Appendix A
Subnetting Cheat Sheet
Subnetting shows up in every domain of the exam, and you will not have a calculator. This appendix collects the tables and the one quick method you need so that any subnetting question can be answered in under a minute.
Powers of two
Every subnetting calculation is a power of two. Memorize this table cold.
| Power | Value | Power | Value |
|---|---|---|---|
| 2^0 | 1 | 2^8 | 256 |
| 2^1 | 2 | 2^9 | 512 |
| 2^2 | 4 | 2^10 | 1,024 |
| 2^3 | 8 | 2^11 | 2,048 |
| 2^4 | 16 | 2^12 | 4,096 |
| 2^5 | 32 | 2^13 | 8,192 |
| 2^6 | 64 | 2^14 | 16,384 |
| 2^7 | 128 | 2^15 | 32,768 |
Bit values inside one octet, left to right: 128, 64, 32, 16, 8, 4, 2, 1. Their running totals give the possible mask octet values: 128, 192, 224, 240, 248, 252, 254, 255.
Full /8 to /32 prefix table
Formulas: subnet mask has the first N bits set to 1; wildcard mask is 255.255.255.255 minus the subnet mask (used by OSPF network statements and ACLs); usable hosts = 2^(32 - N) - 2, except /31 (2 usable on point-to-point links per RFC 3021) and /32 (a single host route).
| Prefix | Subnet mask | Wildcard mask | Total addresses | Usable hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 (point-to-point only) |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 (host route) |
The “magic number” quick method
The magic number (also called the block size or increment) is the size of each subnet within the octet where the mask is “interesting” (the octet that is not 0 or 255).
Magic number = 256 - (the interesting mask octet)
Steps to find the subnet, broadcast, and host range for any address:
- Write the mask in dotted decimal and find the interesting octet (the one that is neither 255 nor 0).
- Magic number = 256 - that octet value.
- In the address, look at the same octet. Find the largest multiple of the magic number that is less than or equal to the address’s octet value. That is the subnet’s octet. All octets to the right become 0. This is the network address.
- Add the magic number to get the next subnet; subtract 1 from that (with octets to the right set to 255) for the broadcast address.
- First usable host = network + 1. Last usable host = broadcast - 1.
Worked example: address 172.16.77.130, mask 255.255.240.0 (/20).
- Interesting octet: third (240). Magic number = 256 - 240 = 16.
- Multiples of 16: 0, 16, 32, 48, 64, 80… The third octet is 77, and the largest multiple of 16 that is 77 or less is 64.
- Network: 172.16.64.0. Next subnet: 172.16.80.0. Broadcast: 172.16.79.255.
- Host range: 172.16.64.1 through 172.16.79.254.
A second quick tool: number of subnets when you borrow bits. If you take a /24 and subnet it to /27, you borrowed 3 bits, giving 2^3 = 8 subnets of 32 addresses each. In general, subnets = 2^(new prefix - old prefix).
Choosing a mask for a required host count: find the smallest power of two that is at least (hosts + 2). For 50 hosts you need 52 addresses, so 64 (2^6): the host portion is 6 bits and the prefix is /26.
Choosing a mask for a required subnet count: find the smallest power of two that is at least the number of subnets. For 10 subnets from a /24 you need 16 (2^4), so borrow 4 bits: /28, which leaves 14 hosts each.
Private and special IPv4 ranges
| Range | Prefix | Purpose |
|---|---|---|
| 10.0.0.0 - 10.255.255.255 | 10.0.0.0/8 | Private (RFC 1918), 1 Class A |
| 172.16.0.0 - 172.31.255.255 | 172.16.0.0/12 | Private (RFC 1918), 16 Class B |
| 192.168.0.0 - 192.168.255.255 | 192.168.0.0/16 | Private (RFC 1918), 256 Class C |
| 169.254.0.0 - 169.254.255.255 | 169.254.0.0/16 | APIPA / link-local (DHCP failed) |
| 127.0.0.0 - 127.255.255.255 | 127.0.0.0/8 | Loopback |
| 224.0.0.0 - 239.255.255.255 | 224.0.0.0/4 | Multicast (Class D) |
| 240.0.0.0 - 255.255.255.254 | 240.0.0.0/4 | Experimental (Class E) |
| 100.64.0.0 - 100.127.255.255 | 100.64.0.0/10 | Carrier-grade NAT shared space |
Classful boundaries for reference: Class A 1-126 (/8), Class B 128-191 (/16), Class C 192-223 (/24). The first octet 0 and 127 are reserved.
