October 23, 2026 · CertCrack Blog

How to Subnet IPv4 in Under a Minute — The Magic-Number Method for Network+ and CCNA

Subnetting is the single skill that fails more Network+ and CCNA candidates than any other topic — not because it is hard, but because it is usually taught backwards. This guide teaches the magic-number method: a fast, exam-room-friendly procedure that gets you the network address, broadcast address, valid host range, and number of subnets for any IPv4 prefix without binary math on paper.

What a subnet mask actually does

An IPv4 address is 32 bits. The subnet mask (or the CIDR prefix, e.g. /26) tells you how many of those 32 bits identify the network and how many identify individual hosts. The boundary between network bits and host bits is what lets routers decide where a packet goes, and it is what every subnetting exam question is really asking about. Forget memorizing dotted-decimal masks for every prefix — you only need one fact: 256 minus the interesting octet's mask value gives you the block size (the "magic number").

The magic-number method (step by step)

1. 1. Find the interesting octet: the octet where the mask is neither 255 nor 0. For /24 and smaller the interesting octet is the last one; for /16–/23 it is the third.
2. 2. Compute the magic number: 256 minus the mask value in the interesting octet. (You will rarely need the full dotted mask — just remember which octet, or convert the prefix once.)
3. 3. Subnets are multiples of the magic number in the interesting octet: 0, magic, 2×magic, 3×magic… Each multiple starts a subnet.
4. 4. The broadcast address of a subnet is one less than the next subnet's network address.
5. 5. Valid hosts are everything between the network and broadcast addresses.

Common conversions worth memorizing cold for the exam: /24 = block size 256 (whole third octet per subnet, i.e. classic class C split); /25 = 128; /26 = 64; /27 = 32; /28 = 16; /29 = 8; /30 = 4. On exam day you will reach for /26 (64), /27 (32), and /28 (16) most often.

Worked example 1: 192.168.10.0/26

The interesting octet is the last one; mask 192 → magic number 64. Subnets: 192.168.10.0, 192.168.10.64, 192.168.10.128, 192.168.10.192. Take the second subnet: network 192.168.10.64, broadcast is one less than 128 → 192.168.10.127, valid hosts 192.168.10.65 through 192.168.10.126 (62 usable addresses). A /26 always gives 62 usable hosts per subnet.

Worked example 2: 10.20.0.0/28

Interesting octet is the last one; mask 240 → magic number 16. Subnets: 10.20.0.0, 10.20.0.16, 10.20.0.32… Subnet 10.20.0.32: broadcast 10.20.0.47, valid hosts 10.20.0.33–46 (14 usable). The host 10.20.0.41 belongs to subnet 10.20.0.32 — "which subnet does this host belong to" is answered by finding the nearest multiple of 16 below the host octet.

Worked example 3: 172.16.5.128/25

Mask 128 in the last octet → magic number 128. Two subnets: 172.16.5.0 and 172.16.5.128. Second subnet: network 172.16.5.128, broadcast 172.16.5.255, valid hosts 172.16.5.129–254 (126 usable). Note the broadcast is the end of the address space here — still just "one less than the next subnet," which doesn't exist, so it's the last address.

VLSM walkthrough: carving 192.168.50.0/24 for four offices

VLSM (variable-length subnet masking) means using different prefix lengths inside one address block to avoid wasting addresses — an exam favorite on both Network+ and CCNA. Requirements: Office A needs 60 hosts, B needs 25, C needs 12, D needs a point-to-point link (2 hosts). - Office A (60 hosts): needs 6 host bits → /26 (64 addresses, 62 usable). Assign 192.168.50.0/26. Hosts .1–.62, broadcast .63. - Office B (25 hosts): needs 5 host bits → /27 (32 addresses, 30 usable). Next free block: 192.168.50.64/27. Hosts .65–.94, broadcast .95. - Office C (12 hosts): needs 4 host bits → /28 (16 addresses, 14 usable). Next: 192.168.50.96/28. Hosts .97–.110, broadcast .111. - Office D (2 hosts): /30 (4 addresses, 2 usable). Next: 192.168.50.112/30. Hosts .113–.114, broadcast .115. Rule: always allocate the largest requirement first, then work down — that keeps the blocks aligned and non-overlapping.

Quick-reference table (memorize the /25–/30 column)

Common exam traps

1. 1. First and last usable host: the network address and broadcast address are never assigned to hosts — "192.168.10.64/26: how many usable hosts" is 62, not 64.
2. 2. "Which subnet does this host belong to": always round the host octet DOWN to the nearest multiple of the magic number — rounding up is the classic wrong answer.
3. 3. /31 and /32: a /31 (RFC 3021) is used on point-to-point links with zero usable hosts in the old sense — 2 addresses, both usable as endpoints. Know it exists so a trick option doesn't surprise you.
4. 4. Route summarization: the reverse skill — given several subnets, find the smallest prefix that covers them all (align on the common bits). Practice it separately; questions combine it with VLSM.
5. 5. Speed: the exam gives you roughly a minute per question. If you are still converting to binary, practice the magic-number method until the block sizes are reflex.

5-question self-check

1. 1. What is the broadcast address of 192.168.7.96/27? (Answer: 192.168.7.127)
2. 2. How many usable hosts does a /28 provide? (Answer: 14)
3. 3. Which subnet does host 10.1.1.200/26 belong to? (Answer: 10.1.1.192/26 — nearest multiple of 64 below 200)
4. 4. A branch office needs 29 usable addresses from 172.20.0.0/24. What is the smallest subnet you can assign, and what is its range? (Answer: a /27 — 30 usable; e.g. 172.20.0.0/27, hosts .1–.30, broadcast .31)
5. 5. You need three /28 subnets and one /26 from 192.168.99.0/24 without overlap. Show the allocation. (Answer: /26 first: 192.168.99.0/26; then /28s: 192.168.99.64/28, 192.168.99.80/28, 192.168.99.96/28)