Network, broadcast and usable host range

The four answers every subnet question wants

Given an address and a mask, you usually need four things. The network address is the first address of the subnet, with all host bits set to 0; it names the subnet and is not given to a device. The broadcast address is the last address, with all host bits set to 1; a packet sent to it reaches every device in the subnet. The first usable host is the network address plus 1. The last usable host is the broadcast address minus 1. Routers usually take the first or the last usable address as the default gateway.

If there are h host bits, the subnet has 2^h addresses in total. Two of them (network and broadcast) cannot be given to devices, so there are 2^h − 2 usable hosts. A /24 has 8 host bits: 256 addresses, 254 usable.

The block size method (magic number)

Converting everything to binary works, but it is slow. The block size method is what exam takers use.

1. Write the mask in dotted decimal.
2. Find the interesting octet: the one where the mask is not 255 and not 0.
3. Block size = 256 minus the mask value in that octet. Subnets start at every multiple of the block size: 0, block, 2 × block, and so on.
4. Network address: the largest multiple of the block size that is less than or equal to the address in the interesting octet. Octets to the right become 0.
5. Broadcast: next multiple minus 1 in the interesting octet. Octets to the right become 255.
6. First host = network + 1, last host = broadcast − 1, hosts = 2^h − 2.

Worked example 1: 192.168.10.77/27

Mask 255.255.255.224. The interesting octet is the fourth (224). Block size 256 − 224 = 32. Multiples: 0, 32, 64, 96. 77 falls between 64 and 95. Network 192.168.10.64, broadcast 192.168.10.95, first host 192.168.10.65, last host 192.168.10.94. Host bits 32 − 27 = 5, so 2^5 − 2 = 30 usable hosts.

Worked example 2: 172.16.45.200/20

Mask 255.255.240.0. The interesting octet is the third (240). Block size 16. Multiples: 0, 16, 32, 48. 45 falls between 32 and 47. Network 172.16.32.0 (the octet to the right becomes 0). Broadcast 172.16.47.255 (third octet 48 − 1 = 47, and the fourth becomes 255). First host 172.16.32.1, last host 172.16.47.254. Host bits 12, so 2^12 − 2 = 4,094 hosts.

Worked example 3: 10.1.2.3/9

Mask 255.128.0.0. The interesting octet is the second (128). Block size 128. Multiples: 0 and 128. 1 falls in 0 to 127. Network 10.0.0.0, broadcast 10.127.255.255, first host 10.0.0.1, last host 10.127.255.254. Host bits 23, so 2^23 − 2 = 8,388,606 hosts.

Special cases: /31 and /32

A /31 has only two addresses. RFC 3021 allows both to be used on a point-to-point link between two routers, with no network or broadcast address, which saves addresses. A /32 is a single address: it is used for loopback interfaces on routers and for host routes. The 2^h − 2 formula applies to /30 and shorter prefixes.

Doing it with bits in Python

import ipaddress

iface = ipaddress.ip_interface("172.16.45.200/20")
net = iface.network
print(net)                        # 172.16.32.0/20
print(net.broadcast_address)      # 172.16.47.255
print(net.num_addresses - 2)      # 4094
hosts = list(net.hosts())
print(hosts[0], hosts[-1])        # 172.16.32.1 172.16.47.254

Under the hood it is just the AND from the last topic. Turn the address into one 32-bit number, AND it with the mask to get the network, and OR it with the inverted mask (the wildcard) to set all host bits to 1 for the broadcast.

Common mistakes

• Using the block size in the wrong octet. For /20 the block of 16 is in the third octet, not the fourth.
• Forgetting to set the octets to the right: they are 0 in the network address and 255 in the broadcast.
• Forgetting the minus 2. A /27 has 32 addresses but only 30 usable hosts.