Beginner · Subnetting practice and IPv6 · topic 18 of 57 · 35 min
Subnetting drills for exam speed
Explanation
Why speed matters
In the CCNA exam, many questions hide a subnetting step inside them: "which host can ping this server?", "which route will the router use?". If each one takes you five minutes, you run out of time. At work, you will subnet while someone waits on a call. The aim is a correct answer in under a minute, without a calculator.
The cheat table
Write this table from memory on a blank sheet at the start of every practice session (and on the whiteboard you get in an exam centre, if allowed). After a week you will not need it.
| Prefix | Mask | Interesting octet | Block size | Usable hosts |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 2nd | 1 | 65,534 |
| /17 | 255.255.128.0 | 3rd | 128 | 32,766 |
| /18 | 255.255.192.0 | 3rd | 64 | 16,382 |
| /19 | 255.255.224.0 | 3rd | 32 | 8,190 |
| /20 | 255.255.240.0 | 3rd | 16 | 4,094 |
| /21 | 255.255.248.0 | 3rd | 8 | 2,046 |
| /22 | 255.255.252.0 | 3rd | 4 | 1,022 |
| /23 | 255.255.254.0 | 3rd | 2 | 510 |
| /24 | 255.255.255.0 | 3rd | 1 | 254 |
| /25 | 255.255.255.128 | 4th | 128 | 126 |
| /26 | 255.255.255.192 | 4th | 64 | 62 |
| /27 | 255.255.255.224 | 4th | 32 | 30 |
| /28 | 255.255.255.240 | 4th | 16 | 14 |
| /29 | 255.255.255.248 | 4th | 8 | 6 |
| /30 | 255.255.255.252 | 4th | 4 | 2 |
The six-step routine
- Write the mask for the prefix.
- Find the interesting octet (not 255, not 0).
- Block size = 256 minus that mask octet.
- Network: the largest multiple of the block size that is not more than the address octet. Octets to the right are 0.
- Broadcast: next multiple minus 1. Octets to the right are 255.
- First host = network + 1, last host = broadcast − 1, hosts from the table.
Ten worked drills
- 192.168.5.130/26: block 64, 130 is in 128 to 191. Network .128, broadcast .191, hosts .129 to .190, 62 hosts.
- 10.10.10.10/29: block 8, 10 is in 8 to 15. Network 10.10.10.8, broadcast .15, hosts .9 to .14, 6 hosts.
- 172.16.100.50/22: block 4 in the third octet, 100 is in 100 to 103. Network 172.16.100.0, broadcast 172.16.103.255, hosts 172.16.100.1 to 172.16.103.254, 1,022 hosts.
- 192.168.20.250/28: block 16, 250 is in 240 to 255. Network .240, broadcast .255, hosts .241 to .254, 14 hosts.
- 10.200.37.5/12: mask 255.240.0.0, block 16 in the second octet, 200 is in 192 to 207. Network 10.192.0.0, broadcast 10.207.255.255, 1,048,574 hosts.
- 172.31.200.1/19: block 32 in the third octet, 200 is in 192 to 223. Network 172.31.192.0, broadcast 172.31.223.255, 8,190 hosts.
- 192.168.100.63/27: block 32, 63 is in 32 to 63. Network .32, broadcast .63. Trap: 192.168.100.63 is the broadcast address, so it cannot be given to a host.
- How many /28 subnets fit in a /24, and how many hosts each? 4 borrowed bits: 16 subnets of 14 hosts.
- Smallest subnet for 500 hosts? /23, with 510 usable. A /24 (254) is too small.
- Is 10.1.0.255/23 a usable host? The /23 block of 2 in the third octet is 0 to 1, so the subnet is 10.1.0.0 to 10.1.1.255. 10.1.0.255 is in the middle: yes, usable.
Route summarisation
Summarisation (also called supernetting or route aggregation) is the reverse of subnetting. A router that knows 172.16.0.0/24, 172.16.1.0/24, 172.16.2.0/24 and 172.16.3.0/24 can tell its neighbours about one route instead of four. Smaller routing tables mean less memory, faster lookups, and fewer updates when one small link goes up and down.
Method: write the octet that changes in binary, and count how many bits from the left are the same in all the networks. Third octets 0, 1, 2 and 3 are 00000000, 00000001, 00000010 and 00000011. The first 6 bits match. 16 bits from the first two octets plus 6 gives /22. The summary is 172.16.0.0/22.
Second example: 192.168.8.0/24 to 192.168.15.0/24. 8 is 00001000 and 15 is 00001111: the first 5 bits match, so the summary is 192.168.8.0/21.
import ipaddress
nets = [ipaddress.ip_network(f"172.16.{i}.0/24") for i in range(4)]
print(list(ipaddress.collapse_addresses(nets))) # [IPv4Network('172.16.0.0/22')]Common mistakes
- Doing the drill steps in a different order each time. Use the same routine until it is automatic.
- Missing the broadcast trap: always check whether the "host" in the question is actually the network or broadcast address.
