You perform a bitwise AND of an IP address with its subnet mask. What does the result always represent, and why?
The broadcast address, because AND sets the host bits to 1.
The network address, because the mask's 0s force every host bit to 0.
The first usable host, because AND adds 1 to the address.
A random host on the subnet, because AND scrambles the host bits.
For the subnet 192.168.10.0/26 (block size 64), what are the first and last usable host addresses?
192.168.10.0 and 192.168.10.63
192.168.10.1 and 192.168.10.63
192.168.10.1 and 192.168.10.62
192.168.10.0 and 192.168.10.64
Why can neither the network address nor the broadcast address be assigned to a device's interface?
They are reserved: one names the subnet as a whole, the other reaches every host at once.
They are always in use by the DHCP server.
Their host bits are a mix of 0s and 1s, which devices reject.
They fall outside the subnet's contiguous block of addresses.
When a /24 is split into two /25 blocks, the broadcast of the first block is 192.168.0.127 and the network of the second is 192.168.0.128. What does this adjacency demonstrate?
The two blocks overlap and share address 192.168.0.128.
There is a gap of unused addresses between the two blocks.
The blocks butt up against each other with no gaps and no overlaps.
The second block reuses the broadcast address of the first.
A host is 10.0.5.130 with a /25 mask. Using the /25 block size of 128, which block does it fall in, and what is that block's broadcast address?
Block 10.0.5.0–127; broadcast 10.0.5.127
Block 10.0.5.128–255; broadcast 10.0.5.255
Block 10.0.5.130–255; broadcast 10.0.5.255
Block 10.0.5.128–254; broadcast 10.0.5.254
The Four Key Addresses
Key Points
- Every ordinary subnet is a contiguous block of addresses bounded by two reserved endpoints.
- The network address is the first address (all host bits 0), found by ANDing the IP with the mask; it names the subnet and cannot be assigned to a device.
- The broadcast address is the last address (all host bits 1); it reaches every host at once and cannot be assigned either.
- Usable hosts sit between them: first host = network + 1, last host = broadcast − 1.
- The block size shortcut (256 − mask value in the interesting octet) tells you how far apart consecutive blocks start.
Think of a subnet as a numbered street. The addresses run in an unbroken sequence from a first house number to a last house number. Four positions carry special meaning: the network address (the street name), the first and last usable hosts (the livable houses), and the broadcast address (the neighborhood loudspeaker).
The network address is defined by setting every host bit to 0. A host bit is any bit that falls after the prefix boundary — the bits not locked down by the mask. You compute it with a bitwise AND of the IP and the mask, which follows three rules:
| Operation | Result |
|---|
| 1 AND 1 | 1 |
| 1 AND 0 | 0 |
| 0 AND 0 | 0 |
Because the mask has 0s in every host position, ANDing forces all host bits to 0 — exactly the definition of the network address. The broadcast address is the mirror image: take the network address and set every host bit to 1. A handy mnemonic: network = "all host bits low," broadcast = "all host bits high," usable hosts = everything in between.
graph LR
A["Network address
(first, host bits all 0)"] --> B["First usable host
(network + 1)"]
B --> C["...usable host range...
(assignable to devices)"]
C --> D["Last usable host
(broadcast - 1)"]
D --> E["Broadcast address
(last, host bits all 1)"]
The Binary Procedure, Step by Step
The same procedure produces all four addresses: convert the IP and mask to binary, line up the 32 bits, AND them for the network address, set all host bits to 1 for the broadcast, then add and subtract 1 for the host range.
