# How do you calculate the prefix, network, subnet, and host numbers?

Example:

IP: 128.42.5.4

In binary: 10000000 00101010 00000101 00000100

Subnet: 255.255.248.0

How could you determine the prefix, network, subnet, and host numbers?

## Calculating the Netmask Length (also called a prefix):

Convert the dotted-decimal representation of the netmask to binary. Then, count the number of contiguous 1 bits, starting at the most significant bit in the first octet (i.e. the left-hand-side of the binary number).

``````255.255.248.0   in binary: 11111111 11111111 11111000 00000000
-----------------------------------
I counted twenty-one 1s             -------> /21
``````

The prefix of 128.42.5.4 with a 255.255.248.0 netmask is /21.

The network address is the logical AND of the respective bits in the binary representation of the IP address and network mask. Align the bits in both addresses, and perform a logical AND on each pair of the respective bits. Then convert the individual octets of the result back to decimal.

Logical AND truth table: ``````128.42.5.4      in binary: 10000000 00101010 00000101 00000100
255.255.248.0   in binary: 11111111 11111111 11111000 00000000
----------------------------------- [Logical AND]
10000000 00101010 00000000 00000000 ------> 128.42.0.0
``````

As you can see, the network address of 128.42.5.4/21 is 128.42.0.0

Remember that our IP address in decimal is:

``````128.42.5.4      in binary: 10000000 00101010 00000101 00000100
``````

``````255.255.248.0   in binary: 11111111 11111111 11111000 00000000
``````

This means our host bits are the last 11 bits of the IP address, because we find the host mask by inverting the network mask:

``````Host bit mask            : 00000000 00000000 00000hhh hhhhhhhh
``````

To calculate the broadcast address, we force all host bits to be 1s:

``````128.42.5.4      in binary: 10000000 00101010 00000101 00000100
Host bit mask            : 00000000 00000000 00000hhh hhhhhhhh
----------------------------------- [Force host bits]
10000000 00101010 00000111 11111111 ----> 128.42.7.255
``````

## Calculating subnets:

You haven't given enough information to calculate subnets for this network; as a general rule you build subnets by reallocating some of the host bits as network bits for each subnet. Many times there isn't one right way to subnet a block... depending on your constraints, there could be several valid ways to subnet a block of addresses.

Let's assume we will break 128.42.0.0/21 into 4 subnets that must hold at least 100 hosts each... In this example, we know that you need at least a /25 prefix to contain 100 hosts; I chose a /24 because it falls on an octet boundary. Notice that the network address for each subnet borrows host bits from the parent network block.

How did I know that I need at least a /25 masklength for 100 hosts? Calculate the prefix by backing into the number of host bits required to contain 100 hosts. One needs 7 host bits to contain 100 hosts. Officially this is calculated with:

Host bits = Log2(Number-of-hosts) = Log2(100) = 6.643

Since IPv4 addresses are 32 bits wide, and we are using the host bits (i.e. least significant bits), simply subtract 7 from 32 to calculate the minimum subnet prefix for each subnet... 32 - 7 = 25.

### The lazy way to break 128.42.0.0/21 into four equal subnets:

Since we only want four subnets from the whole 128.42.0.0/21 block, we could use /23 subnets. I chose /23 because we need 4 subnets... i.e. an extra two bits added to the netmask.

This is an equally-valid answer to the constraint, using /23 subnets of 128.42.0.0/21... ## Calculating the host number:

This is what we've already done above... just reuse the host mask from the work we did when we calculated the broadcast address of 128.42.5.4/21... This time I'll use 1s instead of `h`, because we need to perform a logical AND on the network address again.

``````128.42.5.4      in binary: 10000000 00101010 00000101 00000100
Host bit mask            : 00000000 00000000 00000111 11111111
----------------------------------- [Logical AND]
00000000 00000000 00000101 00000100 -----> 0.0.5.4
``````

## Calculating the maximum possible number of hosts in a subnet:

To find the maximum number of hosts, look at the number of binary bits in the host number above. The easiest way to do this is to subtract the netmask length from 32 (number of bits in an IPv4 address). This gives you the number of host bits in the address. At that point...

Maximum Number of hosts = 2**(32 - netmask_length) - 2

The reason we subtract 2 above is because the all-ones and all-zeros host numbers are reserved. The all-zeros host number is the network number; the all-ones host number is the broadcast address.

Using the example subnet of 128.42.0.0/21 above, the number of hosts is...

Maximum Number of hosts = 2**(32 - 21) - 2 = 2048 - 2 = 2046

Suppose someone gives us two IP addresses and expects us to find the longest netmask which contains both of them; for example, what if we had:

• 128.42.5.17
• 128.42.5.67

The easiest thing to do is to convert both to binary and look for the longest string of network-bits from the left-hand side of the address.

``````128.42.5.17     in binary: 10000000 00101010 00000101 00010001
128.42.5.67     in binary: 10000000 00101010 00000101 01000011
^                           ^     ^
|                           |     |
+--------- Network ---------+Host-+
(All bits are the same)    Bits
``````

NOTE: If you try starting from the right-hand side, don't get tricked just because you find one matching column of bits; there could be unmatched bits beyond those matching bits. Honestly, the safest thing to do is to start from the left-hand side.

The answer above hits the nail on the head perfectly. However, when I first started out, it took me a few different examples from a couple of sources for it to really hit home. Therefore, if you're interested in other examples, I wrote a few blog posts on the subject - http://www.oznetnerd.com/category/subnetting/

Admins, if this post is considered spam, please feel free to delete it.

Edit: As per YLearn's suggestion, I'll try to grab the relevant parts from Part 1 of my series, without pasting the whole entry here.

Let's use 195.70.16.159/30 as an example.

As it is a /30, we know the host portion is going to be in the fourth octet. Let's convert that to binary:

