IPv4 — address format, classes, subnetting, CIDR notation: Worked examples

This page is the "throw everything at it" companion to the parent IPv4 note. The parent gave you the tools; here we drill every kind of question an exam or a real network can ask — every quadrant of the problem space, every degenerate edge, every trap.

Before we start, one promise: we build every idea from bits. If you can count in base 2 (see Binary and Positional Number Systems) you can follow line one to the end.

The scenario matrix

Every IPv4 subnetting problem is one (or a blend) of these cells. Our examples below are labelled with the cell they cover, so by the end no cell is left dark.

#	Cell (kind of case)	What makes it tricky	Covered by
C1	Prefix breaks mid-octet (e.g. /26, /27)	block size ≠ whole octet; must find the boundary	Ex 1, Ex 3
C2	Prefix on an octet boundary (/8, /16, /24)	clean split — sanity anchor	Ex 2
C3	"How many subnets" (borrow bits)	choosing $s$ from a required subnet count	Ex 4
C4	Degenerate tiny nets (/30, /31, /32)	the " $- 2$ " rule breaks or vanishes	Ex 5
C5	Zero / all-ones host (network & broadcast)	reserved addresses, off-by-one	Ex 1, Ex 3, Ex 8
C6	Aggregation / supernetting (merge blocks)	going the other way — fewer network bits	Ex 6
C7	Real-world word problem (VLSM)	translate English → prefixes	Ex 7
C8	Exam twist: is X a valid host?	membership test, boundary confusion	Ex 8

Example 1 — /26: prefix breaks mid-octet (cells C1, C5)

Worked example Given

192.168.1.100/26, find the network address, broadcast address, first & last usable host, and host count. Forecast first: the prefix (cut position) is /26. Which octet does the "cut" land in, and what's the block size? Guess before reading — is .100 in the block starting at .64 or .128?

Step 1 — Find host bits. $h = 32 - 26 = 6$ . Why this step? Everything (block size, host count) flows from how many bits are on the host side of the cut.

Step 2 — Which octet holds the cut? 26 bits = 8 + 8 + 8 + 2. So the first three octets are fully network; the cut sits 2 bits into the last octet. Why this step? The block size only "moves" inside the octet where the mask stops being all-ones.

Step 3 — Block size in that octet. Using the page formula, $block = 2^{(8 - (26 mod 8))} = 2^{(8 - 2)} = 2^{6} = 64$ . Why this step? 6 host bits live in the last octet, so the network boundary repeats every $2^{6} = 64$ . Boundaries are the multiples of 64: 0, 64, 128, 192.

Step 4 — Which block does .100 fall in? $64 \leq 100 < 128$ , so the block starts at 64. Why this step? The network address is the largest multiple of the block size not exceeding the host octet. Look at the figure — .100 (yellow) lands in the .64–.127 slot.

Step 5 — Assemble the four answers.

Network (all host bits 0) = 192.168.1.64
Broadcast (all host bits 1) = 192.168.1.64 + 63 = 192.168.1.127
First usable = network + 1 = 192.168.1.65
Last usable = broadcast − 1 = 192.168.1.126
Usable hosts = $2^{6} - 2 = 62$ . Why this step? Network = all-zeros host; broadcast = all-ones host; usable range sits strictly between them.

Verify: Last usable − first usable + 1 = $126 - 65 + 1 = 62$ ✓ matches $2^{6} - 2$ . And .100 satisfies $65 \leq 100 \leq 126$ , so it's a legal host inside its own subnet ✓.

Example 2 — /16: clean octet-boundary split (cell C2)

Worked example For

172.20.0.0/16, give network, broadcast, host count. Then say why this one has no block-size arithmetic. Forecast: /16 is a multiple of 8. Do you expect any "boundary hunting"? (No — this is the sanity-anchor case.)

Step 1 — Host bits. $h = 32 - 16 = 16$ . Why this step? Two whole octets (the last two) are host.

Step 2 — Network address. Set both host octets to 0 → 172.20.0.0. Why this step? The cut is exactly between octet 2 and octet 3, so no octet is "split" — the block-size formula only applies when $n$ is not a multiple of 8, so we skip it here.