flowchart TD
A["Convert IP and mask to binary"] --> B["Line up 32 address bits
against 32 mask bits"]
B --> C["Bitwise AND address and mask
(forces host bits to 0)"]
C --> D["Network address"]
D --> E["Set all host bits to 1"]
E --> F["Broadcast address"]
D --> G["Network + 1 = First host"]
F --> H["Broadcast - 1 = Last host"]
Visual animation — coming soon
Worked Example: 192.168.10.5 /24
A /24 mask (255.255.255.0) locks the first 24 bits and leaves 8 host bits:
| Row | Binary | Decimal |
|---|
| IP | 11000000.10101000.00001010.00000101 | 192.168.10.5 |
| Mask | 11111111.11111111.11111111.00000000 | 255.255.255.0 |
| Network | 11000000.10101000.00001010.00000000 | 192.168.10.0 |
| Broadcast | 11000000.10101000.00001010.11111111 | 192.168.10.255 |
| Role | Address | How it was found |
|---|
| Network address | 192.168.10.0 | All 8 host bits set to 0 |
| First usable host | 192.168.10.1 | Network + 1 |
| Last usable host | 192.168.10.254 | Broadcast − 1 |
| Broadcast address | 192.168.10.255 | All 8 host bits set to 1 |
Worked Example: 192.168.10.0 /26
A /26 leaves 6 host bits. The block size shortcut is 256 − the mask value in the interesting octet. A /26 mask is 255.255.255.192, so the block size is 256 − 192 = 64. Addresses advance in jumps of 64, and the first block is 0–63.
graph LR
A["Network
192.168.10.0"] --> B["First host
192.168.10.1"]
B --> C["...62 usable hosts...
block size 64"]
C --> D["Last host
192.168.10.62"]
D --> E["Broadcast
192.168.10.63"]
Worked Example: Splitting 192.168.0.0 /24 into Two /25s
A /25 has a block size of 256 − 128 = 128, so a /24 divides cleanly into two /25 blocks:
| Subnet | Network | First host | Last host | Broadcast | Usable |
|---|
| /25 #1 | 192.168.0.0 | 192.168.0.1 | 192.168.0.126 | 192.168.0.127 | 126 |
| /25 #2 | 192.168.0.128 | 192.168.0.129 | 192.168.0.254 | 192.168.0.255 | 126 |
Notice how the broadcast of the first block (…127) sits directly below the network address of the second (…128) — the blocks butt up against each other with no gaps and no overlaps.
You perform a bitwise AND of an IP address with its subnet mask. What does the result always represent, and why?
The broadcast address, because AND sets the host bits to 1.
The network address, because the mask's 0s force every host bit to 0.
The first usable host, because AND adds 1 to the address.
A random host on the subnet, because AND scrambles the host bits.
For the subnet 192.168.10.0/26 (block size 64), what are the first and last usable host addresses?
192.168.10.0 and 192.168.10.63
192.168.10.1 and 192.168.10.63
192.168.10.1 and 192.168.10.62
192.168.10.0 and 192.168.10.64
Why can neither the network address nor the broadcast address be assigned to a device's interface?
They are reserved: one names the subnet as a whole, the other reaches every host at once.
They are always in use by the DHCP server.
Their host bits are a mix of 0s and 1s, which devices reject.
They fall outside the subnet's contiguous block of addresses.
When a /24 is split into two /25 blocks, the broadcast of the first block is 192.168.0.127 and the network of the second is 192.168.0.128. What does this adjacency demonstrate?
The two blocks overlap and share address 192.168.0.128.
There is a gap of unused addresses between the two blocks.
The blocks butt up against each other with no gaps and no overlaps.
The second block reuses the broadcast address of the first.
A host is 10.0.5.130 with a /25 mask. Using the /25 block size of 128, which block does it fall in, and what is that block's broadcast address?
Block 10.0.5.0–127; broadcast 10.0.5.127
Block 10.0.5.128–255; broadcast 10.0.5.255
Block 10.0.5.130–255; broadcast 10.0.5.255
Block 10.0.5.128–254; broadcast 10.0.5.254
A subnet has 5 host bits. How many usable host addresses does it provide, and why is it not just 2^5?
32, because every one of the 2^5 addresses can be assigned.
30, because the network and broadcast addresses are reserved and subtracted.
31, because only the broadcast address is subtracted.
16, because host counts are always half of the total addresses.
An engineer needs a subnet that supports at least 100 usable hosts. What is the smallest prefix (largest number after the slash) that works?