``````128 64 32 16  8  4 2 1
SN  SN SN SN SN SN H H
1   0  0  1  1  1 1 1
``````

Now to find out the network address all we do is add the SN bits that have a 1 underneath them, together. (128 + 16 + 8 + 4 = 156).

When you add this 156 to the first three octets of the address, we’re left with the Network Address 195.70.16.156.

Now, as we know that the first usable address is always the Network Address plus one, all we need to do is perform the following calculation: (156 + 1 = 157).

This gives us a First Usable Address of 195.70.16.157.

Now let’s skip the Last Usable Address for a moment and find the Broadcast Address. To find out what it is, all we need to do is add all of the H bits together (regardless of whether they are a 1 or a 0) and then add this number to the Network Address. (2 + 1 + 156 = 159).

And finally, let’s work out the last usable address. This process is similar to finding the First Usable Address, however, instead of adding one to the network address, we actually subtract one from the Broadcast Address. (159 – 1 = 158).

This gives us a Last Usable Address of 195.70.16.158.

And there we have it! Our temaplte is complete. For easy reference, here it is again:

As a shortcut, you can also use this formula. It works on subnets of any size:

• Tiny (almost insignificant) caveat: the Last Usable Address formula at the bottom works for all subnets except a /31... see RFC 3021. It's a small but relevant exception if someone tried to use your algorithm in code.
– This
Jun 4 '15 at 7:34

I do not want to take anything away from Mike Pennington's excellent answer, which I have relentlessly promoted, but I keep seeing questions that are not directly addressed by his answer, and I have created something that was originally based on Mike's answer, but I have more information to address questions that have popped up over time. Unfortunately, it is too large, and I had to break it into two answers.

# Part 1 of 2

## IPv4 Math

I cannot stress enough that you must do IPv4 math in binary. I think every network engineer (or would-be network engineer) has tried to figure out a way to do it all in decimal, as I’m sure you will*. The problem is that 10 (decimal) is not a power of 2 (binary), so decimal and binary do not naturally convert between each other the way that hexadecimal (base 16) naturally converts to and from binary because 16 is a power of 2.

It seems that using dotted-decimal notation for IPv4 was an early mistake that cannot now be corrected, but IPv6 adopted the use of hexadecimal from the very beginning, and it is easy to convert between hexadecimal and binary.

If you do not have an IP calculator (probably not allowed in network education class exams or certification tests), it is useful to make a chart of the values of the bits in an octet. Because this is binary, each bit value is 2 times the same digit value in the next less-significant digit. Each digit is the number base times the same digit value in the next less-significant digit. This is also true for any other number base, including decimal (base 10), where each digit value is 10 times the value of the same digit value in the next less-significant number position. For binary digits (bits):

``````---------------------------------------------------------
| Bit # |   7 |   6 |   5 |   4 |   3 |   2 |   1 |   0 |
---------------------------------------------------------
| Value | 128 |  64 |  32 |  16 |   8 |   4 |   2 |   1 |
---------------------------------------------------------
``````

Where decimal is all about the powers of 10, binary is all about the powers of 2. Notice that for each bit number in the table above, the corresponding value is 2 to the power of the bit number.

``````For our example IPv4 dotted-decimal address of 198.51.100.223:
1st octet: 198 = 128 + 64 +  0 +  0 + 0 + 4 + 2 + 0 = 11000110
2nd octet:  51 =   0 +  0 + 32 + 16 + 0 + 0 + 2 + 1 = 00110011
3rd octet: 100 =   0 + 64 + 32 +  0 + 0 + 4 + 0 + 0 = 01100100
4th octet: 223 = 128 + 64 +  0 + 16 + 8 + 4 + 2 + 1 = 11011111

For our example IPv4 binary address of 11000110001100110110010011011111:
1st octet: 11000110 = 128 + 64 +  0 +  0 + 0 + 4 + 2 + 0 = 198
2nd octet: 00110011 =   0 +  0 + 32 + 16 + 0 + 0 + 2 + 1 =  51
3rd octet: 01100100 =   0 + 64 + 32 + 0 + 0 + 4 + 0 + 0= 100
4th octet: 11011111 = 128 + 64 +  0 + 16 + 8 + 4 + 2 + 1 = 223
``````

You will also need to remember your Truth Tables from school (in binary math, 0 is False, and 1 is True):

``````-----------------------------------------
| False AND False = False | 0 AND 0 = 0 |
-----------------------------------------
| False AND True  = False | 0 AND 1 = 0 |
-----------------------------------------
| True  AND False = False | 1 AND 0 = 0 |
-----------------------------------------
| True  AND True  = True  | 1 AND 1 = 1 |
-----------------------------------------

-----------------------------------------
| False OR False = False  | 0 OR 0 = 0  |
-----------------------------------------
| False OR True  = True   | 0 OR 1 = 1  |
-----------------------------------------
| True  OR False = True   | 1 OR 0 = 1  |
-----------------------------------------
| True  OR True  = True   | 1 OR 1 = 1  |
-----------------------------------------
``````

*If you perform IPv4 math for many years, you may get to the point where you can perform binary/decimal conversions in your head, and you can then appear to be able to do IPv4 math in decimal. Even though I can do this in my head, I will always double-check with an IP calculator, or convert to binary, perform the math, and convert back to decimal, before committing a change to a production network.

The IPv4 dotted-decimal notation, e.g. `198.51.100.223`, is simply to make it easier for humans to read an IPv4 address. The four separate sections, called octets, really have no meaning to IPv4. Do not make the common mistake of thinking the octets have a special meaning. An IPv4 address is really a 32-bit binary number, and that is how network devices see and use an IPv4 address.

Our example IPv4 address `198.51.100.223` is actually `11000110001100110110010011011111` to a device on the network, so you can see that the dotted-decimal representation really does make it easier for humans. Each octet is eight bits of the 32-bit address (hence the commonly used term, “octet”), so there are four octets (`32 address bits / 8 bits per octet = 4 octets`). Our example 32-bit binary address is separated into four octets, then each binary octet is converted to a decimal number*:

