# Mental Subnetting Cheatsheet

This is a plain-text copy of a cheatsheet published by Ellington Technologies, made for pasting into an AI assistant. It's generated from the same source file as the web page. If the two ever differ, the web page is correct: https://jeremiahellington.com/resources/cheatsheets/mental-subnetting

- Source (authoritative web version): https://jeremiahellington.com/resources/cheatsheets/mental-subnetting
- Author: Jeremiah Ellington
- Published: 2026-10-28
- Last updated: 2026-10-28
- Last reviewed: 2026-10-28
- Next scheduled review: 2027-04-30
- Applies to: IPv4 CIDR prefixes /0 to /32. IPv6 isn't covered

One printable page for subnetting IPv4 without a chart: the four steps, the interesting octet for each prefix, mask values and increments, powers of two, and /0, /31 and /32.

---

The full explanation, with worked examples, is in [Subnetting in Your Head](https://jeremiahellington.com/resources/subnetting-in-your-head). Practice with the [Mental Subnetting Trainer](https://jeremiahellington.com/resources/it-tools/subnetting-trainer); check answers with the [IPv4 Subnet Calculator](https://jeremiahellington.com/resources/it-tools/subnet-calculator). Examples use documentation and private addresses.

> The method is inspired by [an explanation u/nivekami posted on r/ccna](https://www.reddit.com/r/ccna/comments/l9cr5v/). This cheatsheet is written independently, in its own words, and isn't endorsed by that author.

## The four steps

1. **Interesting octet:** the octet the prefix ends in (table below). Copy the octets before it.
2. **Increment:** 2 to the power of the host bits left in that octet, which is 256 minus the mask value there.
3. **Block:** round the address's value in that octet **down** to a multiple of the increment. The block ends at start + increment − 1.
4. **Fill in:** network = block start, then **0** in every later octet. Broadcast = block end, then **255** in every later octet. Usable hosts are in between.

Example: `172.23.23.18/22` is the third octet, increment 4, 23 rounds down to 20, so the network is `172.23.20.0/22` and the broadcast is `172.23.23.255`.

## Which octet

| Prefix | Interesting octet | Copy unchanged | Fill with 0s / 255s |
|---|---|---|---|
| /1 to /8 | first | none | second, third, fourth |
| /9 to /16 | second | first | third, fourth |
| /17 to /24 | third | first, second | fourth |
| /25 to /32 | fourth | first three | none |

## Mask values and increments

| Bits in the octet | Mask value | Increment | Prefixes |
|---|---|---|---|
| 1 | 128 | 128 | /1, /9, /17, /25 |
| 2 | 192 | 64 | /2, /10, /18, /26 |
| 3 | 224 | 32 | /3, /11, /19, /27 |
| 4 | 240 | 16 | /4, /12, /20, /28 |
| 5 | 248 | 8 | /5, /13, /21, /29 |
| 6 | 252 | 4 | /6, /14, /22, /30 |
| 7 | 254 | 2 | /7, /15, /23, /31 |
| 8 | 255 | 1 | /8, /16, /24, /32 |

With 8 bits, the prefix is octet-aligned: copy the octet as it is.

## Powers of two

Total addresses in a subnet = 2 to the power of (32 − prefix).

| Host bits | Addresses | Prefix |
|---|---|---|
| 0 | 1 | /32 |
| 1 | 2 | /31 |
| 2 | 4 | /30 |
| 3 | 8 | /29 |
| 4 | 16 | /28 |
| 5 | 32 | /27 |
| 6 | 64 | /26 |
| 7 | 128 | /25 |
| 8 | 256 | /24 |
| 10 | 1,024 | /22 |
| 12 | 4,096 | /20 |
| 16 | 65,536 | /16 |
| 20 | 1,048,576 | /12 |
| 22 | 4,194,304 | /10 |
| 24 | 16,777,216 | /8 |
| 32 | 4,294,967,296 | /0 |

## Special prefixes

| Prefix | Total | Usable | Notes |
|---|---|---|---|
| /30 | 4 | 2 | Network, two hosts, broadcast |
| /31 | 2 | 2 | Point-to-point link (RFC 3021): no network or broadcast address |
| /32 | 1 | 1 | Single-address route: host routes, loopbacks |
| /0 | 4,294,967,296 | Not meaningful | Default route: 0.0.0.0 to 255.255.255.255 |

Conventional usable hosts = total − 2, from /1 to /30 only; at /0 the count isn't meaningful.

## Watch for

- A host address isn't the network ID: `192.168.4.20/28` is a host on `192.168.4.16/28`.
- Fill **every** octet after the interesting one, not just the last.
- Round **down**, never to the nearest multiple.
- "How many subnets?" needs a parent prefix: a /24 holds 4 /26s; a /22 holds 16.
- "Subnet 3" needs a parent range and a starting count (0 or 1).

---

## Sources and official documentation

- [Original explanation that inspired this method: u/nivekami on r/ccna (Reddit)](https://www.reddit.com/r/ccna/comments/l9cr5v/)
- [RFC 4632: Classless Inter-domain Routing (CIDR)](https://www.rfc-editor.org/rfc/rfc4632)
- [RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links](https://www.rfc-editor.org/rfc/rfc3021)
- [RFC 5737: IPv4 Address Blocks Reserved for Documentation](https://www.rfc-editor.org/rfc/rfc5737)

## Review history

- Technical review: Jeremiah Ellington, 2026-10-28
- Editorial review: Jeremiah Ellington, 2026-10-28