Subnetting — subnet mask, network - host bits, VLSM: Worked examples

Look at the ruler below: the purple cells to the left of the heavy line are network bits, the coral cells to the right are host bits, and the black line is the mask's dividing line — here drawn at /26. Everything on this page is about where that line falls and where your address lands between two tick marks.

Figure — Subnetting — subnet mask, network - host bits, VLSM

Three more words we reuse constantly — earn them once too:

The scenario matrix

Every subnetting question is one (or a combination) of these cells. Each example below is titled with its cell and its Ex-number so the table and the worked drills line up exactly.

#	Case class	What makes it tricky	Example
C1	Mask cuts the 4th octet	classic, block size in last octet	Ex 1
C2	Mask cuts the 3rd octet	interesting octet is not the last one	Ex 2
C3	Mask cuts the 2nd octet	interesting octet far left, big blocks	Ex 3
C4	Degenerate `/31`	point-to-point, the $- 2$ rule breaks	Ex 4
C5	Degenerate `/32`	a single host, zero host bits	Ex 5
C6	`/0` limiting case	the whole internet, no network bits fixed	Ex 6
C7	Reverse question — given host counts, find the prefix	design direction	Ex 7
C8	Full VLSM allocation, largest-first	many subnets, alignment	Ex 8
C9	Real-world word problem	translate English → numbers	Ex 9
C10	Exam twist — "is host X on the same subnet as host Y?"	apply AND, compare	Ex 10

Ex 1 · Cell C1 — Mask cuts the 4th octet (the classic)

Worked example Find the subnet, broadcast and host range of

10.20.30.77/28 Forecast: before reading on, guess the block size and which block .77 lands in. Write it down.

Step 1 — Host bits $h = 32 - n = 32 - 28 = 4$ . Why this step? The prefix /28 means $n = 28$ network bits; whatever is left of 32 is host bits, and host bits are what we count over.

Step 2 — Mask octet. 28 ones = 11111111.11111111.11111111.11110000, last octet 11110000. Its four set bits are $128 + 64 + 32 + 16 = 240$ . Mask $=$ 255.255.255.240. Why this step? We need the interesting octet's value to get the block size.

Step 3 — Block size $= 256 - 240 = 16$ . Why this step? Block size = spacing of subnet start-lines in the interesting (4th) octet, and $256 - mask octet = 256 - 240 = 16$ . Cross-check with the other formula: block size in the interesting octet also equals $2^{h} = 2^{4} = 16$ . Both routes give 16 — that agreement is your built-in safety net.

Step 4 — Boundaries in the 4th octet: $0, 16, 32, 48, 64, 80, \dots$ Why this step? Subnets start at every multiple of the block size.

Step 5 — Which block holds 77? $64 \leq 77 < 80$ , so subnet $=$ 10.20.30.64. Why this step? The host lives in the gap whose lower boundary it sits on or above.

Step 6 — Broadcast $=$ next boundary $- 1 = 80 - 1 = 79$ , i.e. 10.20.30.79. Why this step? Broadcast is the all-1s host pattern — the very last address before the next subnet begins.

Step 7 — Host range $=$ .65 to .78. Why this step? Everything strictly between network (.64) and broadcast (.79).

Verify: usable hosts should be $2^{4} - 2 = 14$ . Count .65 … .78 inclusive $= 78 - 65 + 1 = 14$ . ✓ Units check: all values are $0$ – $255$ , valid octets. ✓

The figure below draws exactly this: the tick marks are the boundaries $0, 16, 32, \dots$ , the mint band is the .64 subnet, and the coral dot is host .77 sitting inside it. Notice how the subnet is simply "the band the dot fell into", and the broadcast .79 is the tick just before the next band.

Ex 2 · Cell C2 — Mask cuts the 3rd octet

Worked example Find the subnet of

172.16.135.200/20 Forecast: the mask has $n = 20$ ones. Guess: which octet is the interesting one?

