Subnetting questions are marks that candidates should not be dropping. The maths is not hard once you have a reliable method, but the CCNA exam is designed to trap candidates who have learned shortcuts without understanding the underlying logic.
Here are the mistakes that appear most often and how to avoid each one.
Mistake 1: Confusing Network Address with First Usable Host
The network address is the first address in a subnet and cannot be assigned to a host. The first usable host address is network address + 1.
Example — 192.168.1.0/26:
- Network address: 192.168.1.0
- First usable host: 192.168.1.1
- Last usable host: 192.168.1.62
- Broadcast address: 192.168.1.63
Exam questions often ask for the "first host address" and provide the network address as one of the options. Candidates who read quickly pick .0 and lose the mark.
Mistake 2: Confusing Last Usable Host with Broadcast
The broadcast address is the last address in the subnet. The last usable host is broadcast minus 1.
From the same /26 example:
- Broadcast: 192.168.1.63
- Last usable host: 192.168.1.62
If the question asks for the "last host address that can be assigned," the answer is .62, not .63. This is one of the most common single-mark errors on the exam.
Mistake 3: Off-by-One Errors in Host Count
The formula for usable hosts is: 2^(host bits) - 2
The minus 2 accounts for the network address and broadcast address. A /26 subnet has 6 host bits: 2^6 = 64 total addresses, 62 usable.
Where candidates go wrong: they calculate 2^6 = 64 and write 64 as the host count, forgetting to subtract 2. A /27 provides 30 usable hosts (32 - 2). If you need 31 hosts, you need a /26.
Mistake 4: Getting the Subnet Mask Wrong for a Given Prefix
The exam uses both prefix notation and dotted decimal masks. Candidates often confuse these for mid-range prefixes like /19, /22, or /23.
| Prefix | Subnet Mask | Block Size |
|---|---|---|
| /24 | 255.255.255.0 | 256 |
| /25 | 255.255.255.128 | 128 |
| /26 | 255.255.255.192 | 64 |
| /27 | 255.255.255.224 | 32 |
| /28 | 255.255.255.240 | 16 |
| /29 | 255.255.255.248 | 8 |
| /30 | 255.255.255.252 | 4 |
| /22 | 255.255.252.0 | 1024 |
| /23 | 255.255.254.0 | 512 |
The "block size" is how many addresses are in each subnet. Knowing block sizes lets you quickly identify subnet boundaries without full binary conversion.
Mistake 5: Not Identifying Subnet Boundaries Correctly
Given the address 172.16.45.200/20, which subnet does it belong to?
/20 means the subnet mask is 255.255.240.0. The interesting octet is the third. The block size in the third octet is 16 (256 - 240 = 16).
Subnets in the third octet: 0, 16, 32, 48 (too high). The subnet is 172.16.32.0.
Method: divide the host octet value by the block size and round down. 45 / 16 = 2.8 → round down to 2 → 2 × 16 = 32. Subnet is 172.16.32.0/20.
Broadcast: 172.16.47.255 (the next subnet starts at 172.16.48.0, so broadcast is .47.255).
Mistake 6: VLSM — Not Sizing Largest Subnet First
Variable Length Subnet Masking questions ask you to allocate subnets from an address block efficiently. The rule is to allocate the largest requirement first, then progressively smaller ones. Candidates who allocate in the order given by the question run out of address space.
Example — allocate from 10.0.0.0/24 for: 60 hosts, 30 hosts, 14 hosts, two point-to-point links:
- 60-host subnet: needs /26 (62 usable). Assign 10.0.0.0/26.
- 30-host subnet: needs /27 (30 usable). Assign 10.0.0.64/27.
- 14-host subnet: needs /28 (14 usable). Assign 10.0.0.96/28.
- Point-to-point links: /30 each (2 usable). Assign 10.0.0.112/30 and 10.0.0.116/30.