Step 3 — Broadcast. Set both host octets to all-ones (255) → 172.20.255.255. Why this step? All-ones host = broadcast, and "all ones" of 16 bits is 255.255 in the last two octets.

Step 4 — Host count. $2^{16} - 2 = 65534$ . Why this step? $2^{16}$ counts every pattern of the 16 host bits; subtract the two reserved patterns (network + broadcast) to get usable hosts.

Verify: Addresses in range = broadcast − network + 1. In integer terms the last 16 bits run 0 to 65535, that's $65536$ addresses; minus 2 reserved = $65534$ ✓.

Example 3 — /27: another mid-octet cut, and picking a valid subnet address (cells C1, C5)

Worked example You're told a subnet has mask

255.255.255.224. (a) What prefix is that? (b) List all its subnet network addresses in the last octet. (c) Is 192.0.2.200 a network address, a broadcast, or a usable host — and of which subnet? Forecast: 224 in binary is 11100000 — count the ones. Then the block size should equal $256/ (number of subnets)$ .

Step 1 — Convert the mask to a prefix. $224 = 128 + 64 + 32 = 11100000$ → 3 network bits in the last octet. Total = $24 + 3 = 27$ , i.e. /27. Why this step? The prefix length is just the count of leading 1-bits in the whole mask.

Step 2 — Block size. $h = 32 - 27 = 5$ , and using the formula $block = 2^{(8 - (27 mod 8))} = 2^{(8 - 3)} = 2^{5} = 32$ . Why this step? 5 host bits inside the last octet → boundaries repeat every 32.

Step 3 — List network addresses (multiples of 32). 0, 32, 64, 96, 128, 160, 192, 224. That's $256/32 = 8$ subnets. Why this step? Every subnet network address is a multiple of the block size; there are exactly $2^{3} = 8$ of them (3 subnet bits).

Step 4 — Classify .200. Which block? $192 \leq 200 < 224$ → block starts at 192, so this subnet is 192.0.2.192/27 with broadcast 192.0.2.223.

Network = .192, broadcast = .223, usable = .193–.222.
.200 is strictly between → it's a usable host of subnet .192/27. Why this step? Membership = "find the block, then compare against network/broadcast endpoints."

Verify: Number of subnets $\times$ block size = $8 \times 32 = 256$ (fills the whole octet) ✓. And .200 satisfies $193 \leq 200 \leq 222$ → usable ✓.

Example 4 — "I need N subnets": borrowing bits (cell C3)

Worked example Split

10.10.0.0/16 so that you get at least 50 subnets, each as large as possible. How many bits to borrow? Give the new prefix, subnet count, hosts per subnet, and the first two subnet addresses. Forecast: 50 subnets needs $2^{s} \geq 50$ . What's the smallest such $s$ ?

Step 1 — Choose $s$ (bits to borrow). We need $2^{s} \geq 50$ . $2^{5} = 32$ (too few), $2^{6} = 64 \geq 50$ ✓. So $s = 6$ . Why this step? We take the smallest $s$ that meets the requirement, because every extra borrowed bit halves the hosts per subnet — we want subnets as large as possible.

Step 2 — New prefix length. The new prefix length is the old prefix length plus the borrowed bits: $16 + 6 = 22$ , i.e. /22. (Here the number after the slash is the prefix length $n$ defined at the top of the page.) Why this step? Borrowing $s$ host bits moves the cut $s$ steps to the right, so $n$ grows by $s$ .

Step 3 — Counts.

Subnets = $2^{6} = 64$ (≥ 50 ✓, with 14 spare).
Host bits $h = 32 - 22 = 10$ → hosts per subnet $= 2^{10} - 2 = 1022$ . Why this step? $s$ subnet bits → $2^{s}$ subnets; remaining $h$ host bits → $2^{h} - 2$ usable.

Step 4 — Where's the block boundary? /22 → the cut is 6 bits into the third octet ( $22 = 8 + 8 + 6$ ). Block size in the third octet $= 2^{(8 - (22 mod 8))} = 2^{(8 - 6)} = 2^{2} = 4$ . So the third-octet network numbers step by 4: 0, 4, 8, …. First two subnets: 10.10.0.0/22 and 10.10.4.0/22. Why this step? The mask breaks in octet 3, so boundaries live there, spaced by the block size.

Verify: Subnets × hosts-per-subnet + reserved ≈ original size. $64 \times 1024 = 65536 = 2^{16}$ = the /16 block exactly ✓ (we count all $2^{10}$ per subnet here to check the bit bookkeeping). And $2^{6} = 64 \geq 50$ ✓.

Example 5 — Degenerate tiny networks /30, /31, /32 (cell C4)

Worked example A router-to-router link needs exactly 2 usable addresses. (a) What's the smallest classic prefix that works? (b) What happens at

/31 and /32 — do the usual formulas survive? Forecast: For "2 usable hosts", solve $2^{h} - 2 = 2$ . Then push into the weird cases where $- 2$ stops making sense.

Step 1 — Solve for /30. $2^{h} - 2 = 2 \Rightarrow 2^{h} = 4 \Rightarrow h = 2 \Rightarrow n = 32 - 2 = 30$ , i.e. /30. Why this step? A point-to-point link has exactly two endpoints; /30 gives $2^{2} - 2 = 2$ usable — perfect fit.

Step 2 — The /30 layout. For 192.0.2.4/30: block size $2^{2} = 4$ , so this subnet is .4–.7.

Network .4, broadcast .7, usable .5 and .6. Two hosts ✓. Why this step? Even for the smallest normal subnet, the network + broadcast rule still holds.

Step 3 — /31: the exception. $2^{1} - 2 = 0$ usable by the old formula — that would be useless. RFC 3021 redefines /31 for point-to-point links: no network/broadcast reservation, so both addresses are usable → 2 hosts with only 1 host bit. Why this step? This is the classic edge case where the blunt " $- 2$ " rule breaks; the standard patches it precisely for links with only two ends.

Step 4 — /32: a single host. $h = 0$ , one address, no room to split. Used for loopbacks and host routes (a route to one exact machine). "Usable" = 1 (the address itself). Why this step? The limiting case $h \to 0$ — the host part vanishes; the address is the network.

Verify: /30 usable $= 2^{2} - 2 = 2$ ✓; /31 usable (RFC 3021) $= 2$ ✓; /32 addresses $= 2^{0} = 1$ ✓. Notice /30 and /31 both yield 2 usable — the /31 trick saves one address per link.

Example 6 — Aggregation / supernetting (cell C6)

Worked example Your routing table has four routes:

192.168.4.0/24, 192.168.5.0/24, 192.168.6.0/24, 192.168.7.0/24. Combine them into ONE route. What prefix? Forecast: Write the third octets in binary. How many high bits do 4, 5, 6, 7 all share?

Step 1 — Binary of the varying octet. $4 = 00000100$ , $5 = 00000101$ , $6 = 00000110$ , $7 = 00000111$ . Why this step? Aggregation works only if the blocks share a common leading bit-pattern — we must see exactly where they start to differ.

Step 2 — Find the common prefix. They agree on the top 6 bits (000001) and differ only in the last 2 bits (00,01,10,11). Those 2 differing bits are precisely the 4 combinations for 4 blocks. Why this step? $2^{2} = 4$ blocks ⇒ exactly 2 varying low bits ⇒ 6 fixed bits in this octet.

Step 3 — Total prefix length. First two octets fixed (16 bits) + 6 shared bits in octet 3 = $16 + 6 = 22$ , i.e. /22. Why this step? The cut sits just left of the 2 varying bits — that's the network boundary the aggregate route uses.

Step 4 — The aggregate. Network = lowest block with those low bits zeroed = 192.168.4.0/22. This single route covers 192.168.4.0–192.168.7.255. Why this step? One route replaces four → smaller routing table (see Routing Tables and Longest Prefix Match).

Verify: A /22 spans $2^{32 - 22} = 2^{10} = 1024$ addresses = four /24 blocks ( $4 \times 256 = 1024$ ) ✓. And 4,5,6,7 must be contiguous and aligned on a multiple of 4 — the block starts at 4, and $4 mod 4 = 0$ ✓ (you could not aggregate 5,6,7,8 into one /22, because 5 is not a multiple of 4).