``````Binary address: 11000110001100110110010011011111
---------------------------------------------
Binary octets:  | 11000110 | 00110011 | 01100100 | 11011111 |
Decimal octets: |      198 |       51 |      100 |      223 |
---------------------------------------------
Dotted-decimal: 198.51.100.223
``````

Because each octet is eight bits in length, each octet will have a value between `0` and `255` (any values greater than `255` are invalid). The reason is that `2^8 = 256`: `2` (the binary number base) to the power of `8` (eight bits per octet) equals `256`, the number of different values that can be expressed by an eight-bit octet. Remember that the first value is `0`, so the `256`th value will be one less that the total number of values that can be expressed (`256 – 1 = 255`).

To correctly perform IPv4 math, you must do it in binary, otherwise you will make mistakes that will cause you problems and frustration. That means that you must convert the dotted decimal notation to binary before trying to manipulate it:

``````Dotted-decimal: 198.51.100.223
---------------------------------------------
Decimal octets: |      198 |       51 |      100 |      223 |
Binary octets:  | 11000110 | 00110011 | 01100100 | 11011111 |
---------------------------------------------
``````

*Leading zeroes in a dotted-decimal IPv4 address may be interpreted by some applications and programming languages as octal (base 8) rather than decimal (base 10), causing errors, and leading zeros should be avoided for the dotted-decimal IPv4 representation, but leading zeroes are necessary for the binary IPv4 address octets because they represent bit positions in the full address, and leaving out a bit position will shorten the address and change the binary value.

An IPv4 network mask is used to divide an IPv4 address into two parts: the network part, and the host part. The division can be at any bit number, so it may fall within an octet, not on an octet boundary, as many people incorrectly assume it always does. An IPv4 network mask is the same size as an IPv4 address (32 bits), and it is expressed in dotted-decimal notation the same way you would express an IPv4 address in dotted-decimal notation (four eight-bit octets, separated by a period). For example, `255.255.248.0`.

An IPv4 network mask consists of a number of consecutive `1` bits (representing the network portion of an address), followed by a number of `0` bits (representing the host portion of the address). The total number of `1` bits and the total number of `0` bits adds up to `32`, the number of bits in an IPv4 address or network mask. For our example network mask:

``````Dotted-decimal: 255.255.248.0
------------------------------------------------
Decimal octets: |      255 |      255 |         248 |        0 |
Binary octets:  | 11111111 | 11111111 | 11111 | 000 | 00000000 |
------------------------------------------------
| 21 Network bits             | 11 Host bits   |
------------------------------------------------
``````

As you can see, the division between the network and host portions of the IPv4 address using this particular mask falls within an octet, not on an octet boundary.

An IPv4 network mask is often represented by the number of consecutive `1` bits in the mask. This is variously called the network mask length or prefix length, and it is represented as a `/` followed by the number of consecutive `1` bits in the network mask. For our example, counting the number of consecutive `1` bits gets `21`, which can be represented as `/21`.

Given a mask length, you can calculate the dotted-decimal representation of the mask. Simply put down the number of `1` bits for the mask length and add enough `0` bits on the end to total `32` bits. Convert the resulting binary number into the dotted-decimal representation:

``````Mask length:    /21
------------------------------------------------
| 21 Network bits             | 11 Host bits   |
------------------------------------------------
Binary octets:  | 11111111 | 11111111 | 11111 | 000 | 00000000 |
Decimal octets: |      255 |      255 |         248 |        0 |
------------------------------------------------
Dotted-decimal: 255.255.248.0
``````

The example may be represented traditionally as `198.51.100.223`, with a network mask of `255.255.248.0`, or it may be represented as the more modern CIDR (Classless Inter-Domain Routing) `198.51.100.223/21`.

An IPv4 network address is an IPv4 address with all the host bits set to `0`. The IPv4 network address can be calculated by a bitwise `AND` of the respective bits in the binary representation of the IPv4 address and the IPv4 network mask. Align the bits in both addresses, and perform a bitwise `AND` on each pair of the respective bits, then convert the individual octets of the result back to decimal.

For our example IPv4 address `198.51.100.223` and network mask `255.255.248.0`:

``````Decimal address:        198.51.100.223/21
Binary address octets:  11000110 00110011 01100100 11011111
Binary mask octets:     11111111 11111111 11111000 00000000 AND
-----------------------------------
Binary network octets:  11000110 00110011 01100000 00000000
Decimal network octets:      198       51       96        0
Dotted-decimal network: 198.51.96.0
``````

As you can see, the network address of `198.51.100.223/21` is `198.51.96.0`. Notice that You cannot depend on the octets to tell you which portion of the address is the network, and which portion of the address is for the hosts.

You can use this method to determine if two addresses are on the same or different networks*. If, for example, you want see if your `198.51.100.223/21` address is on the same IPv4 network with a host assigned the `198.51.102.57` address, determine your IPv4 network address (as above). Next, determine the IPv4 network address of the host in question, using your IPv4 network mask (hosts on the same network use the same network mask, and you may not have the mask, only the address, of the destination host):

