Subnetting in Your Head: The No-Chart Method

Subnetting looks like a binary exercise, and most courses teach it that way: write out the address in ones and zeros, line up the mask, and AND them together. That works, but it's slow, and it's hard to do while someone is reading an address to you over the phone. This guide shows a method that needs no chart and no binary for everyday use: find one octet, do one small division, and fill in the rest.

Everything here is IPv4. The examples use private addresses (RFC 1918) and documentation addresses (RFC 5737), so none of them belongs to a real network.

What the prefix tells you#

An IPv4 address is 32 bits, written as four octets of 8 bits each, such as 192.168.4.20. The prefix length after the slash says how many of those bits, counted from the left, identify the network. The rest identify a host on that network.

So in 192.168.4.20/28, the first 28 bits are the network and the last 4 are the host. A subnet mask says the same thing as four numbers: /28 is 255.255.255.240.

Because each octet is 8 bits, the prefix length tells you straight away which octet the network ends in:

That octet is the interesting octet. Every octet before it is entirely network bits, so it's the same for every address in the subnet. Every octet after it is entirely host bits. Only the interesting octet needs any thought.

A short binary refresher#

You don't need binary to use the method, but it explains why it works. The bits in an octet are worth 128, 64, 32, 16, 8, 4, 2 and 1, from left to right. A mask fills them from the left, so the only values a mask octet can take are:

The increment is the value of the lowest network bit in that octet, which is also 256 minus the mask value. Subnets in that octet start at every multiple of it.

The method#

1. Find the interesting octet

   Use the table above. /20 ends in the third octet; /10 ends in the second; /28 ends in the fourth. Copy every octet before it as it is.

2. Work out the increment

   Count how many prefix bits fall in the interesting octet: the prefix minus 0, 8, 16 or 24 for the first, second, third or fourth octet. The host bits left in that octet are 8 minus that, and the increment is 2 to the power of the host bits. Put another way, the increment is 2 to the power of (the next octet boundary minus the prefix): for /20 that's 2 to the power of (24 − 20), which is 16.

3. Round down to the block

   Take the address's value in the interesting octet and find the largest multiple of the increment that isn't more than it. That's where the block starts. The block ends one before the next multiple: start + increment − 1.

4. Fill in the rest

   For the network address, put the block start in the interesting octet and 0 in every octet after it. For the broadcast address, put the block end in the interesting octet and 255 in every octet after it. The usable hosts are everything in between.

The trailing octets are the step people most often forget. The 0s and 255s go in every octet after the interesting one, not just the last octet.

Worked examples#

Try each one before reading the working. The Mental Subnetting Trainer reveals the same steps one at a time for any address you enter.

192.168.4.20/28#

• Interesting octet: /28 is between /25 and /32, so the fourth. Copy 192.168.4.
• Increment: 28 − 24 = 4 prefix bits in the fourth octet, leaving 4 host bits. 2⁴ = 16.
• Block: the fourth octet is 20. Multiples of 16 are 0, 16, 32 …; the largest that isn't more than 20 is 16. The block is 16 to 31.
• Answer: network 192.168.4.16/28, broadcast 192.168.4.31, usable hosts 192.168.4.17 to 192.168.4.30. That's 16 addresses, 14 of them usable.

172.16.32.0/20#

• Interesting octet: /20 is between /17 and /24, so the third. Copy 172.16.
• Increment: 20 − 16 = 4 prefix bits in the third octet, leaving 4 host bits. 2⁴ = 16.
• Block: the third octet is 32, which is already a multiple of 16. The block is 32 to 47.
• Answer: network 172.16.32.0/20, broadcast 172.16.47.255. The range is 172.16.32.0 to 172.16.47.255: 4,096 addresses, 4,094 usable (172.16.32.1 to 172.16.47.254).

The address entered here is the network address itself, which is fine for naming a subnet but can't be given to a host. The fourth octet becomes 255 in the broadcast address even though the prefix ends in the third: that's the trailing-octet rule at work.

172.23.23.18/22#

• Interesting octet: /22 ends in the third octet. Copy 172.23.
• Increment: 22 − 16 = 6 prefix bits in the third octet, leaving 2 host bits. 2² = 4.
• Block: the third octet is 23. Multiples of 4 are … 16, 20, 24 …; the largest that isn't more than 23 is 20. The block is 20 to 23.
• Answer: network 172.23.20.0/22, broadcast 172.23.23.255. The range is 172.23.20.0 to 172.23.23.255: 1,024 addresses, 1,022 usable.