/24, which gives 254 usable hosts.
/25, which gives 126 usable hosts.
/26, which gives 62 usable hosts.
/23, which gives 510 usable hosts.
Applying 2^h − 2 to a /31 gives 0 usable hosts. How does RFC 3021 resolve this for point-to-point links?
It reserves a third address elsewhere to act as the broadcast.
It forbids /31 subnets entirely, so a /30 must always be used.
Since a point-to-point link needs no broadcast, both addresses become usable hosts — 2 total.
It borrows one host from the adjacent subnet to reach a count of 2.
Why is a /32 used as a host route or loopback rather than as a link between two devices?
It contains exactly one address, and a link needs two endpoints.
It contains four addresses, all reserved for routing protocols.
Its broadcast address conflicts with the network address.
The 2^h − 2 formula gives it 2 hosts, too few for a link.
Choosing a /31 instead of a /30 for a router-to-router link changes address consumption how, and why does it matter at WAN scale?
It uses 2 addresses instead of 4 — a 50% saving that compounds across many links.
It uses 4 addresses instead of 2, doubling consumption but adding reliability.
It uses the same number of addresses, but is faster to configure.
It uses 1 address instead of 4, but only works on loopback interfaces.
Counting Hosts
Key Points
- Total addresses = 2^h, where h = 32 − prefix length; this count includes the network and broadcast addresses.
- Usable hosts = 2^h − 2, because the network address (all host bits 0) and broadcast address (all host bits 1) are reserved.
- A /30 gives 2 usable hosts — the classic point-to-point link size under the normal formula.
- A /31 overrides the 0 result via RFC 3021: no broadcast is needed on a point-to-point link, so both addresses become usable (2 hosts, 50% saving vs. /30).
- A /32 is a single address (host route or loopback); the −2 rule does not apply.
Each host bit can be 0 or 1, and with h independent bits there are 2^h possible combinations — hence 2^h total addresses. Two of those addresses are always reserved: the first (all host bits 0) is the network address, and the last (all host bits 1) is the broadcast address. Neither belongs to an individual host, so both are subtracted, giving usable hosts = 2^h − 2.
flowchart TD
A["Prefix length (e.g. /26)"] --> B["h = 32 - prefix
(host bits)"]
B --> C["Total addresses = 2^h"]
C --> D["Subtract network address
(all host bits 0)"]
D --> E["Subtract broadcast address
(all host bits 1)"]
E --> F["Usable hosts = 2^h - 2"]
Host-Count Reference Table
This table appears constantly in real work and on exams and is worth memorizing:
| Prefix | Subnet Mask | Host Bits (h) | Total (2^h) | Usable (2^h − 2) |
|---|
| /24 | 255.255.255.0 | 8 | 256 | 254 |
| /25 | 255.255.255.128 | 7 | 128 | 126 |
| /26 | 255.255.255.192 | 6 | 64 | 62 |
| /27 | 255.255.255.224 | 5 | 32 | 30 |
| /28 | 255.255.255.240 | 4 | 16 | 14 |
| /29 | 255.255.255.248 | 3 | 8 | 6 |
| /30 | 255.255.255.252 | 2 | 4 | 2 |
A crucial rule of thumb: subtract 2 when counting hosts, but never subtract 2 when counting subnets — the next section explains why.
The /31 and /32 Exceptions
The 2^h − 2 formula breaks down at the two smallest prefixes. A /31 has only 2 total addresses; 2^1 − 2 = 0, which would make the subnet useless. RFC 3021 solves this by allowing both addresses to be assigned as host addresses on point-to-point links: a link has exactly one neighbor at each end, so no broadcast is needed — and if nothing must be reserved for broadcast, both addresses are usable. The payoff is a 50% saving versus a /30 (2 addresses per link instead of 4), which adds up across the many router-to-router links in a large WAN.