Mistake 7: Forgetting /30 for Point-to-Point Links
A point-to-point link needs exactly 2 usable addresses. A /30 provides exactly that. Using /29 or larger wastes address space, and on VLSM allocation questions asking for the "most efficient" design, the /30 is always the right choice.
The Fastest Method Under Exam Pressure
- Find the interesting octet (not 0 or 255 in the mask)
- Block size = 256 minus the interesting octet value
- List boundaries until the address falls within one
- Network = boundary, Broadcast = next boundary - 1
- First host = network + 1, Last host = broadcast - 1
Practice with time pressure on CCNA subnetting questions until the steps are automatic.
The 60-Second Binary Method vs Block Size Method — Which to Use When
There are two approaches candidates use to solve subnetting questions. Both give correct answers. The question is which one to use when.
Binary method: convert the IP address and mask to binary, AND them to get the network address, flip the mask for the broadcast. Reliable for every case, including unusual masks. Slow. Takes 60–90 seconds for a single subnet question.
Block size method: identify the interesting octet, calculate the block size (256 minus the interesting octet value), count up in multiples to find the boundary. Fast. Under 15 seconds for /24 through /30. Requires knowing the block sizes by memory.
The exam does not give you extra time for complex subnetting. You will have routing table questions, OSPF questions, EtherChannel questions — all requiring subnetting as background calculation. If every subnet question costs you 60 seconds, you will run out of time.
Use block size method for /25 through /30 on the same octet — this covers 90% of exam subnetting questions. Get to the point where you can do these without writing anything down.
Use binary method as a backup for /19, /22, /23, and any question that feels genuinely ambiguous. These mid-range prefixes span two octets of interest and the block size method can trip people up if they rush.
The practical approach: drill block sizes until they are automatic. The block sizes you absolutely must have memorised are 128 (/25), 64 (/26), 32 (/27), 16 (/28), 8 (/29), 4 (/30). If you can rattle those off faster than you can read this sentence, you are ready.
The /23 and /22 Problem — Where Everyone's Mental Math Breaks
The single octet with a clean block size works for /25 through /30. It starts to break when the mask is /23 or /22 because the subnet spans the boundary between the third and fourth octets.
/23 mask: 255.255.254.0. Block size in the third octet is 2 (256 - 254 = 2). So subnets in the third octet go: 0, 2, 4, 6, 8 ... and each subnet covers two full values of the third octet.
Example: which subnet does 172.16.45.200/23 belong to?
Third octet is 45. Block size is 2. Multiples of 2: 0, 2, 4, ..., 44, 46. The subnet boundary below 45 is 44. So the subnet is 172.16.44.0/23.
The broadcast address: 172.16.44.0/23 covers 172.16.44.x AND 172.16.45.x because each /23 subnet spans two consecutive values of the third octet. Broadcast is 172.16.45.255.
Here is what trips people up: they see 172.16.45.200 and think the network is 172.16.45.0. That's wrong. The network starts at 172.16.44.0 and extends through 172.16.45.255. The .45.200 address is inside this subnet, but the subnet address itself starts in the .44.x range.
/22 is the same logic with block size 4. Subnet 172.16.44.0/22 covers 172.16.44.x, .45.x, .46.x, and .47.x. Broadcast is 172.16.47.255.
The fastest way to handle these: convert only the third octet using block size, not the full address. 45 / 2 = 22.5, round down to 22, multiply back: 22 × 2 = 44. Subnet network is 172.16.44.0. Broadcast is 172.16.45.255 (next boundary is 172.16.46.0, so the previous address is .45.255).
Full Worked VLSM Problem
The exam will give you an address block and a list of requirements. Your job is to allocate subnets without wasting address space. Here is a complete worked example different from the one earlier in this post.
Given: Address block 192.168.10.0/24. Allocate for these requirements in any order: Site A needs 50 hosts, Site B needs 25 hosts, Site C needs 12 hosts, Site D needs 6 hosts, two WAN links each needing 2 usable addresses.
