network+

Guides › Study topics

Updated 1 Nov 2026 · 6 min read

On this page

1. What the prefix length tells you
2. The block size method
3. Why usable hosts is 2^h minus 2
4. Worked examples
5. The /31 and /32 exceptions
6. VLSM in brief
7. A note on IPv6
8. How this fits your exam
9. Frequently asked questions
10. Sources

By the end of this guide you will be able to take any IPv4 address with a prefix length, such as 192.168.10.77/26, and work out its subnet mask, network address, broadcast address, usable host range and host count with nothing but a pen. You will also know the two prefix lengths that break the usual rule, how to carve one block into different sized subnets, and why IPv6 subnetting mostly stops at /64.

What the prefix length tells you

An IPv4 address is 32 bits. CIDR notation, defined in RFC 4632, writes a prefix as a dotted address followed by a slash and a decimal number from 0 to 32 that says how many of the leading bits are significant. Those leading bits are the network part. The remaining bits identify hosts inside that network.

The subnet mask is the same information written as 32 bits: ones for every network bit, zeros for every host bit. RFC 4632 gives the example that 172.16.0.0/16 has the mask 255.255.0.0, because the top 16 bits are ones and the bottom 16 are zeros.

You only need to memorise one short sequence to convert any prefix to a mask. Inside a single octet, the mask value for 1 to 8 network bits is 128, 192, 224, 240, 248, 252, 254 and 255. Each value adds the next bit down (128, then plus 64, plus 32, and so on). So /20 is two full octets (16 bits) plus 4 more bits, which gives 255.255.240.0.

The block size method

The number of addresses in a prefix is 2 raised to the number of host bits, which is 32 minus the prefix length. RFC 4632 tabulates this, from 1 address for a /32 up to 4,294,967,296 for /0. The block size method turns that into something you can do in your head:

1. Find the interesting octet: the first octet, reading from the left, where the mask is not 255.
2. Subtract the mask value in that octet from 256. The result is the block size.
3. Subnets in that octet start at 0 and go up in steps of the block size.
4. The subnet containing your address starts at the highest multiple of the block size that is not greater than the address's value in that octet. That is the network address.
5. The next subnet's network address minus one is the broadcast address.

This table covers /24 to /30, where the interesting octet is the last one.

Why usable hosts is 2^h minus 2

In a normal subnet, two addresses are reserved. The address with all host bits set to 0 identifies the network itself, and the address with all host bits set to 1 is the directed broadcast for that subnet. RFC 1122 lists the directed broadcast as the network number followed by an all-ones host field and says IP addresses may not use 0 or all ones in the host field outside those special cases. RFC 3021 states the result plainly for a /30: it needs four addresses per link, two host addresses, one all-zeros network and one all-ones broadcast.

So with h host bits, usable hosts is 2^h - 2 for prefixes of /30 or shorter (the /31 and /32 cases are covered below). A /26 has 6 host bits: 2^6 is 64, minus 2 is 62.

Worked examples

Example 1: 192.168.10.77/26

The mask is 255.255.255.192, so the interesting octet is the fourth. Block size is 256 minus 192, which is 64. The subnets start at 0, 64, 128 and 192. The value 77 sits between 64 and 127, so the network address is 192.168.10.64 and the broadcast is 192.168.10.127 (one less than the next subnet at 128). Usable hosts run from 192.168.10.65 to 192.168.10.126, which is 62 addresses.

Example 2: 172.16.45.200/20

A /20 is 255.255.240.0, so the interesting octet is the third. Block size is 256 minus 240, which is 16. Subnets in the third octet start at 0, 16, 32, 48 and so on. The value 45 falls between 32 and 47. The network address is 172.16.32.0 and the broadcast is 172.16.47.255. Usable hosts run from 172.16.32.1 to 172.16.47.254. There are 12 host bits, so 2^12 minus 2 gives 4,094 usable hosts. Notice that the fourth octet of the address (200) does not matter here, because the fourth octet is entirely host bits.

Example 3: pick a prefix for 50 hosts

Work backwards. Five host bits give 2^5 minus 2, which is 30, too few. Six host bits give 62, which is enough. Six host bits means a prefix of 32 minus 6, which is /26.