A /32 uses a full 32-bit mask (255.255.255.255) and defines exactly one address. A single address cannot form a link, so a /32 is used as a host route — for loopback interfaces, specific server or router addresses, and targeted firewall or routing rules.
| Prefix | Total addresses | Usable | Formula status | Typical use |
|---|
| /30 | 4 | 2 | 2^h − 2 applies normally | Traditional point-to-point link |
| /31 | 2 | 2 | Overrides 0 result (RFC 3021) | Modern point-to-point link |
| /32 | 1 | 1 | −2 does not apply | Host route / loopback |
A subnet has 5 host bits. How many usable host addresses does it provide, and why is it not just 2^5?
32, because every one of the 2^5 addresses can be assigned.
30, because the network and broadcast addresses are reserved and subtracted.
31, because only the broadcast address is subtracted.
16, because host counts are always half of the total addresses.
An engineer needs a subnet that supports at least 100 usable hosts. What is the smallest prefix (largest number after the slash) that works?
/24, which gives 254 usable hosts.
/25, which gives 126 usable hosts.
/26, which gives 62 usable hosts.
/23, which gives 510 usable hosts.
Applying 2^h − 2 to a /31 gives 0 usable hosts. How does RFC 3021 resolve this for point-to-point links?
It reserves a third address elsewhere to act as the broadcast.
It forbids /31 subnets entirely, so a /30 must always be used.
Since a point-to-point link needs no broadcast, both addresses become usable hosts — 2 total.
It borrows one host from the adjacent subnet to reach a count of 2.
Why is a /32 used as a host route or loopback rather than as a link between two devices?
It contains exactly one address, and a link needs two endpoints.
It contains four addresses, all reserved for routing protocols.
Its broadcast address conflicts with the network address.
The 2^h − 2 formula gives it 2 hosts, too few for a link.
Choosing a /31 instead of a /30 for a router-to-router link changes address consumption how, and why does it matter at WAN scale?
It uses 2 addresses instead of 4 — a 50% saving that compounds across many links.
It uses 4 addresses instead of 2, doubling consumption but adding reliability.
It uses the same number of addresses, but is faster to configure.
It uses 1 address instead of 4, but only works on loopback interfaces.
You borrow 3 bits from the host portion. How many subnets does this create, and what is the formula?
6 subnets, using 2^s − 2.
8 subnets, using 2^s (no subtraction).
3 subnets, one per borrowed bit.
16 subnets, using 2^(s+1).
Why do you subtract 2 when counting usable hosts but not when counting subnets?
Subnets are always fewer than hosts, so the subtraction is unnecessary.
There is no "network subnet" or "broadcast subnet" to reserve; all 2^s subnets are usable.
Modern equipment reserves 2 subnets for routing, so you actually should subtract.
The subtraction only applies to IPv6, not IPv4 subnetting.
Borrowing bits from the host portion has what effect on the number of hosts per subnet, and why?
More hosts per subnet, because the network grows larger.
No change, because subnets and hosts are counted independently.
Fewer hosts per subnet, because the 32-bit boundary is fixed and host bits are given up.
More hosts per subnet, because borrowed bits are returned to the host side.
Starting from a /24 and borrowing 4 bits, what prefix, subnet count, and usable-host-per-subnet count result?
/28, 16 subnets, 14 usable hosts each.
/28, 14 subnets, 16 usable hosts each.
/20, 16 subnets, 4094 usable hosts each.
/26, 4 subnets, 62 usable hosts each.
The subnet-vs-host trade-off is described as a "see-saw." What does this metaphor capture about subnet design?
Subnet count and hosts-per-subnet rise and fall together as the prefix changes.
Because the 32-bit boundary is fixed, gaining subnets means losing hosts per subnet, and vice versa.
Adding more bits keeps both subnets and hosts constant, balancing the network.
The address space itself grows and shrinks depending on the prefix chosen.
Counting Subnets
Key Points
- To create more subnets you borrow bits from the host portion, lengthening the prefix (moving the boundary right).
- Subnets = 2^s, where s = number of borrowed bits — with no "− 2" (no network or broadcast subnet to reserve).
- The 32-bit boundary is fixed, so every bit borrowed for subnets is a bit lost to hosts.