IPv6 prefix quick reference
IPv6 addresses are 128 bits written as eight 16-bit hextets in hexadecimal. Prefix lengths work exactly like IPv4 CIDR but there is no subnet mask notation, only /N.
| Prefix | Meaning |
|---|---|
| 2000::/3 | Global unicast (first hextet 2000 through 3FFF) |
| FC00::/7 | Unique local (private); in practice FD00::/8 is used |
| FE80::/10 | Link-local (every IPv6 interface has one; not routable) |
| FF00::/8 | Multicast |
| FF02::1 | All-nodes link-local multicast |
| FF02::2 | All-routers link-local multicast |
| FF02::5 and FF02::6 | OSPFv3 all-SPF-routers and all-DR-routers |
| FF02::1:FF00:0/104 | Solicited-node multicast (used by neighbor discovery) |
| ::1/128 | Loopback |
| ::/128 | Unspecified address |
| ::/0 | Default route |
| 2001:DB8::/32 | Documentation prefix (examples only) |
| 64:FF9B::/96 | NAT64 well-known prefix |
| ::FFFF:0:0/96 | IPv4-mapped IPv6 addresses |
Common IPv6 subnetting facts:
- A typical ISP allocation to an organization is a /48; a typical LAN subnet is a /64, leaving 64 bits for the interface ID (required for SLAAC and EUI-64).
- A /48 contains 2^16 = 65,536 /64 subnets. A /56 contains 256 /64s. A /52 contains 4,096 /64s.
- Each hexadecimal digit is 4 bits; each hextet is 16 bits. So a /64 covers exactly the first four hextets, a /48 the first three, and a /32 the first two.
- Address compression rules: drop leading zeros in each hextet; replace one run of consecutive all-zero hextets with
::. - EUI-64: split the 48-bit MAC in half, insert
FFFEin the middle, and flip the seventh bit (the universal/local bit) of the first byte. MAC 0050.56AB.1234 becomes interface ID0250:56FF:FEAB:1234.
Five practice problems with worked solutions
Problem 1. A host has the address 192.168.10.77 with mask 255.255.255.224. What are the network address, broadcast address, and usable host range?
Solution. The interesting octet is the fourth (224). Magic number = 256 - 224 = 32. Multiples of 32: 0, 32, 64, 96. The largest at or below 77 is 64. Network = 192.168.10.64/27. Next subnet starts at 96, so broadcast = 192.168.10.95. Usable hosts = 192.168.10.65 through 192.168.10.94 (30 hosts).
Problem 2. You are given 10.20.0.0/16 and need subnets that each support at least 1,000 hosts. What prefix should you use, how many hosts does each subnet support, and how many subnets do you get?
Solution. 1,000 hosts + 2 = 1,002 addresses; the smallest power of two that fits is 1,024 = 2^10, so leave 10 host bits: prefix = 32 - 10 = /22 (mask 255.255.252.0). Usable hosts per subnet = 1,024 - 2 = 1,022. Bits borrowed = 22 - 16 = 6, so subnets = 2^6 = 64. The first four subnets are 10.20.0.0/22, 10.20.4.0/22, 10.20.8.0/22, 10.20.12.0/22.
Problem 3. Which subnet does the address 172.31.200.9/21 belong to, and what is the last usable address in that subnet?
Solution. /21 = 255.255.248.0. Interesting octet is the third (248). Magic number = 256 - 248 = 8. The largest multiple of 8 at or below 200 is 200 itself. Network = 172.31.200.0/21. Next subnet = 172.31.208.0, so broadcast = 172.31.207.255 and the last usable host = 172.31.207.254.
Problem 4. A router has interfaces on 10.1.1.0/30, 10.1.1.4/30, and 10.1.1.8/30 toward three neighbors. What wildcard mask would be used in an OSPF network command to match all three links with one statement, and what network statement would you write?
Solution. The three /30 subnets together span 10.1.1.0 through 10.1.1.11, which is 12 addresses; the smallest block that contains them is 16 addresses, a /28 starting at 10.1.1.0 (10.1.1.0 - 10.1.1.15). A /28 mask is 255.255.255.240, so the wildcard is 255.255.255.255 - 255.255.255.240 = 0.0.0.15. The statement is network 10.1.1.0 0.0.0.15 area 0. (Any wildcard that covers the range works, such as 0.0.0.255, but 0.0.0.15 is the tightest match.)
Problem 5. An organization has been assigned 2001:DB8:AB00::/48. It wants to number its LANs using /64 subnets. How many /64 subnets are available, and what are the first and last /64 subnets in the block?
Solution. From /48 to /64 is 16 bits, so 2^16 = 65,536 subnets. The 16 borrowed bits are exactly the fourth hextet. First subnet: 2001:DB8:AB00:0::/64 (written 2001:DB8:AB00::/64). Last subnet: 2001:DB8:AB00:FFFF::/64. The subnet with the fourth hextet 0010 (hex) is 2001:DB8:AB00:10::/64, which is the 17th subnet (hex 10 = decimal 16, counting from 0).