4 · IPv4, CIDR and subnetting Network

Prefix math you can do in your head · network, broadcast, usable range · /31, /32 · longest-prefix match

Why it matters for NPE. Subnetting shows up in nearly every network screen. You must answer /26 and /28 questions without a calculator and explain why a router picks the most specific route.

Primer: a prefix is just "how many bits are fixed"

An IPv4 address is 32 bits. /24 means the first 24 bits name the network and the last 8 bits name the host, so there are 2⁸ = 256 addresses in the block. /26 fixes 26 bits, leaving 6 host bits: 64 addresses. Everything else (mask, network ID, broadcast, usable range, "next network") falls out of the block size.

Watch

Drill generator: subnetipv4.com. Time yourself; stop when ten in a row take under 20 seconds each.

The mask table (write it from memory once a day until it sticks)

The mask octet values are always from the set 0, 128, 192, 224, 240, 248, 252, 254, 255 (each adds the next bit). Mask octet = 256 − block size.

The 20-second method

Question: 192.0.2.130/26. Network? Broadcast? Usable range?

1. Block size: 32 − 26 = 6 host bits → 64.
2. Which multiple of 64 is at or below 130? 0, 64, 128, 192. So the network ID is 192.0.2.128.
3. Next network is 192.0.2.192, so the broadcast is one less: 192.0.2.191.
4. Usable hosts: .129 to .190 (62 of them).

When the prefix is shorter than /24 the "interesting octet" moves left. 10.37.200.5/20: 32 − 20 = 12 host bits, so the block is 16 in the third octet. Multiples of 16 at or below 200: 192. Network 10.37.192.0, broadcast 10.37.207.255, hosts 10.37.192.1 to 10.37.207.254.

Drills (do them cold, then check)

Longest-prefix match: how the route table is read

$ ip route
default via 10.1.1.1 dev eth0              # 0.0.0.0/0
10.0.0.0/8 via 10.1.1.2 dev eth0
10.2.0.0/16 via 10.1.1.3 dev eth0
10.2.2.0/24 via 10.1.1.4 dev eth0
10.1.1.0/24 dev eth0 proto kernel scope link src 10.1.1.10

A packet to 10.2.2.30 matches /0, /8, /16 and /24. The router picks the /24, the longest (most specific) prefix, so the next hop is 10.1.1.3? No: 10.1.1.4. Read it again if you got that wrong; it is the classic trap. A packet to 10.2.5.1 matches /0, /8, /16 → next hop 10.1.1.3. A packet to 10.9.9.9 → the /8 → 10.1.1.2. A packet to 8.8.8.8 → default → 10.1.1.1.

Order of decisions in a router: 1. longest prefix. Only when two routes have the same prefix does it compare 2. administrative distance / protocol preference (connected 0, static 1, eBGP 20, OSPF 110, IS-IS 115, iBGP 200 on Cisco; Linux and other vendors differ) and then 3. metric within the same protocol. Equal everything → ECMP, traffic hashed across the next hops.

ip route get 10.2.2.30 on Linux prints exactly which route the kernel would use. Use it in troubleshooting answers.

Special addresses you should recognise

Interview questions

Traps

• Subtracting 2 for usable hosts on a /31 or /32.
• Forgetting that the block boundary moves to the third (or second) octet for prefixes shorter than /24.
• Picking the route with the "best" protocol instead of the longest prefix.
• Thinking a /24 "always ends in .0 to .255" when the question is about a /25 or /26 inside it.
• Confusing the mask 255.255.255.224 (/27) with 255.255.255.240 (/28). Recompute from the block size rather than recalling the number.
• Saying two addresses are on the same subnet because the first three octets match. It depends on the mask.

Scenario

A new server at 10.5.20.70 with mask 255.255.255.192 and gateway 10.5.20.1 cannot reach anything outside its rack. Servers at 10.5.20.10 work fine with the same gateway.

← 3 · Hash maps, sets, counting and grouping · all topics · 5 · File handling and log parsing →