IPv4 addressing and subnetting: masks, prefixes, private ranges and troubleshooting

Why this matters

Every IPv4 device needs three numbers to work: an address, a mask and a default gateway. A help-desk analyst moving into networking sees the results of getting one of them wrong every day. A PC can talk to the printer next to it but not to the internet. Two laptops on the same switch cannot ping each other. A new VLAN runs out of addresses in its first week. Each of these is a subnetting question in disguise.

Subnetting is also the skill a junior network engineer uses when planning: carving an address block into VLANs that are big enough but not wasteful, picking the right mask for a point-to-point link, and spotting an address that does not belong on an internal network. If you cannot work out a subnet's network and broadcast address in under a minute, troubleshooting stalls at the first step. This lesson gives you one method that works for every prefix, and the faults it finds.

The lesson

Finding and fixing IPv4 addressing faults, with public and private ranges

An IPv4 address is 32 bits, written as four decimal octets such as 172.16.45.200. The subnet mask says how many of those bits identify the network. The rest identify the host. You can write the mask in dotted decimal (255.255.255.192) or as a prefix length (/26), which is simply the count of 1 bits in the mask.

Inside any subnet, two addresses are reserved:

• The network address has all host bits set to 0. It names the subnet and cannot be given to a host.
• The broadcast address has all host bits set to 1. It reaches every host in the subnet and cannot be given to a host either.

Everything between them is a usable host address. The number of usable hosts is 2 to the power of the host bits, minus 2.

Masks, prefixes and the block size

Learn the eight values one octet of a mask can take. Each adds the next bit from the left:

The block size is 256 minus the mask value. Subnets start at multiples of the block size in the interesting octet, which is the octet where the mask stops being 255.

To turn a prefix into a mask, count off 8 bits per octet. A /20 is 8 + 8 + 4, so the first two octets are 255 and the third has 4 bits: 128 + 64 + 32 + 16 = 240. The mask is 255.255.240.0. Watch for look-alikes: 255.255.248.0 is a /21, and 255.255.255.240 is a /28.

Common prefixes and their sizes:

Worked example 1: a /26 in the last octet

A help-desk ticket shows a PC at 172.16.45.200/26. Which subnet is it in?

1. A /26 is 24 + 2, so the interesting octet is the fourth. Its mask value is 192.
2. Block size: 256 - 192 = 64. Subnets in the fourth octet start at 0, 64, 128 and 192.
3. The host value is 200. The highest block start that is not above 200 is 192.
4. Network: 172.16.45.192.
5. Broadcast: the next block would start at 256, so this one ends at 255: 172.16.45.255.
6. Usable range: 172.16.45.193 to 172.16.45.254, which is 62 hosts.

The same method gives the last usable host of any subnet. A camera at 192.168.77.70/28 sits in the /28 block of 16 that runs 64 to 79. The broadcast is 192.168.77.79, so the last usable address is 192.168.77.78.

Worked example 2: a /21 in the third octet

A server is configured as 10.44.19.130/21. What is its broadcast address?

1. A /21 is 16 + 5, so the interesting octet is the third. Five bits give a mask value of 248, so the mask is 255.255.248.0.
2. Block size: 256 - 248 = 8. Blocks in the third octet start at 0, 8, 16, 24 and so on.
3. The third octet is 19, which falls in the block 16 to 23.
4. Network: 10.44.16.0. The fourth octet is 0, because every bit there is a host bit.
5. Broadcast: the last value of the block in the third octet, with the fourth octet all ones: 10.44.23.255.
6. Usable range: 10.44.16.1 to 10.44.23.254.

When the mask stops in the third octet, an address ending in .0 or .255 can be a perfectly good host. In 172.16.8.0/22, the block covers third-octet values 8 to 11. The network is 172.16.8.0 and the broadcast is 172.16.11.255, but 172.16.10.0 and 172.16.9.255 are both ordinary usable addresses. Likewise, a wireless controller at 172.31.203.9/22 is in the block 200 to 203, so its subnet's first usable host is 172.31.200.1, not 172.31.203.1.

Worked example 3: sizing a subnet for a number of hosts

A branch VLAN must hold 100 hosts with as little waste as possible.

1. Find the smallest number of host bits h where 2^h - 2 is at least 100. 2^6 - 2 = 62 is too small. 2^7 - 2 = 126 is enough.
2. Seven host bits leave 32 - 7 = 25 network bits: a /25, mask 255.255.255.128.
3. A /24 would also fit, but it offers 254 hosts and wastes more than half of them.

For 500 hosts: 2^9 - 2 = 510 is the first value that fits, so 9 host bits, a /23, mask 255.255.254.0. A /22 also works but wastes about 500 addresses.

Worked example 4: splitting a block into a number of subnets

Split 192.168.50.0/24 into six equal subnets, each as large as possible.

1. Find the fewest borrowed bits n where 2^n is at least 6. Two bits give 4, too few. Three bits give 8.
2. Borrow 3 bits: /24 + 3 = /27, mask 255.255.255.224, block size 32.
3. The subnets are 192.168.50.0, .32, .64, .96, .128, .160, .192 and .224, each with 30 usable hosts. Six are used and two are spare.

Borrowing 4 bits would also give enough subnets, but each would be smaller than it needs to be.

