Exercises — Subnetting — subnet mask, network - host bits, VLSM
Two number lines drive the whole page — keep them in mind:

Level 1 — Recognition
Can you read a mask and translate between its three faces (prefix, decimal, binary)?
L1.1 — Prefix → host bits and host count
Given the prefix /28, state (a) the number of host bits, (b) the number of usable hosts.
Recall Solution L1.1
(a) Host bits . Why? The prefix eats the network side; whatever is left is the host side, and always. (b) Usable hosts . Why ? The all-0 host pattern is the network address (the nameplate) and the all-1 host pattern is the broadcast address (the loudspeaker). Neither is assignable to a machine. Answers: 4 host bits, 14 usable hosts.
L1.2 — Prefix → dotted-decimal mask
Write the subnet mask for /28 in dotted-decimal.
Recall Solution L1.2
means 28 ones, then zeros:
11111111.11111111.11111111.11110000.
The first three octets are all ones each. The last octet is 11110000. Why is that 240? Sum the place-values of the ones: .
Answer: 255.255.255.240.
L1.3 — Mask octet → block size
The interesting (last non-255) mask octet is 240. What is the block size?
Recall Solution L1.3
Block size . Why? Block size is how far apart consecutive subnet start-addresses sit inside that octet, and it equals . Look at the top number line in the figure: the ticks land at 0, 16, 32, ... exactly 16 apart. Answer: 16.
Level 2 — Application
Can you run the full subnet drill: block size → boundaries → subnet → broadcast → range?
L2.1 — Locate the subnet
Given 10.0.5.77/27, find the subnet (network) address.
Recall Solution L2.1
Step 1 — Interesting octet & block size. mask 255.255.255.224 (last octet 11100000 ). Block size .
Step 2 — Boundaries in the 4th octet: (multiples of 32).
Step 3 — Which block holds 77? , so the subnet is 10.0.5.64. Look at the middle number line in the figure: 77's red dot sits inside the [64, 96) band.
Answer: 10.0.5.64/27.
L2.2 — Broadcast and host range
For the same 10.0.5.77/27, give the broadcast address and the usable host range.
Recall Solution L2.2
Broadcast = next boundary − 1. Next boundary after 64 is , so broadcast 10.0.5.95. Why? Broadcast is the all-1s host pattern — the very last address before the next subnet begins.
Host range = strictly between network and broadcast .65 to .94 10.0.5.65 – 10.0.5.94.
Sanity check: usable count . ✓ (host bits ).
Answers: broadcast 10.0.5.95, hosts 10.0.5.65–10.0.5.94.
L2.3 — Count subnets from borrowed bits
You take a /24 block and subnet it into /29 pieces. How many subnets, and how many usable hosts in each?
Recall Solution L2.3
Borrowed bits . Number of subnets . Why? Each borrowed bit doubles the number of distinct subnet labels; 5 bits give patterns. Host bits , so usable hosts per subnet. Answers: 32 subnets, 6 usable hosts each.
Level 3 — Analysis
Can you reason backwards, compare, and audit a claim for correctness?
L3.1 — Reverse-engineer the prefix
A subnet has network address 172.16.8.0 and broadcast 172.16.8.63. What is its prefix?
Recall Solution L3.1
Block size broadcast − network . Why ? We are counting addresses inclusive of both endpoints.
Block size host bits. Therefore .
Answer: /26 (mask 255.255.255.192, since ).
L3.2 — Do two hosts share a subnet?
Under mask /28, are 192.168.0.20 and 192.168.0.35 on the same subnet?
Recall Solution L3.2
block size . Boundaries:
.20falls in → subnet192.168.0.16..35falls in → subnet192.168.0.32. Different subnets ⇒ NO, they are not on the same subnet. A router (not a direct link) is needed between them. See the bottom number line in the figure: the two red dots straddle the boundary at 32. Answer: No —.20is in.16,.35is in.32.
L3.3 — Audit a wrong claim
A classmate says: "255.255.255.192 gives 192 usable hosts." Is this correct? If not, what is the true number and where did they go wrong?
Recall Solution L3.3
Incorrect. 255.255.255.192 is /26 (last octet 11000000, two 1-bits prefix ). Host bits , usable .
The mistake: they read the mask octet 192 as a host count. But 192 describes where the dividing line is, not how many hosts fit. The host count depends only on how many host bits exist.
Answer: 62 usable hosts, not 192.
Level 4 — Synthesis
Can you design a complete, conflict-free VLSM plan from raw requirements?
L4.1 — Full VLSM design
From 192.168.100.0/24, allocate for: Sales = 60 hosts, Eng = 28 hosts, Ops = 12 hosts, Link1 = 2 hosts (router-to-router). Give each subnet's network address, prefix, and host range. Allocate largest-first.
Recall Solution L4.1
Golden rule: biggest subnet first, so each block lands on its own size boundary and nothing overlaps.
Sales (60 hosts). Need . ✓, ✗. So , prefix , block size 64.
→ 192.168.100.0/26, hosts .1–.62, broadcast .63.
Eng (28 hosts). ✓, ✗. So , prefix , block size 32. Next free address is .64.
→ 192.168.100.64/27, hosts .65–.94, broadcast .95.
Ops (12 hosts). ✓, ✗. So , prefix , block size 16. Next free address is .96.
→ 192.168.100.96/28, hosts .97–.110, broadcast .111.
Link1 (2 hosts). ✓. So , prefix , block size 4. Next free address is .112.
→ 192.168.100.112/30, hosts .113–.114, broadcast .115.
No overlaps, everything aligned — each block starts at a multiple of its own size (0, 64, 96, 112). Plenty of /24 space remains beyond .116.
Answers: Sales .0/26, Eng .64/27, Ops .96/28, Link1 .112/30.
L4.2 — Two point-to-point links from a leftover /29
You have 10.1.1.8/29 free and need two separate router-to-router links (2 hosts each). Split it and give both subnets fully.
Recall Solution L4.2
A /29 has , so addresses (.8–.15). Each link needs /30 (block size 4). Borrowing bit gives subnets — exactly what we need.
10.1.1.8/30: network.8, hosts.9–.10, broadcast.11.10.1.1.12/30: network.12, hosts.13–.14, broadcast.15. Answers: Link A10.1.1.8/30(.9–.10), Link B10.1.1.12/30(.13–.14).
Level 5 — Mastery
Can you survive the degenerate and edge cases that break naive formulas?
L5.1 — The /31 special case
How many usable hosts does a /31 subnet have under the classic rule, and why is this prefix used anyway for point-to-point links?
Recall Solution L5.1
, so by the classic rule — zero usable hosts. That looks useless!
But on a point-to-point link there is no broadcast to send (only one other endpoint), so RFC 3021 lets a /31 use both addresses as the two hosts. It gives you 2 usable addresses on exactly the links where you don't need a broadcast. This is a documented exception to , not a violation of it — the subtraction assumes a broadcast is needed, and here it isn't.
Answers: 0 by the classic formula; 2 usable in practice on point-to-point links (RFC 3021).
L5.2 — The /32 host route
What does /32 describe, and how many usable hosts does the classic formula give?
Recall Solution L5.2
, so . A negative host count is the formula screaming "this is not a normal subnet."
A /32 has no host bits — it names one single exact address (a host route). It is used in routing tables to point at exactly one machine, and as a loopback address. There is no network/broadcast split because there is nothing to split.
Answer: /32 = a single host address; the formula gives , signalling a degenerate (host-route) case, not a usable subnet.
L5.3 — Which subnet, when the interesting octet isn't the last?
Find the subnet of 172.20.130.5/20.
Recall Solution L5.3
means 20 network bits. The mask is 11111111.11111111.11110000.00000000 255.255.240.0. The interesting octet is the 3rd, not the 4th — because that's where the ones run out.
Block size in the 3rd octet . Boundaries in octet 3:
The address's 3rd octet is 130. Which block? , so octet 3 rounds down to 128, and the 4th octet is 0.
Subnet = 172.20.128.0/20. Broadcast = next boundary − 1 in octet 3 = .143.255 → 172.20.143.255. Host range 172.20.128.1 – 172.20.143.254.
Answer: subnet 172.20.128.0/20, broadcast 172.20.143.255.
Connections
- IPv4 Addressing — the 32-bit canvas every exercise operates on
- Network and Broadcast Addresses — the two reserved patterns behind the
- Bitwise AND OR — the AND that turns address + mask into a subnet
- CIDR and Supernetting — same prefix arithmetic, run in reverse
- Routing Tables and Longest Prefix Match — where
/32host routes and/30links live - Default Gateway and ARP — how a host uses the mask (L3.2) to decide local vs remote