``````Decimal address:        198.51.102.57/21
Binary address octets:  11000110 00110011 01100110 00111001
Binary mask octets:     11111111 11111111 11111000 00000000 AND
-----------------------------------
Binary network octets:  11000110 00110011 01100000 00000000
Decimal network octets:      198       51       96        0
Dotted-decimal network: 198.51.96.0
``````

Compare the resulting IPv4 network address to the original IPv4 network address, and notice that the network addresses are equal, so the host addresses are on the same network.

Now, let’s see if you are on the same network as the `74.125.69.100` Google address:

``````Decimal address:        74.125.69.100/21
Binary address octets:  01001010 01111101 01000101 01100100
Binary mask octets:     11111111 11111111 11111000 00000000 AND
-----------------------------------
Binary network octets:  01001010 01111101 01000000 00000000
Decimal network octets:       74      125       64        0
Dotted-decimal network: 74.125.64.0
``````

Compare the resulting IPv4 network address to the original IPv4 network address, and notice that the network addresses are different, so the host addresses are on different networks.

*This is the method a source host uses to determine if it a destination host on the same network as the source host.

One useful, often overlooked, value that is useful in IPv4 addressing is the IPv4 host mask. An IPv4 host mask is simply the inverse of the IPv4 network mask. You can create a binary host mask from a binary network mask, or a binary network mask from a binary host mask, simply by inverting the `1`s and `0`s of the starting mask:

``````Dotted-decimal network mask: 255.255.248.0
Decimal network mask octets:      255      255      248        0
Binary network mask octets:  11111111 11111111 11111000 00000000 invert
-----------------------------------
Binary host mask octets:     00000000 00000000 00000111 11111111
Decimal host mask octets:           0        0        7      255
``````

It is possible to mathematically create a host mask from the network mask, or the network mask from the host mask by subtracting the starting mask from the longest mask (`/32`, or all-ones mask).

That can be done in binary:

``````Binary all-ones mask octets: 11111111 11111111 11111111 11111111
Binary network mask octets:  11111111 11111111 11111000 00000000 -
-----------------------------------
Binary host mask octets:     00000000 00000000 00000111 11111111
Decimal host mask octets:           0        0        7      255
``````

That can also be done in decimal (an all-ones octet is `255`), but be sure to convert it to binary before actually trying to use it for address manipulation:

``````Decimal all-ones mask octets: 255 255 255 255
Decimal network mask octets:  255 255 248   0 -
---------------
Decimal host mask octets:       0   0   7 255
``````

An IPv4 network broadcast address is the IPv4 network address with all the host bits set to `1`. There are several ways to calculate the IPv4 network broadcast address.

For our example IPv4 address `198.51.100.223` and network mask `255.255.248.0`.

You can perform a bitwise `OR` with the IPv4 address or network address with the host mask:

``````Decimal address octets:        198       51      100      223
Binary address octets:    11000110 00110011 01100100 11011111
Binary host mask octets:  00000000 00000000 00000111 11111111 OR
-----------------------------------
Binary broadcast octets:  11000110 00110011 01100111 11111111
Decimal broadcast octets:      198       51      103      255
``````

You can simply add the value of the IPv4 host mask to the value of the IPv4 network address:

``````Binary network octets:    11000110 00110011 01100000 00000000
Binary host mask octets:  00000000 00000000 00000111 11111111 +
-----------------------------------
Binary broadcast octets:  11000110 00110011 01100111 11111111
Decimal broadcast octets:      198       51      103      255
``````

This is also something you can do in decimal:

``````Decimal network octets:   198  51  96   0
Decimal host mask octets:   0   0   7 255 +
---------------
Decimal broadcast octets: 198  51 103 255
``````

## Total IPv4 Network Host Addresses

The total number of IPv4 host addresses for a network is `2` to the power of the number of host bits, which is `32` minus the number of network bits. For our example of a `/21` (network mask `255.255.248.0`) network, there are `11` host bits (`32 address bits – 21 network bits = 11 host bits`). That means there are `2048` total host addresses in a `/21` IPv4 network (`2^11 = 2048`).

## Total Usable IPv4 Network Host Addresses

Except for `/31` (network mask `255.255.255.254`) and `/32` (network mask `255.255.255.255`) networks, the number of usable host addresses on an IPv4 network is the total number of network host addresses minus `2` (because the IPv4 network and broadcast addresses are unusable for host addresses on the network, you must subtract them from the number of usable host addresses). For our example of a `/21` (`255.255.248.0`) network, there are `2046` usable host addresses (`2^11 - 2 = 2046`).

## First Usable IPv4 Network Host Address

Except for `/31` (network mask `255.255.255.254`) and `/32` (network mask `255.255.255.255`) networks, the first usable IPv4 network host address is the IPv4 network address plus `1` (the IPv4 network address is not usable for a network host address). For our example network of `198.51.96.0/21`, the first usable network host address is `198.51.96.1` (`198.51.96.0 + 1 = 198.51.96.1`). Simply set the low-order bit of the binary IPv4 network address to `1`:

``````Decimal network octets:      198       51       96        0
Binary network octets:  11000110 00110011 01100000 00000000
-----------------------------------
Binary address octets:  11000110 00110011 01100000 00000001
Decimal address octets:      198       51       96        1
``````

## Last Usable IPv4 Network Host Address

Except for `/31` (network mask `255.255.255.254`) and `/32` (network mask `255.255.255.255`) networks, the last usable IPv4 network host address is the IPv4 network broadcast address minus `1` (the IPv4 network broadcast address is not usable for a network host address). For our example network of `198.61.96.0/21`, the last usable network host address is `198.51.103.254` (`198.51.103.255 - 1 = 198.51.103.254`). Simply set the low-order bit of the binary IPv4 network broadcast address to `0`:

``````Decimal broadcast octets:      198       51      103      255
Binary broadcast octets:  11000110 00110011 01100111 11111111
-----------------------------------
Binary address octets:    11000110 00110011 01100111 11111110
Decimal address octets:        198       51      103      254
``````

## Putting IPv4 Network Addressing All Together

For our example IPv4 network address `198.51.100.223` and mask `255.255.248.0` (or `198.51.100.223/21`), we can calculate much network information:

``````Host address:                       198.51.100.223
*First usable network host address: 198.51.100.1
*Last usable network host address:  198.51.103.254
``````

*Network education class exams and certification tests will ask you to be able to quickly calculate these for an IPv4 network, given a host address and mask (or mask length). You can use the hints below for a quick check of your answers:

• Network Address (hint: an even number)
• First Usable Host Address (hint: Network Address plus 1, an odd number)

The above hints do not apply to `/31` (network mask `255.255.255.254`) or `/32` (network mask `255.255.255.255`) networks.

Given enough time on your exam, and a problem that has multiple methods to arrive at an answer, you should use the multiple methods to double-check the answer.

# Part 2 of 2

## Selecting an IPv4 Network Gateway (Router) Address

A gateway is a host on the network that knows how to forward packets to other networks, and it can be assigned any usable network host address. Some people just randomly assign gateway addresses to any usable network host address, some people always assign the first usable network host address to a gateway, and some people always assign the last usable network host address to a gateway. It doesn’t actually matter which usable host network address you assign to a gateway, but you should try to be consistent.

## IPv4 `/31` (network mask `255.255.255.254`) Networks

Originally, `/31` (network mask `255.255.255.254`) networks were unusable because there is only one host bit, giving you two total network host addresses, but the number of usable network host addresses is the total number of network host addresses minus `2` (`2 total host addresses - 2 = 0 usable host addresses`).

Point-to-point links only need two host addresses (one for each end of the link). The traditional way of assigning IPv4 networks required the use of `/30` (network mask `255.255.255.252`) networks for point-to-point links, but that wastes half the network host addresses because a `/30` network has four total network host addresses, but only two are usable network host addresses (`2^2 – 2 = 2`).

With the critical IPv4 address shortage, a standard was created to allow the use of `/31` networks for point-to-point links. That makes sense because there is no need for broadcast on such networks: any packets sent by a host on the network are destined for the only other host on the network, effectively broadcasting. On a `/31` network, the network address is the first usable host address, and the broadcast address is the last usable host address.

Unfortunately, not all vendors (Microsoft in particular) support the standard for using `/31` networks on point-to-point links, and you will most often see point-to-point links using `/30` networks.

## IPv4 `/32` (network mask `255.255.255.255`) Networks

A `/32` (network mask `255.255.255.255`) network is both a network with no host addresses, and a host address, itself. There is only one address in the network, and that is the network address. Because there are no other hosts are on the network, traffic must be routed to and from the network address.

These addresses are often used on virtual network interfaces defined inside a device that can route packets between its virtual and physical interfaces. An example of this is to create a virtual interface in a network device to be used as the source or destination for the device itself. A virtual interface cannot drop because of a physical problem, e.g. cable unplugged, and if the device has multiple paths into it, other devices can still communicate with the device using the virtual interface address when a physical interface of the device is inoperable for some reason.

## Subnetting IPv4 Networks

Subnetting a network is creating multiple, longer networks from a network address and mask. The basic idea is that you borrow high-order bits from the host portion of the original network. Assume you want to create 14 equal-sized subnets from our original `198.51.96.0/21` network. Since you are borrowing high-order bits from the host portion of the original network, you will get a number that is a power of `2`, but `14` is not a power of `2`, so you must get the next higher power of `2`, which happens to be `16` (`16 = 2^4`). The power of `2`, in this case `4`, is the number of high-order host bits necessary to borrow for the number of subnets to be created. You can also use a mathematical formula to determine the number of bits required: `Log2(X subnets) = Y borrowed bits`, rounded up to the next integer value:

``````Log2(14 subnets) = 3.807354922, rounded up = 4 borrowed bits
``````

For our example of needing 14 equal-sized subnets of the original `198.51.96.0/21` network, starting with all `0`s* for the first subnet, add `1` to the subnet portion to get the next subnet:

``````           ----------------------------------------------
Original:  | 21 network bits       | 11 host bits       |
----------------------------------------------
Network:   | 110001100011001101100 | 0000 |  0000000    | = 198.51.96.0/21
Subnet 1:  | 110001100011001101100 | 0000 |  0000000    | = 198.51.96.0/25
Subnet 2:  | 110001100011001101100 | 0001 |  0000000    | = 198.51.96.128/25
Subnet 3:  | 110001100011001101100 | 0010 |  0000000    | = 198.51.97.0/25
Subnet 4:  | 110001100011001101100 | 0011 |  0000000    | = 198.51.97.128/25
Subnet 5:  | 110001100011001101100 | 0100 |  0000000    | = 198.51.97.128/25
Subnet 6:  | 110001100011001101100 | 0101 |  0000000    | = 198.51.98.128/25
Subnet 7:  | 110001100011001101100 | 0110 |  0000000    | = 198.51.99.0/25
Subnet 8:  | 110001100011001101100 | 0111 |  0000000    | = 198.51.99.128/25
Subnet 9:  | 110001100011001101100 | 1000 |  0000000    | = 198.51.100.0/25
Subnet 10: | 110001100011001101100 | 1001 |  0000000    | = 198.51.100.128/25
Subnet 11: | 110001100011001101100 | 1010 |  0000000    | = 198.51.101.0/25
Subnet 12: | 110001100011001101100 | 1011 |  0000000    | = 198.51.101.128/25
Subnet 13: | 110001100011001101100 | 1100 |  0000000    | = 198.51.102.0/25
Subnet 14: | 110001100011001101100 | 1101 |  0000000    | = 198.51.102.128/25
----------------------------------------------
Subnetted: | 25 network bits              | 7 host bits |
----------------------------------------------