Step 1 — Lay the 20 ones across the octets. $8 + 8 + 4 = 20$ : first two octets full 255, third octet 11110000 $= 240$ , fourth 0. Mask $=$ 255.255.240.0. Why this step? We must find where the dividing line falls — it lands inside the 3rd octet, so the 3rd octet is interesting.

Step 2 — Host bits $h = 32 - n = 32 - 20 = 12$ . Why this step? Needed for the host-count check later.

Step 3 — Block size in the 3rd octet $= 256 - 240 = 16$ . Why this step? Same rule as before, but now applied to octet 3, not octet 4. The block spacing is $16$ in the third-octet position.

Step 4 — Boundaries in 3rd octet: $0, 16, 32, \dots, 128, 144, 160, \dots$ Step 5 — Which block holds the 3rd-octet value 135? $128 \leq 135 < 144$ , so 3rd octet of subnet $= 128$ ; 4th octet resets to $0$ . Subnet $=$ 172.16.128.0. Why this step? Everything to the right of the interesting octet (here octet 4) becomes $0$ in the network address.

Step 6 — Broadcast: next 3rd-octet boundary $- 1$ : next is $144$ , so subnet range ends at 172.16.143.255. Why this step? All host bits set to 1: the 3rd octet fills to $143$ (i.e. $144 - 1$ ) and the 4th octet fills to $255$ . Both octets to the right of the line max out.

Step 7 — Host range $=$ 172.16.128.1 to 172.16.143.254.

Verify: usable hosts $= 2^{12} - 2 = 4094$ . Count of addresses 172.16.128.0–172.16.143.255 $= 16 \times 256 = 4096$ , minus network and broadcast $= 4094$ . ✓

Ex 3 · Cell C3 — Mask cuts the 2nd octet (big blocks)

Worked example Find the subnet of

10.130.5.9/12 Forecast: /12 — which octet cut? How big is each subnet?

Step 1 — Spread 12 ones: $8 + 4 = 12$ : octet 1 full 255, octet 2 11110000 $= 240$ , octets 3–4 zero. Mask $=$ 255.240.0.0. Why this step? The line falls inside octet 2 → octet 2 is interesting.

Step 2 — Block size in octet 2 $= 256 - 240 = 16$ . Step 3 — Boundaries in octet 2: $0, 16, 32, 48, \dots, 128, 144, \dots$ Step 4 — Octet-2 value is 130. $128 \leq 130 < 144$ , so octet 2 of subnet $= 128$ ; octets 3,4 reset to $0$ . Subnet $=$ 10.128.0.0. Step 5 — Broadcast: octet 2 fills to $143$ , octets 3,4 to $255$ : 10.143.255.255.

Verify: host bits $h = 32 - n = 32 - 12 = 20$ , usable $= 2^{20} - 2 = 1, 048, 574$ . Address count $10.128.0.0$ – $10.143.255.255$ $= 16 \times 256 \times 256 = 1, 048, 576$ , minus 2 $= 1, 048, 574$ . ✓ This is why a /12 is enormous — huge organisations only.

The figure makes the scale visible: the ruler now spans the second octet ( $0$ – $256$ ), the tick spacing is still 16, and the butter band starting at 130's block ( $128$ ) is one subnet. Compare its width to the whole ruler to feel how huge a /12 is.

Ex 4 · Cell C4 — Degenerate: the `/31` point-to-point

Worked example What are the usable hosts of

192.0.2.4/31? Forecast: apply $2^{h} - 2$ . Does it give something sensible?

Step 1 — $h = 32 - n = 32 - 31 = 1$ . So $2^{1} - 2 = 0$ usable hosts. Why this step? Blindly applying the rule gives zero usable addresses — clearly useless for a link that needs two endpoints.

Step 2 — Recognise the special case (RFC 3021). On a /31 there is exactly one host bit, giving two addresses. To avoid wasting an entire block on every router-to-router link, the $- 2$ reservation is dropped: both addresses become usable hosts. Why this step? This is the one place the parent's $2^{h} - 2$ law is deliberately overridden. You must know it exists.

Step 3 — The two addresses: 192.0.2.4 and 192.0.2.5. Both are host endpoints; there is no separate network or broadcast address.