- More subnets always means fewer hosts per subnet — the central see-saw of subnet design.
- Choosing a prefix means balancing the subnets you need against the hosts each must hold; this is the foundation of VLSM.
So far we have looked inside one subnet. Now we zoom out: if we carve a larger block into smaller pieces, how many pieces do we get? To create more subnets, you take bits from the host portion and reassign them to the network portion — these are borrowed bits. Going from a /24 to a /26 borrows 2 bits, moving the boundary two positions to the right.
graph TD
subgraph After["/26 — 2 bits borrowed"]
C["Network portion
26 bits"]
D["Host portion
6 bits (4 subnets, 62 hosts each)"]
end
subgraph Before["/24 — starting point"]
A["Network portion
24 bits"]
B["Host portion
8 bits (1 subnet, 254 hosts)"]
end
Before --> After
The number of subnets created by borrowing s bits is 2^s. Note the deliberate absence of a "− 2": unlike host counting, subnet counting does not subtract two, because there is no network subnet or broadcast subnet to reserve. Borrowing 2 bits from a /24 yields 2^2 = 4 subnets — the 0–63, 64–127, 128–191, and 192–255 ranges.
Visual animation — coming soon
The Subnet-vs-Host Trade-off
Because the 32-bit ruler is fixed, every bit borrowed for subnets is a bit lost to hosts. The table below shows the trade-off as we borrow increasing numbers of bits from a starting /24:
| Prefix | Borrowed bits (s) | Subnets (2^s) | Host bits (h) | Usable hosts each (2^h − 2) |
|---|
| /24 | 0 | 1 | 8 | 254 |
| /25 | 1 | 2 | 7 | 126 |
| /26 | 2 | 4 | 6 | 62 |
| /27 | 3 | 8 | 5 | 30 |
| /28 | 4 | 16 | 4 | 14 |
| /29 | 5 | 32 | 3 | 6 |
| /30 | 6 | 64 | 2 | 2 |
Read down the "Subnets" column and up the "Usable hosts" column and you see the see-saw clearly: as one rises, the other falls. Choosing a prefix is choosing a point on this see-saw — enough subnets to cover your segments, while leaving each subnet large enough for its devices. This trade-off is the foundation for Variable Length Subnet Masking (VLSM), covered in later chapters, where each segment gets a prefix sized to its actual needs.
You borrow 3 bits from the host portion. How many subnets does this create, and what is the formula?
6 subnets, using 2^s − 2.
8 subnets, using 2^s (no subtraction).
3 subnets, one per borrowed bit.
16 subnets, using 2^(s+1).
Why do you subtract 2 when counting usable hosts but not when counting subnets?
Subnets are always fewer than hosts, so the subtraction is unnecessary.
There is no "network subnet" or "broadcast subnet" to reserve; all 2^s subnets are usable.
Modern equipment reserves 2 subnets for routing, so you actually should subtract.
The subtraction only applies to IPv6, not IPv4 subnetting.
Borrowing bits from the host portion has what effect on the number of hosts per subnet, and why?
More hosts per subnet, because the network grows larger.
No change, because subnets and hosts are counted independently.
Fewer hosts per subnet, because the 32-bit boundary is fixed and host bits are given up.
More hosts per subnet, because borrowed bits are returned to the host side.
Starting from a /24 and borrowing 4 bits, what prefix, subnet count, and usable-host-per-subnet count result?
/28, 16 subnets, 14 usable hosts each.
/28, 14 subnets, 16 usable hosts each.
/20, 16 subnets, 4094 usable hosts each.
/26, 4 subnets, 62 usable hosts each.
The subnet-vs-host trade-off is described as a "see-saw." What does this metaphor capture about subnet design?
Subnet count and hosts-per-subnet rise and fall together as the prefix changes.
Because the 32-bit boundary is fixed, gaining subnets means losing hosts per subnet, and vice versa.
Adding more bits keeps both subnets and hosts constant, balancing the network.
The address space itself grows and shrinks depending on the prefix chosen.