----------------------------------------------
Unused:    | 110001100011001101100 | 111  | 00000000    | = 198.51.103.0/24
----------------------------------------------
``````

*There is a persistent myth that for subnets, as for host addresses, the all-zeros and all-ones subnets cannot be used, but this myth was explicitly dispelled many years ago by a standard. Unfortunately, this myth extends to some network educations classes, and the correct answer for those (incorrect) classes would be to use the 2nd through 15th subnets.

It is possible to subnet a network into variously sized subnets (every IPv4 network is a subnet of the `0.0.0.0/0` network address), as in our example above, where the unused subnet is a `/24` subnet, but this requires careful planning so that the resulting subnets start on the correct bit.

For example, let’s say that we need both a `/26` and a `/27` subnet from our `198.51.96.0/21` network. There are two ways to do that: start with the `/26` subnet, or start with the `/27` subnet.

Starting with the `/26` subnet:

``````Original: | 110001100011001101100 | 00000000000    | /21
Subnet 1: | 110001100011001101100 | 00000 | 000000 | /26
``````

Add `1` to the subnet portion to get the starting position of the next subnet:

``````Subnet 2: | 110001100011001101100 | 00001 | 000000 | /26
``````

Then extend the second subnet to `/27`:

``````Subnet 2: | 110001100011001101100 | 000010 | 00000 | /27
``````

Notice that we are actually subnetting the second `/26` subnet into a `/27` subnet, and that works well because `27` is larger than `26`.

Starting with the `/27` subnet:

``````Original: | 110001100011001101100 | 00000000000    | /21
Subnet 1: | 110001100011001101100 | 000000 | 00000 | /27
``````

Add `1` to the subnet portion to get the starting position of the next subnet:

``````Subnet 2: | 110001100011001101100 | 000001 | 00000 | /27
``````

Notice that there are not enough bits left in the host portion (five host bits) to support a `/26` network, which requires six host bits (`32 address bits – 26 network bits = 6 host bits`). If we use this as the starting position for the `/26` subnet, we will actually overlap the previous and next `/26` networks. We need to leave a gap the size of a `/27` network for the starting position of the `/26` network:

``````Original: | 110001100011001101100 | 00000000000     | /21
Subnet 1: | 110001100011001101100 | 000000 |  00000 | /27
Unused:   | 110001100011001101100 | 000001 |  00000 | /27
Subnet 2: | 110001100011001101100 | 00001  | 000000 | /26
``````

A `/26` subnet must always start on a `/26` boundary: every 2nd `/27` subnet boundary, every 4th `/28` boundary, every 8th `/29` boundary, etc. This rule is for any subnet size: a subnet must start on a boundary of a longer subnet that is equal to `2` to the power of the longer subnet size minus the subnet size. For example, a `/23` subnet must start on every 4th `/25` network (`2^(25 - 23) = 2^2 = 4`).

Trying to configure a device with a network address that starts on the wrong bit boundary will either lead to strange, hard to troubleshoot problems, or the device will give you an error about overlapping networks. Some people try to do this with dotted-decimal, and this can lead to errors. For example, the `198.51.96.0/27` network host addresses are `198.51.96.0` through `198.51.96.31`. If you know that and try to use the `198.51.96.32/26` network, you will run into problems because that network starts on the wrong bit boundary and overlaps the `/27` network (check by using a bitwise `AND` with the addresses and the network masks). It is obvious in binary, but it is not so obvious in dotted-decimal. You can learn that `/26` networks must start on a multiple of decimal `64` boundary, but seeing it in binary can tell you for sure whether or not you have made a mistake.

## Subnet Sizing Based on Number of Hosts

Common exam questions will give you a network and ask you to come up with several variously-sized subnets based on the number of hosts for each subnet. If you can, you need to clarify if the number of hosts is based on the total number of host addresses on the network, or if it is based on the number of usable hosts on the network. (For example, if the question asks for a subnet with `256` or `255` hosts, a `/24` network will give you `256` total host addresses, but only `254` usable host addresses. Such a question may be a trick question, and the correct answer will hinge on whether or not the question means total host addresses or usable host addresses.)

Sample question:

``````Given the 198.51.96.0/21 network, subnet it for the following departments:
Department 1:  500 hosts
Department 2:  100 hosts
Department 3:  200 hosts
Department 4: 1000 hosts
``````

As we saw in the Subnetting IPv4 Networks section, the easiest way to do this is to first sort the departments by the largest to smallest number of hosts because we will not need to deal with network gaps:

``````Department 4: 1000 hosts
Department 1:  500 hosts
Department 3:  200 hosts
Department 2:  100 hosts
``````

You can round each up to the next high power of 2 to get the number of required total host addresses for each subnet, then derive the number of required host bits from the exponent of the power of `2`:

``````Department 4: 1024 total host addresses = 2^10 = 10 host bits
Department 1:  512 total host addresses = 2^9  =  9 host bits
Department 3:  256 total host addresses = 2^8  =  8 host bits
Department 2:  128 total host addresses = 2^7  =  7 host bits
``````

You can also modify the previous formula for finding the number bits required for a particular number of equal-sized subnets to determine the number of host bits required for each subnet: `Log2(X hosts) = Y host bits`, rounded up to the next integer value:

``````Department 4: Log2(1000 hosts) = 9.96578428466209, rounded up = 10 host bits
Department 1: Log2( 500 hosts) = 8.96578428466209, rounded up =  9 host bits
Department 3: Log2( 200 hosts) = 7.64385618977472, rounded up =  8 host bits
Department 2: Log2( 100 hosts) = 6.64385618977473, rounded up =  7 host bits
``````

Once you have the number of host bits required for each subnet, then perform the binary math to get the specific subnet for each department. Remember to add `1` to a subnet to get the starting address of the next subnet:

``````Original:     | 110001100011001101100 |    00000000000 | = 198.51.96.0/21
Department 4: | 110001100011001101100 | 0 | 0000000000 | = 198.51.96.0/22
Department 1: | 110001100011001101100 | 10 | 000000000 | = 198.51.100.0/23
Department 3: | 110001100011001101100 | 110 | 00000000 | = 198.51.102.0/24
Department 2: | 110001100011001101100 | 1110 | 0000000 | = 198.51.103.0/25
Unused:       | 110001100011001101100 | 1111 | 0000000 | = 198.51.103.128/25
``````

## Finding a Particular Subnet

You may be asked to give the network information for a particular subnet of a given network. For example, you may be asked to give the network information for the 23rd `/26` subnet of the `198.51.96.0/21` network. Since you need the 23rd subnet, you can convert `22` (remember `0` is the first subnet, so the 23rd subnet would be `22`*) to binary: Decimal `22` = Binary `10110`. Use the converted binary number in the subnet portion of the address:

``````Original:  | 110001100011001101100 |    00000000000 | = 198.51.96.0/21
Subnet 23: | 110001100011001101100 | 10110 | 000000 | = 198.51.101.128/26
``````

Once you have identified the 23rd network address, `198.51.101.128/26`, you can calculate the other network information (as described in the previous sections):

``````Network address:                   198.51.101.128
First usable network host address: 198.51.101.1
Last usable network host address:  198.51.101.62
``````

*There is a persistent myth that for subnets, as for host addresses, the all-zeros and all-ones subnets cannot be used, but this myth was explicitly dispelled many years ago by a standard. Unfortunately, this myth extends to some network educations classes, and the correct answer for those (incorrect) classes would be to use the 24th (`23` decimal, `10111` binary) subnet in our example of equal-sized subnets, rather than the actual 23rd (`22` decimal, `10110` binary) subnet.

## Finding a Particular Network Host

You may be asked to find the host address for a particular host of a given network. For example, you may be asked to give the host address for the 923rd host of the `198.51.96.0/21` network. Since you need the 923rd host, you can convert `923` to binary: Decimal `923` = Binary `1110011011`. Add the converted binary number to the network address:

``````Binary network: | 110001100011001101100 | 00000000000 |
Binary 923:     | 000000000000000000000 | 01110011011 | +
-----------------------------------
Host address:   | 110001100011001101100 | 01110011011 | = 198.51.99.155
``````

## Largest Common Network for Two Hosts*

You may be given two (or more) different host addresses and asked to come up with the largest network (smallest number of hosts) that contains both host addresses. For example, find the largest common network of `198.51.100.223` and `198.51.101.76`.

First, convert the dotted decimal addresses to binary:

``````198.51.100.223 = 11000110001100110110010011011111
198.51.101.76  = 11000110001100110110010101001100
``````

Next, starting from the highest-order (leftmost) bit, compare the binary addresses at each bit position until the bits in the same position do not match:

``````198.51.100.223 = | 11000110001100110110010 | 011011111 |
198.51.101.76  = | 11000110001100110110010 | 101001100 |
``````

Count the number of matching bits, `23` in this case, to get the mask length. You can then take either address and perform a bitwise `AND` with the network mask to get the common network. Doing this on both addresses should result in the same network, and if it does not, then you either miscounted, or you missed an unmatched bit position.

``````198.51.100.223  = 11000110001100110110010011011111
/23 mask length = 11111111111111111111111000000000 AND
--------------------------------
Binary network:   11000110001100110110010000000000 = 198.51.100.0/23

198.51.101.76   = 11000110001100110110010111011111
/23 mask length = 11111111111111111111111000000000 AND
--------------------------------
Binary network:   11000110001100110110010000000000 = 198.51.100.0/23
``````

Notice that the two network addresses match. That means the largest common network for the two host addresses is `198.51.100.0/23` (CIDR notation), or (traditional) `198.51.100.0` with a mask of `255.255.254.0`.

*You may see this called the smallest common network (or some variant, e.g. minimum network or mask). The smallest network is actually `0.0.0.0/0` (`0` network bits), and it is the common network for all IPv4 addresses, so it is the smallest common network between any IPv4 addresses. The confusion arises because many people look at the host portion of the address and see its size as the network size, rather than the size of the network portion of the address.

IPv4, itself, does not have the concept of, nor distinction between, public and private addressing. The IPv4 Private addressing was arbitrarily chosen, and the ISPs, by agreement, will not forward packets on the public Internet using addresses in the Private address space, but network devices and hosts have no idea if an address is public or private.

1. `10.0.0.0/8`
2. `172.16.0.0/12`
3. `192.168.0.0/16`

Originally, IPv4 addresses were divided into network classes. Classful addressing was deprecated decades ago, and modern networking is based on CIDR (Classless Inter-Domain Routing), but, unfortunately, many network education classes and certification exams insist on testing your knowledge of classful addressing. Please learn and be comfortable with all the previous IPv4 math in this document before you learn about classful addressing.

The IPv4 address classes are all based on the first bits of the address:

``````Class   Address Starts With      Address Range                 Default Size*
A     First one bit    = 0       0.0.0.0 to 127.255.255.255        /8
B     First two bits   = 10    128.0.0.0 to 191.255.255.255       /16
C     First three bits = 110   192.0.0.0 to 223.255.255.255       /24
D     First four bits  = 1110  224.0.0.0 to 239.255.255.255       N/A
E     First four bits  = 1111  240.0.0.0 to 255.255.255.255       N/A
``````
• Class A networks have a default network mask of `255.0.0.0` (`/8`), and a default host mask of `0.255.255.255`, giving you `16,777,216` total host addresses per network.
• Class B networks have a default network mask of `255.255.0.0` (`/16`), and a default host mask of `0.0.255.255`, giving you `65,536` total host addresses per network.
• Class C networks have a default network mask of `255.255.255.0` (`/24`), and a default host mask of `0.0.0.255`, giving you `256` total host addresses per network.
• Class D addresses are used for multicast, where each address is used individually to represent a group of hosts that subscribe to a multicast address. That means that Class D addresses do not normally have the concept of a network mask.
• Class E addresses are reserved, and they cannot be used for anything. There is one exception to this, and that is the Limited Broadcast address of `255.255.255.255`, which is an individual address that every host on a network will treat as its own. That means that anything sent to `255.255.255.255` will be received and processed by every host on the network.

Because each class has a default network size, some questions assume the default mask for a given address, so any calculations need to be made based on the default network mask. For our example address, `198.51.100.223`:

``````Binary: 11000110 00110011 01100100 11011111
``````

Notice that the first three address bits are `110`, meaning that this is a Class C address, and absent any mask or mask length, the network mask is assumed to be `255.255.255.0` (`/24`), making the network address `198.51.100.0`.

*Do not make the common mistake of thinking the network mask dictates the network class, it is the other way around. For example, many people consider any `/24` network to be a Class C network, but that is not even remotely true. Given, for example, a `10.11.12.0/24` network, many people incorrectly call that a Class C network because of the network mask, even though the first bit of the address is `0`, making it is a Class A network, albeit with a longer network mask than the default Class A network mask, meaning it is a subnet of a Class A network, not a Class C network.

Subnet Sizing Based on Number of Hosts

This is for the common question "How do I cut a given network size into n pieces allowing for x1 hosts in network 1, x2 hosts in network 2, etc ...?" can absolutely be solved by working through the methods described in the other excellent answers.

Some people however, might like a more visual method and some general tips.

Visual "Glasscutter" Method

The way I often teach a visual understanding of this is with the following method:

First imagine a paper guillotine like this: (Picture from Wikipedia By Nathan CC BY-SA 3.0)

The properties of this kind of cutter are that it only cuts straight lines, it always cuts all the way across the paper, and it cuts perpendicular to a side. Our particular guillotine is fussy: it will only cut paper in half, and we can't make any cut closer than 1 cm from the edge.

• How many addresses are available in total for your starting block?
• Suppose were dividing up a /22 has 1024 addresses
• Get a piece of paper with that many square centimetres (and square or 2x1 ratio)
• Therefore I get a piece 32 cm by 32 cm which has 1024 sq cm
• Repeatedly
1. Choose a piece (if there's more than one)
2. Cut it in half (within constraints: only rectangular cuts, in half, nothing below 1 cm)
• Often there are different cuts you can make and you have to make a choice
• To get n networks, you need to make n-1 cuts
• Sometimes you end up with extra pieces (depending how you want to distribute the "waste")

Here's an illustration of the process. You see that there is only one kind of cut possible at cut 1 and cut 2, but at cut 3 we make a choice: cut the small piece (red) or the big piece (blue), giving two different possibilities. The is what's often called the guillotine problem, which I learned as the "glasscutter" problem, as sheet glass really does has to be cut all the way across, and this specific might be called "binary glasscutter" as it's always cutting into halves.

When I actually do this in real life, I mentally do the halvings while looking at grid like this. I can remember that /26 must begin on 0, .64, 128 or .192; I might know that the seventh leased line needs the seventh /30 in the top quarter, but I won't remember that's .216.

The grid obviously can be used to represent the third octet too, and each square represents a /24. Now it says that a /18 begins on .0, .64, .128 or .192. General Technique Tips

The general procedure is:

• round up each required size into the smallest block which is big enough
• make sure you follow whatever global rules (often "maximise the addressing available", sometimes it's "allow double for growth" or "make routing easy")
• allocate the subnets to addresses STARTING WITH THE BIGGEST and going down to the smallest (this is the part they usually forget to tell you)
• follow any specific rules (test questions often have extra rules, sometimes as abritrary as "No network address may have a 7 in it")
• if any network is small (/30, /31 or /32) pay extra attention as there are some edge cases for networks with 4, 2, and 1 hosts, and the details depend on what exact problem you're solving

Example:

IP: 128.42.5.4

In binary: 10000000 00101010 00000101 00000100

Subnet: 255.255.248.0

How could you determine the prefix, network, subnet, and host numbers?

``````      32768     16384  8192  4096  2048  1024   512   256  ----> Binary
128       192   224   240   248   252   254   255  ----> Sunet Mask
/17       /18   /19   /20   /21   /22   /23   /24  ----> CIDR
32766     16382  8190  3094  2046  1022   510   254  ----> Host

128     64    32     16     8     4    2     1   ----> Binary
128    192   224    240   248   252   254   255  ----> Sunet Mask
/25    /26   /27    /28   /29   /30   /31   /32  ----> CIDR
126     62    30     14     6     2    *     -   ----> Host

128        64        32       16        8         4         2        1
10000000   01000000  00100000 00010000  00001000  00000100  00000010   00000001
``````

``````   Example
Network=192.168.1.0 /24;
254 Host
``````

``````   Network=192.168.1.0 /25;
``````   When the CIDR increased ex. /24. /25.  the network will divided by the