Verify: /31 gives $2^{1} = 2$ total addresses; special rule makes both usable. Contrast a /30 link: $2^{2} - 2 = 2$ usable but $4$ addresses total (2 wasted). So /31 saves 2 addresses per link. ✓

Ex 5 · Cell C5 — Degenerate: the `/32` single host

Ex 6 · Cell C6 — Limiting case: `/0`

Ex 7 · Cell C7 — Reverse question: hosts → prefix

Worked example A subnet must hold

300 hosts. What is the smallest prefix (largest mask) that fits? Forecast: guess the prefix before computing.

Step 1 — Solve $2^{h} - 2 \geq 300$ . Try $h = 8$ : $2^{8} - 2 = 254 < 300$ (too small). Try $h = 9$ : $2^{9} - 2 = 510 \geq 300$ ✓. Why this step? We want the smallest $h$ (fewest wasted addresses) that still satisfies the requirement — increase $h$ until the inequality holds.

Step 2 — Prefix $n = 32 - h = 32 - 9 = 23$ , i.e. /23. Here $n$ is the network-bit count from our legend; $n + h = 32$ is the zero-sum trade — more host bits means a shorter prefix. Why this step? Once $h$ is fixed by the host requirement, the prefix is forced by $n = 32 - h$ .

Step 3 — Sanity on waste. /23 gives 510 usable; we use 300; 210 spare. A /24 (254 usable) would not fit 300, so /23 is genuinely the tightest.

Verify: $2^{9} - 2 = 510 \geq 300$ and $2^{8} - 2 = 254 < 300$ . ✓

Ex 8 · Cell C8 — Full VLSM allocation, largest-first

Worked example From

192.168.4.0/24, size subnets for: LAN1 = 60 hosts, LAN2 = 28 hosts, LAN3 = 12 hosts, Link = 2 hosts. Forecast: in what order do we allocate, and where does each start?

Step 1 — Sort by size, largest first: 60, 28, 12, 2. Why this step? The golden rule — placing big blocks first keeps every block aligned to its own boundary, so later small blocks never straddle a big one's space.

Step 2 — LAN1 (60): need $2^{h} - 2 \geq 60 \Rightarrow h = 6$ ( $62 \geq 60$ ), prefix $n = 32 - 6 = /26$ , block size $64$ . Allocate 192.168.4.0/26, hosts .1–.62, broadcast .63. Why this step? Smallest $h$ that fits 60 (since $2^{5} - 2 = 30 < 60$ ).

Step 3 — LAN2 (28): $2^{5} - 2 = 30 \geq 28 \Rightarrow h = 5$ , /27, block $32$ . Next free address is .64. 192.168.4.64/27, hosts .65–.94, broadcast .95. Why this step? Start at the first address after LAN1's block, and $.64$ is a multiple of $32$ → aligned. ✓

Step 4 — LAN3 (12): $2^{4} - 2 = 14 \geq 12 \Rightarrow h = 4$ , /28, block $16$ . Next free .96. 192.168.4.96/28, hosts .97–.110, broadcast .111. Why this step? $.96$ is a multiple of $16$ → aligned.

Step 5 — Link (2): $2^{2} - 2 = 2 \Rightarrow h = 2$ , /30, block $4$ . Next free .112. 192.168.4.112/30, hosts .113–.114, broadcast .115.

Verify: no overlaps — block ends .63, .95, .111, .115 all $<$ next start. Total consumed $= 64 + 32 + 16 + 4 = 116$ addresses of the $256$ , leaving .116–.255 free for growth. ✓

The stacked bands below are these four subnets laid on the /24 ruler, largest-first, left to right. Each band's left edge lands exactly on a multiple of its own block size — that alignment is why largest-first works, and the grey band on the right is the leftover .116–.255.

Ex 9 · Cell C9 — Real-world word problem

Worked example "Our office got the block

198.51.100.0/24. We have 3 floors, each needs about 40 devices, plus a spare floor for later. Give each floor an equal subnet." Forecast: fixed (equal) subnetting this time. How many subnet bits to borrow?

Step 1 — Need $\geq 4$ subnets (3 floors + 1 spare). Borrow $b$ bits: $2^{b} \geq 4 \Rightarrow b = 2$ ( $2^{2} = 4$ ). Why this step? Borrowing $b$ host bits creates $2^{b}$ subnets; pick the smallest $b$ covering 4.

Step 2 — New prefix $n = 24 + b = 26$ , i.e. /26. Host bits $h = 32 - n = 6$ , usable $= 2^{6} - 2 = 62 \geq 40$ . ✓ Why this step? Each subnet must still hold 40 devices; 62 comfortably does.

Step 3 — Block size $= 256 - 192 = 64$ . The four subnets:

Floor 1: 198.51.100.0/26 (hosts .1–.62)
Floor 2: 198.51.100.64/26 (hosts .65–.126)
Floor 3: 198.51.100.128/26(hosts .129–.190)
Spare: 198.51.100.192/26(hosts .193–.254)

Verify: $4$ subnets $\times 62$ usable $= 248$ assignable; requirement $3 \times 40 = 120$ met with room. ✓

Ex 10 · Cell C10 — Exam twist: same subnet or not?

Worked example Under mask

/27, are 10.0.0.35 and 10.0.0.60 on the same subnet? Forecast: guess yes/no before doing the arithmetic.

Step 1 — Block size $= 256 - 224 = 32$ (/27 last octet 11100000 $= 128 + 64 + 32 = 224$ ). Why this step? We compare which 32-wide block each address falls into. Same block ⇒ same subnet.

Step 2 — Boundaries in the 4th octet: $0, 32, 64, 96, \dots$ Why this step? These are the subnet start-lines; every address belongs to exactly one gap between them.

Step 3 — Locate .35. $32 \leq 35 < 64$ → its subnet is 10.0.0.32. Why this step? .35 sits in the block whose lower boundary ( $32$ ) it exceeds but whose upper boundary ( $64$ ) it does not reach.

Step 4 — Locate .60. $32 \leq 60 < 64$ → its subnet is also 10.0.0.32. Why this step? Same block-finding logic applied to the second address. This shortcut is exactly the bitwise AND of address and mask (Bitwise AND OR) — it produces the network address without writing binary.

Step 5 — Compare the two subnet addresses. Both are 10.0.0.32. They are equal, so the two hosts are on the same subnet and can talk directly without a router. Why this step? "Same subnet?" is answered by "do the two network addresses match?" — nothing more.

Verify (via AND): $35 AND 224 = 32$ and $60 AND 224 = 32$ → equal → same subnet. ✓ Contrast 10.0.0.35 vs 10.0.0.70: $70 AND 224 = 64 \neq = 32$ → different subnets, so those two would need a router.

Recall Quick self-test

/28 block size in the 4th octet? ::: $256 - 240 = 16$ . Usable hosts on a /31 and why? ::: 2 — RFC 3021 drops the network/broadcast reservation for point-to-point links. Smallest prefix for 300 hosts? ::: /23 ( $2^{9} - 2 = 510$ ). Are 10.0.0.35 and 10.0.0.60 same subnet under /27? ::: Yes, both AND to 10.0.0.32. Interesting octet of /20? ::: The 3rd octet (mask 255.255.240.0). Relationship between $n$ and $h$ ? ::: $n + h = 32$ ; move the line right and $n$ grows while $h$ shrinks.

Connections

Parent: Subnetting — the laws these examples drill
IPv4 Addressing — the 32-bit ruler every example draws on
CIDR and Supernetting — the reverse of Ex 7/Ex 8: merging prefixes
Routing Tables and Longest Prefix Match — why Ex 5's /32 and Ex 6's /0 matter to routers
Default Gateway and ARP — Ex 10's "same subnet?" decides local vs remote delivery
Bitwise AND OR — the AND behind Ex 10's shortcut
Network and Broadcast Addresses — the two reserved patterns, and where they vanish (Ex 4)