Example 7 — Real-world word problem, VLSM (cell C7)

Worked example A campus has 3 departments needing

100, 50, and 25 hosts respectively, all carved from 172.16.8.0/24. Assign each a subnet using variable-length masks (VLSM), largest first, with no waste beyond necessity. Forecast: For each requirement, find the smallest prefix whose usable count is big enough. Then place them back-to-back so blocks don't overlap.

Step 1 — Sort largest → smallest and size each.

100 hosts: need $2^{h} - 2 \geq 100 \Rightarrow 2^{h} \geq 102 \Rightarrow h = 7$ ( $2^{7} = 128$ ) → /25, block 128.
50 hosts: $2^{h} \geq 52 \Rightarrow h = 6$ ( $64$ ) → /26, block 64.
25 hosts: $2^{h} \geq 27 \Rightarrow h = 5$ ( $32$ ) → /27, block 32. Why this step? Sizing largest-first prevents a big block from being stranded after small ones fragment the space.

Step 2 — Lay them out from .0, each starting on its own block boundary.

Dept A (/25): 172.16.8.0/25 → .0–.127 (usable .1–.126).
Dept B (/26): next free = .128 → 172.16.8.128/26 → .128–.191 (usable .129–.190).
Dept C (/27): next free = .192 → 172.16.8.192/27 → .192–.223 (usable .193–.222). Why this step? Each subnet's network address must be a multiple of its own block size; placing them in decreasing size keeps every start aligned.

Step 3 — Check capacity vs requirement. A: 126 ≥ 100 ✓; B: 62 ≥ 50 ✓; C: 30 ≥ 25 ✓. Why this step? Confirms each department fits with a little headroom.

Verify: Consumed = $128 + 64 + 32 = 224$ of 256 addresses; .224–.255 (32 addresses = a spare /27) remain free ✓. No block overlaps: A ends at 127, B starts at 128, B ends at 191, C starts at 192 ✓.

Example 8 — Exam twist: "Is this a valid host?" (cells C8, C5)

Worked example True or false, with reason: In network

192.0.2.128/26, the address 192.0.2.191 can be assigned to a laptop. Forecast: Find the subnet's broadcast. If .191 equals it, the answer is false.

Step 1 — Block size and range. /26 → $h = 32 - 26 = 6$ , block $= 2^{(8 - (26 mod 8))} = 2^{6} = 64$ . .128 is a valid boundary ( $128 = 2 \times 64$ ). So this subnet spans .128–.191. Why this step? We need the subnet's endpoints to test membership and to locate the reserved slots.

Step 2 — Identify reserved addresses. Network = .128 (all host bits 0), broadcast = .128 + 63 = .191 (all host bits 1). Why this step? These two can never be assigned — the classic off-by-one trap.

Step 3 — Verdict. .191 is the broadcast address of this subnet ⇒ it cannot be assigned to a laptop. So the statement is False. Why this step? Directly applies the " $- 2$ " rule: the usable range is only .129–.190, and .191 sits just outside it.

Verify: Usable count = $2^{6} - 2 = 62$ , and .190 − .129 + 1 = 62 ✓. .191 sits outside [129, 190] → not a usable host ✓, confirming the answer False.

Recall Cover-and-recall: the whole matrix in one breath

Mid-octet prefix → find block size $2^{(8 - (n mod 8))}$ , network = largest multiple ≤ host octet. ::: Ex 1, 3 Octet-boundary prefix → no block hunting, just zero/255 the host octets. ::: Ex 2 Need N subnets → smallest $s$ with $2^{s} \geq N$ ; new prefix $= n + s$ . ::: Ex 4 /31 special rule → 2 usable, no net/broadcast reserved (RFC 3021). ::: Ex 5 Aggregate 4 contiguous aligned /24s → one /22. ::: Ex 6 VLSM word problem → size largest-first, align each on its block. ::: Ex 7 "Valid host?" → fails if it's the network or broadcast address. ::: Ex 8

See also: Subnet Mask and ANDing (how a router extracts the network part), NAT — Network Address Translation (how private ranges reach the Internet), DHCP and APIPA (who hands out these addresses), IPv6 — addressing and notation (what happens when 32 bits run out).