Notice the address sits in the last /24 of its block, and the network address has a different third octet from the address you started with. That's normal whenever the prefix ends before the octet does.

10.12.34.145/10#

• Interesting octet: /10 is between /9 and /16, so the second. Copy 10.
• Increment: 10 − 8 = 2 prefix bits in the second octet, leaving 6 host bits. 2⁶ = 64.
• Block: the second octet is 12. Multiples of 64 are 0, 64, 128 and 192; the largest that isn't more than 12 is 0. The block is 0 to 63.
• Answer: network 10.0.0.0/10, broadcast 10.63.255.255. The range is 10.0.0.0 to 10.63.255.255: 4,194,304 addresses (2²²).

The third and fourth octets of the address (34 and 145) don't matter at all. Once you've found the block in the interesting octet, everything after it is 0 or 255.

Prefixes that end on an octet boundary#

/8, /16 and /24 (and /32) end exactly at the end of an octet, so there's nothing to round. The increment in the interesting octet is 2⁰ = 1, which means "copy the octet as it is". In practice you can skip straight to step 4:

• 10.20.30.40/8: network 10.0.0.0, broadcast 10.255.255.255.
• 172.16.200.9/16: network 172.16.0.0, broadcast 172.16.255.255.
• 192.168.4.20/24: network 192.168.4.0, broadcast 192.168.4.255.

Small and special prefixes#

The usual host count, 2^{host bits} − 2, subtracts the network and broadcast addresses. It holds from /1 to /30; at /0 the count isn't meaningful. It doesn't apply to /31 or /32, so don't treat it as universal.

• 198.51.100.6/30: fourth octet, increment 4, block 4 to 7. Network 198.51.100.4, broadcast 198.51.100.7, usable 198.51.100.5 and 198.51.100.6.
• 198.51.100.6/31: fourth octet, increment 2, block 6 to 7. Both 198.51.100.6 and 198.51.100.7 are used, one at each end of the link. There's no broadcast address and nothing is subtracted. Check that both devices support /31 before you use one.
• 198.51.100.6/32: the increment is 1, so the "block" is just 198.51.100.6. There's nothing to subtract and no broadcast.
• 0.0.0.0/0: no network bits at all, so there's no interesting octet. The range is 0.0.0.0 to 255.255.255.255, the whole IPv4 space. In a routing table, 0.0.0.0/0 is the default route: it matches any destination that nothing more specific matches.

Common mistakes#

• Mixing up a host address with the network ID. 172.23.23.18/22 is a host on the 172.23.20.0/22 network. Configure the host with its own address; use the network address when you write a route, an ACL or a firewall object.
• Forgetting the trailing octets. With /20 or /10 the prefix ends before the fourth octet, so every octet after the interesting one is 0 in the network address and 255 in the broadcast. Changing only the last octet gives the wrong answer.
• Using 2^{host bits} − 2 everywhere. It's right for /30 and shorter, but a /31 has 2 usable addresses and a /32 has 1.
• Rounding to the nearest multiple instead of down. 23 with an increment of 4 belongs to the block starting at 20, not 24.
• Counting subnets without saying what you're dividing. "How many /26 subnets are there?" has no answer on its own. Inside a /24, there are 2^{26 − 24} = 4; inside a /22, there are 2^{26 − 22} = 16. Always name the parent prefix.
• Asking for "subnet 3" without a parent range or a starting point. Split 192.168.4.0/24 into /26s and you get .0, .64, .128 and .192. Counting from one, subnet 3 is 192.168.4.128/26; counting from zero, it's 192.168.4.192/26. Split 192.168.4.0/22 instead and there are 16 of them, running up to 192.168.7.192/26. Give the parent network and say whether you count from 0 or 1.

Practice and tools#

• The Mental Subnetting Trainer reveals the steps one at a time for any address, and gives you random practice questions from private and documentation ranges.
• The IPv4 Subnet Calculator gives the full answer at once, including masks in binary, and splits a network into smaller subnets. Use it to check your work.
• The Wildcard Mask Calculator turns a subnet mask into the wildcard mask that Cisco ACLs use.
• The Mental Subnetting Cheatsheet puts the tables and the four steps on one printable page.

For where subnets fit in a real network plan, see IP addresses and subnets, in plain terms in the network guide, and VLANs for a Small Office on Cisco IOS.