The addresses in these examples come from the private ranges in RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. RFC 1918 says an enterprise can use them without any coordination with IANA or an Internet registry.

The /31 and /32 exceptions

A /31 has one host bit, so only two addresses. By the 2^h minus 2 rule it would have no usable hosts. RFC 3021 changes that for point-to-point links: with a 31-bit mask on such a link, both addresses must be interpreted as host addresses. The RFC's reasoning is that a point-to-point link can only have two endpoints and does not support the notion of broadcast, because any packet one end sends is always received by the other. So using a /31 instead of a /30 halves the addresses spent per link. For example, 10.0.0.0/31 gives one router 10.0.0.0 and the other 10.0.0.1.

A /32 has no host bits and exactly one address. RFC 4632's table labels it a "host route": a route to one single address.

VLSM in brief

Variable length subnet masking means cutting one block into subnets of different sizes rather than equal ones. RFC 1812 describes this directly: an address block can be subdivided into subblocks of different sizes so that their prefixes have different lengths. The reliable method is to allocate the largest subnet first, then the next largest from the next free address, so every subnet starts on a multiple of its own block size.

Say you have 192.168.50.0/24 and need subnets for 100 hosts, 50 hosts, 20 hosts and one router link:

That uses 228 of the 256 addresses and leaves 192.168.50.228 to 192.168.50.255 free for later. If the routers on that link support RFC 3021, a /31 would do the same job with two addresses.

A note on IPv6

IPv6 is simpler. RFC 4291, as updated by RFC 7136, requires 64-bit interface identifiers for all unicast addresses except those starting with binary 000, which fixes the subnet prefix at /64 in almost every case. RFC 7421 notes that this means no more calculating leaf subnet sizes: adding a subnet is just taking another /64. RFC 7421 names one documented exception: RFC 6164, which standardises /127 prefixes for point-to-point links between routers.

How this fits your exam

Cisco 200-301 CCNA. The current CCNA Exam v1.1 blueprint lists 1.6 "Configure and verify IPv4 addressing and subnetting", 1.7 "Describe private IPv4 addressing" and 1.8 "Configure and verify IPv6 addressing and prefix". Objective 3.3 on static routing includes 3.3.c "Host route", which for IPv4 is the /32 case above. The CCNA 200-301 study guide covers how the rest of the blueprint fits together.

CompTIA Network+ N10-009. CompTIA's objectives summary places IPv4 addressing in the Networking concepts domain (23%), naming public vs. private, APIPA, RFC1918, loopback, subnetting (VLSM, CIDR) and address classes (A, B, C, D, E). See the Network+ N10-009 guide for the other domains.

Frequently asked questions

Is the block size always 256 minus the mask?

Yes, in the interesting octet. Because each octet holds 256 values and the mask octet's zero bits are the host bits in that octet, 256 minus the mask value is the number of values each subnet spans there. For prefixes shorter than /24 the interesting octet moves left to the third, second or first octet, as in the /20 example, and every octet to its right is all host bits.

Why does a /31 not lose two addresses like a /30?

RFC 3021 covers /31 on point-to-point links only, where there are exactly two endpoints and the link does not support the notion of broadcast. On such a link both addresses are treated as host addresses, and the RFC requires the limited broadcast (255.255.255.255) for any broadcast traffic instead.

Do I subnet IPv6 the same way?

Not for ordinary LANs. RFC 7421 explains that the 64-bit interface identifier fixes the subnet prefix at /64, so you plan how many /64 subnets you need rather than how many hosts fit in each. RFC 7421 describes prefixes longer than /64 as outside the current IPv6 specifications, apart from the RFC 6164 /127 case for router links.

Sources

• RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan
• RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links
• RFC 1918: Address Allocation for Private Internets
• RFC 7421: Analysis of the 64-bit Boundary in IPv6 Addressing
• CCNA Exam v1.1 (200-301)
• CompTIA Network+

Test yourself on subnetting with the free CCNA 200-301 practice questions, then read the full CCNA exam guide.