IPv4 subnetting cheat sheet for the CCNA

By Ata Tunc Bilge · Published 1 October 2026

Everything you need to subnet IPv4 addresses for the CCNA 200-301 exam, on one page: mask tables from /16 to /32, the magic number method with three worked examples, wildcard masks, a VLSM example and the reference ranges worth memorizing. Every number on this page was checked with a script.

The formulas

• An IPv4 address has 32 bits. The prefix length /n is the number of network bits; the remaining h = 32 − n bits are host bits.
• Usable hosts per subnet = 2^h − 2, because the first address is the network address and the last is the broadcast address. The exceptions are /31 and /32 (see the table).
• Subnets created by borrowing s bits = 2^s. For example, splitting a /24 into /27s borrows 3 bits and gives 8 subnets.
• Block size, or magic number = 256 − the mask value in the interesting octet.

Mask table: /24 to /32

• /31: no network or broadcast address. Both addresses are usable on point-to-point links, as defined in RFC 3021, which saves addresses on router-to-router links.
• /32: a single address. Used for host routes and for loopback interfaces.

Mask table: /16 to /23

The one row to memorize

Every mask octet is one of these values. The block size is 256 minus the mask value.

The magic number method

1. Find the interesting octet: the octet where the mask is neither 255 nor 0.
2. Magic number (block size) = 256 − the mask value in that octet.
3. Network address: in the interesting octet, take the largest multiple of the magic number that is less than or equal to the address's value. Set every octet to the right to 0.
4. Next network: network value + magic number in the interesting octet. The broadcast address is one less than the next network (octets to the right become 255).
5. First host = network + 1. Last host = broadcast − 1.
6. Usable hosts = 2^h − 2.

Worked example 1: 10.226.222.134/23

/23 means 23 network bits and 9 host bits. The mask is 255.255.254.0, so the interesting octet is the third one, with a mask value of 254.

1. Magic number: 256 − 254 = 2, counted in the third octet.
2. Network: the largest multiple of 2 that is less than or equal to 222 is 222, so the network is 10.226.222.0.
3. Next network: 222 + 2 = 224, so 10.226.224.0. The broadcast is one address less: 10.226.223.255.
4. First usable host: 10.226.222.1. Last usable host: 10.226.223.254.
5. Usable hosts: 2⁹ − 2 = 510.

This subnet spans two values of the third octet (222 and 223), so addresses such as 10.226.222.255 and 10.226.223.0 are ordinary host addresses inside it.

Worked example 2: 172.16.45.77/27

1. /27 gives a mask of 255.255.255.224. The interesting octet is the fourth (224); magic number 256 − 224 = 32.
2. Multiples of 32: 0, 32, 64, 96 … 64 ≤ 77 < 96, so the network is 172.16.45.64.
3. Next network: 172.16.45.96, so the broadcast is 172.16.45.95.
4. First usable host: 172.16.45.65. Last usable host: 172.16.45.94.
5. Usable hosts: 2⁵ − 2 = 30.

Worked example 3: 172.20.99.10/20

1. /20 gives a mask of 255.255.240.0. The interesting octet is the third (240); magic number 256 − 240 = 16.
2. Multiples of 16: … 80, 96, 112. 96 ≤ 99 < 112, so the network is 172.20.96.0.
3. Next network: 172.20.112.0, so the broadcast is 172.20.111.255.
4. First usable host: 172.20.96.1. Last usable host: 172.20.111.254.
5. Usable hosts: 2¹² − 2 = 4,094.

Wildcard masks

A wildcard mask is the inverse of a subnet mask: subtract each octet of the mask from 255. In a wildcard, a 0 bit means the address bit must match and a 1 bit means it is ignored. Cisco IOS uses wildcard masks in ACLs and in OSPF network statements.

! Match 192.168.10.64 to 192.168.10.127 (192.168.10.64/26)
access-list 10 permit 192.168.10.64 0.0.0.63

! Enable OSPF area 0 on interfaces in 10.1.1.0/24
router ospf 1
 network 10.1.1.0 0.0.0.255 area 0

Use the network address of the range in the statement. With 0.0.0.63 the last six bits are ignored, so 192.168.10.64 through 192.168.10.127 match.

VLSM example

VLSM (variable length subnet masking) means using different prefix lengths inside one block, so that each subnet is only as large as it needs to be. Allocate the largest subnets first so that each one starts on a boundary of its own block size.

Task: split 192.168.10.0/24 for LAN A (100 hosts), LAN B (50 hosts), LAN C (20 hosts) and two point-to-point WAN links.

Still free for growth: 192.168.10.232/29 (.232 to .239) and 192.168.10.240/28 (.240 to .255). If both routers support it, a /31 on each WAN link (RFC 3021) uses 2 addresses instead of 4.

Reference ranges

Common mistakes

• Forgetting the − 2: a /26 has 64 addresses but 62 usable hosts.
• Stepping by the mask value instead of the block size: the /27 mask octet is 224, but /27 subnets step by 32.
• Looking in the wrong octet: from /17 to /23 the interesting octet is the third, so the fourth octet runs through 0 to 255 inside one subnet.
• Treating a /31 like a /30: on point-to-point links a /31 has two usable addresses and no broadcast.
• Writing an ACL or OSPF statement with a host address and a wildcard that does not match the range you meant.

Practice

Speed comes from repetition. Do a few problems at a time, several days a week, and check each answer with the method above. Linkwing's Subnetting Gym generates unlimited drills on iPhone and works offline. For where subnetting fits into a full schedule, see the CCNA study plan.