Point-to-point links: /30 and /31

A link between two routers needs only two addresses. A /30 gives four: network, two usable, broadcast. For 10.0.0.8/30, the network is 10.0.0.8, R1 takes 10.0.0.9, R2 takes 10.0.0.10, and 10.0.0.11 is the broadcast. The next link starts at 10.0.0.12.

IOS also supports /31 on point-to-point links, where both addresses are usable because a two-device link does not need a broadcast address. You will see /30 more often in exam scenarios.

R1(config)#interface GigabitEthernet0/0/1
R1(config-if)#ip address 10.0.0.9 255.255.255.252
R1(config-if)#no shutdown

Public and private addresses

Public addresses are globally unique and routed on the internet. Private addresses, defined in RFC 1918, can be reused inside any organisation but are never routed on the internet. Traffic from them must be translated by NAT to reach the internet (lesson 19).

The middle one catches people. A /12 covers second-octet values 16 to 31 only. 172.20.10.5 and 172.31.250.4 are private; 172.15.8.1 and 172.32.10.5 are public. Likewise 192.169.10.5 is public, because only 192.168 is private.

Other special ranges that are not RFC 1918:

• 100.64.0.0/10 is shared address space for carrier-grade NAT, used between an internet provider and its customers.
• 169.254.0.0/16 is link-local. A host assigns itself an address here when it gets no reply from a DHCP server. Windows calls this APIPA.
• 127.0.0.0/8 is loopback, the host talking to itself.
• 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are reserved for documentation and examples.

Troubleshooting address configuration

The method above becomes a troubleshooting tool. Work out each device's subnet from its own address and mask, then compare.

The default gateway is outside the host's subnet. A PC is set to 10.10.5.37, mask 255.255.255.240, gateway 10.10.5.49. A /28 has a block of 16, so 37 is in 32 to 47. The gateway 10.10.5.49 is in the next block, 48 to 63. The PC can reach hosts in its own subnet, but it cannot reach the gateway directly, so nothing beyond the subnet works. A gateway can be any usable address in the subnet; it just has to be in the same one.

Two hosts in one VLAN, but in different subnets. PC1 is 10.1.1.20/25 and PC2 is 10.1.1.140/25. A /25 splits the last octet at 128, so PC1 is in 10.1.1.0/25 and PC2 in 10.1.1.128/25. Each treats the other as remote and sends to its gateway. With no router present, the ping fails even though both are on access ports in the same VLAN. The usual cause is a mistyped mask or address.

A host given a reserved address. A technician types 192.168.4.63 with mask 255.255.255.192. That is a /26, whose first block runs 0 to 63, so .63 is the broadcast address. The operating system rejects it. IOS rejects a network or broadcast address in the same way:

R2(config)#interface GigabitEthernet0/0/0
R2(config-if)#ip address 192.168.4.64 255.255.255.192
Bad mask /26 for address 192.168.4.64

192.168.4.64 is the network address of 192.168.4.64/26, so it cannot be an interface address either.

Overlapping subnets on one router. IOS will not let two interfaces sit in overlapping subnets. Here Gi0/0/1 already holds 192.168.4.65/26, which covers .64 to .127, so .100 on another interface is refused:

R2(config)#interface GigabitEthernet0/0/2
R2(config-if)#ip address 192.168.4.100 255.255.255.192
% 192.168.4.64 overlaps with GigabitEthernet0/0/1

A self-assigned 169.254 address. A laptop showing 169.254.37.112, mask 255.255.0.0 and no gateway did not get an answer from DHCP. That is not a private lease and not carrier-grade NAT space. Check DHCP reachability next, for example a missing relay on a new VLAN (lesson 7 covers DHCP and relay).

Duplicate addresses. Two devices with the same static address cause intermittent failures. Windows reports an address conflict, and the router's ARP entry for that address flips between two MAC addresses.

To check a router's own addressing, start with a brief view, then the detail for one interface:

R3#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     10.0.0.10       YES manual up                    up
GigabitEthernet0/1     172.16.33.14    YES manual up                    up
GigabitEthernet0/2     unassigned      YES unset  administratively down down

R3#show ip interface GigabitEthernet0/1 | include Internet
  Internet address is 172.16.33.14/28

The brief view does not show masks, so use the detailed command or the running configuration to see the prefix. From 172.16.33.14/28: block of 16, block 0 to 15, broadcast 172.16.33.15, next subnet 172.16.33.16.

What the exam is really asking

• Network versus broadcast versus usable. Usable hosts are 2^h - 2. A /27 is 30 hosts, not 32.
• The block size method. 256 minus the mask value in the interesting octet. Use it for every network, broadcast, first-host and last-host question.
• Masks that look alike. 255.255.240.0 (/20), 255.255.248.0 (/21) and 255.255.255.240 (/28) are different prefixes.
• Masks in the third octet. Addresses ending in .0 or .255 can be valid hosts when the block spans several third-octet values.
• Sizing questions. "Hosts needed" counts host bits; "subnets needed" counts borrowed bits. Choose the smallest that fits.
• RFC 1918 boundaries. 172.16 to 172.31 only. 100.64.0.0/10 is carrier-grade NAT, 169.254.0.0/16 is link-local, 192.0.2.0/24 is documentation: none is RFC 1918.
• 169.254 means DHCP failed, not that DHCP handed out a private address.
• Gateway outside the subnet breaks off-subnet traffic only; local traffic still works.
• Same VLAN does not mean same subnet. Two hosts whose masks place them in different subnets need a router to talk.