- Summarising 10.1.3.0/24 and 10.1.4.0/24 as a /23. 3 is 00000011 and 4 is 00000100: only the first 5 bits match, so the smallest summary is 10.1.0.0/21.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Subnetting drills for exam speed · 1/7
Subnetting only gets fast with practice. In this lesson you get a cheat table, a fixed routine and ten drills.
Prefer a video by a teacher? Find free videos on “subnetting practice questions fast method ccna” on YouTube ↗
In real life: Shrinking routing tables at an ISP in Kerala
A regional ISP gives each of its 16 town offices one /24 from 100.70.0.0/20 for internal management (from 100.64.0.0/10, the shared address space set aside for internal use by ISPs). The core routers used to carry 16 separate routes for these offices. An engineer summarises them as one route, 100.70.0.0/20, on the edge of the region. The core routing table shrinks, and when one town's link flaps at night, the core routers no longer recalculate anything.
import ipaddress
offices = [ipaddress.ip_network(f"100.70.{i}.0/24") for i in range(16)]
print(list(ipaddress.collapse_addresses(offices)))Practice (0/4 done)
Write which_subnet(ip, prefix) that returns the subnet (network with prefix, as a string) that the host belongs to. Example: which_subnet("192.168.5.130", 26) returns "192.168.5.128/26".
Write summarise(networks) that takes a list of network strings and returns the shortest equivalent list (as strings) using ipaddress.collapse_addresses.
collapse_addresses never covers addresses you did not list. A summary route does: it is the ONE smallest network that covers every network in the list. Write summary_route(networks): find the lowest network address and the highest broadcast address as integers, then shorten the prefix from 32 until both share the same leading bits. Return it as a string. Example: ["10.1.4.0/24", "10.1.6.0/24"] gives "10.1.4.0/22".
Make your own cheat table in JavaScript. cheatRow(prefix) returns an object { mask, block, hosts } for a prefix from 16 to 30. mask is the dotted decimal mask, block is 256 minus the last mask octet that is not 0 (for /24 that is 255, so the block is 1), and hosts is 2 ** (32 - prefix) - 2. Keep the keys in that order.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- IPv6 addresses: format and shortening rulesSubnetting practice and IPv6 · same module
- Subnet masks, prefix length and wildcard masksIPv4 addressing
- Validating addresses and checking the same subnetIPv4 addressing
- VPC basics: CIDR, subnets and gatewaysCloud Computing (AWS, Azure, Google Cloud) · Networking and databases: VPC and RDS
- How a router forwards: the routing tableRouting: static routes and OSPF
- Network basics: IP addresses, routes, DNS and the ip commandLinux and Red Hat (RHCSA to RHCE) · Software and networking
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Drill: what is the network address of 172.16.77.9/21?
Answer: 172.16.72.0
/21 has a block of 8 in the third octet. 77 is in 72 to 79, so the network is 172.16.72.0.
Drill: which address is a usable host in 10.5.5.64/27?
Answer: 10.5.5.80
The subnet runs from .64 (network) to .95 (broadcast). .80 is in between. .96 is in the next subnet.
Drill: what is the broadcast address of 192.168.33.33/19?
Answer: 192.168.63.255
/19 has a block of 32 in the third octet. 33 is in 32 to 63, so the broadcast is 192.168.63.255.
Which single route best summarises 10.10.16.0/24 to 10.10.31.0/24?
Answer: 10.10.16.0/20
16 is 00010000 and 31 is 00011111: the first 4 bits match. 16 + 4 = /20, network 10.10.16.0.
Drill: how many usable hosts does 172.20.0.0/18 have?
Answer: 16,382
32 − 18 = 14 host bits. 2^14 − 2 = 16,382.
Drill: a router has 192.168.0.0/24, 192.168.1.0/24 and 192.168.2.0/24 and announces 192.168.0.0/22. What is the risk?
Answer: The summary also covers 192.168.3.0/24, which the router does not have
A /22 covers four /24s, 0 to 3. Traffic for 192.168.3.0/24 will be drawn to this router too.
Is 192.168.0.255/23 a usable host address?Related
Answer: Yes, the subnet runs from 192.168.0.0 to 192.168.1.255
In a /23 the broadcast is 192.168.1.255. 192.168.0.255 is in the middle of the range, so it is a normal host.
Each subnet must hold 25 hosts. Which prefix wastes the fewest addresses?Related
Answer: /27
/27 gives 30 usable hosts. /28 gives only 14, and /26 wastes more.
Where does Cisco IOS expect a wildcard mask instead of a subnet mask?Related
Answer: In access-list statements and the OSPF network command
Interfaces take subnet masks. ACLs and OSPF network statements take wildcard masks.
Which prefix should a link between two routers get in a classic CCNA VLSM plan?Related
Answer: /30
A /30 has exactly 2 usable addresses, one for each router. (/31 is also possible under RFC 3021.)
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 2 more topics in “Subnetting practice and IPv6” before its exam: IPv6 addresses: format and shortening rules, IPv6 address types, EUI-64, SLAAC and NDP.
- Module 4 exam: Subnetting practice and IPv6 · 13 questions · 25 min, without help. 5 topics of this module still to finish first.
- Then the next module, Switching and VLANs. 57 topics left in the course before the final exam.