Step 1: sort largest to smallest.
50, 25, 12, 6, 2, 2
Step 2: allocate in order.
50 hosts: 2^6 = 64, minus 2 = 62 usable. Need /26.
- Subnet: 192.168.10.0/26
- Range: 192.168.10.1 – 192.168.10.62
- Broadcast: 192.168.10.63
- Next available: 192.168.10.64
25 hosts: 2^5 = 32, minus 2 = 30 usable. Need /27.
- Subnet: 192.168.10.64/27
- Range: 192.168.10.65 – 192.168.10.94
- Broadcast: 192.168.10.95
- Next available: 192.168.10.96
12 hosts: 2^4 = 16, minus 2 = 14 usable. Need /28.
- Subnet: 192.168.10.96/28
- Range: 192.168.10.97 – 192.168.10.110
- Broadcast: 192.168.10.111
- Next available: 192.168.10.112
6 hosts: 2^3 = 8, minus 2 = 6 usable. Need /29.
- Subnet: 192.168.10.112/29
- Range: 192.168.10.113 – 192.168.10.118
- Broadcast: 192.168.10.119
- Next available: 192.168.10.120
WAN link 1 (2 usable): /30.
- Subnet: 192.168.10.120/30
- Range: 192.168.10.121 – 192.168.10.122
- Broadcast: 192.168.10.123
- Next available: 192.168.10.124
WAN link 2 (2 usable): /30.
- Subnet: 192.168.10.124/30
- Range: 192.168.10.125 – 192.168.10.126
- Broadcast: 192.168.10.127
Total addresses used: 64 + 32 + 16 + 8 + 4 + 4 = 128. Half of the /24 remains (192.168.10.128 through 192.168.10.255) for future use.
The question the exam asks after this kind of allocation: "Which subnet is assigned to Site C?" If you allocated in the wrong order, your answer will be off. Always sort largest first.
Practice Under Time Pressure — How Long Is Too Long
Here are realistic benchmarks for CCNA exam conditions. If you are taking longer than these, you need more drilling before exam day.
| Question Type | Target Time |
|---|---|
| /26 through /30 — network, broadcast, host range | Under 15 seconds |
| /23 or /22 — which subnet does an address belong to | Under 25 seconds |
| VLSM — 4 subnets, which prefix for N hosts | Under 60 seconds |
| Full VLSM allocation — 5+ requirements | Under 90 seconds |
| Host count for a given prefix | Under 5 seconds |
The 15-second target for /26-/30 sounds aggressive until you realise the exam is 120 questions in 120 minutes. Every second you spend longer than needed on a subnetting question is time you are not spending on an OSPF scenario or an EtherChannel configuration question. Subnetting should be the easiest marks you pick up, not the ones that eat your time budget.
Drilling method that actually works: get a random IP address generator (or just write out a list of random IPs and masks), set a 15-second timer, and force yourself to write the network and broadcast. Do 20 repetitions every day for two weeks. By the end, /26-/30 should feel as automatic as multiplication tables.
Checklist Before Moving On
Before you leave a subnetting question on the exam, run through this mentally. It takes about five seconds and catches the most common errors.
- Did I use the correct mask? (/26 is 64 addresses, not 62 — subtract 2 only for host count)
- Is the network address a multiple of the block size? (192.168.1.64/26 yes; 192.168.1.65/26 no)
- Is the broadcast address exactly one less than the next subnet? (192.168.1.127 for /26 starting at .64)
- Did they ask for network address, broadcast, first host, last host, or host count? Read the question again.
- Did I subtract 2 only if they asked for usable hosts? (64 total, 62 usable for /26)
That fifth point catches more marks than anything else. Candidates calculate 64 for a /26 and write 64 as the host count. The correct answer is 62. Or they write 62 when the question asked for total addresses. Read what the question is actually asking.
Practice Question Sets
The best way to lock in subnetting is working through real exam questions with immediate feedback. Pick a session size that fits your schedule: