Subnetting mastery for Network+ and Security+

Why subnetting decides exams

Subnetting is a load-bearing skill: addressing, VLANs, routing, ACLs, and half of troubleshooting assume it. Slow subnetting doesn't just cost its own questions. It taxes every question built on top. Target: any /24-/30 in 30 seconds, /16-/23 without fear.

The only method you need: block sizes

1. Find the interesting octet (mask neither 0 nor 255).
2. Block size = 256 − mask value. (/26 → 256−192 = 64.)
3. Networks start at multiples of the block (0, 64, 128, 192).
4. Your address falls in one block: that is the network; the next block minus one is broadcast; everything between is usable.

Practice this on the calculator until the multiples feel like times tables.

Memorize these, derive the rest

Each row: prefix length, dotted mask, block size (addresses per subnet), usable hosts (minus network and broadcast).

• /24, 255.255.255.0, 256 addresses, 254 usable. The home row. One full last octet.
• /25, 255.255.255.128, 128 addresses, 126 usable. Halves a /24.
• /26, 255.255.255.192, 64 addresses, 62 usable. The exam's favorite: big enough for a department, small enough for mental math.
• /27, 255.255.255.224, 32 addresses, 30 usable. Small teams and point-of-sale networks.
• /28, 255.255.255.240, 16 addresses, 14 usable. Printer VLANs and lab benches.
• /29, 255.255.255.248, 8 addresses, 6 usable. Small links.
• /30, 255.255.255.252, 4 addresses, 2 usable. Router-to-router links: network, two ends, broadcast.
• /23, 255.255.254.0, 512 addresses, 510 usable. Two /24s joined; the mask's third octet (254) is the tell.
• /16, 255.255.0.0, 65,536 addresses, 65,534 usable. The old Class B in one row.

The pattern that replaces memorization past /24: each extra bit halves the block. 256, 128, 64, 32, 16, 8, 4. Say it until it is reflex, because every harder question is this sequence wearing a scenario.

VLSM thinking (Network+ level)

Right-size each subnet to its host count: point-to-point links get /30s (2 usable, nothing wasted), small departments get /27s-/26s, growth gets one block up. The exam asks which mask fits a requirement: compute hosts-needed, find the smallest mask that covers it, allocate from the largest requirement down.

Two worked examples (do these by hand)

172.20.14.88/20: mask 255.255.240.0, interesting octet is the third (240 → block 16). Third-octet multiples: 0, 16, 32, so .14 falls in 0-15, so network 172.20.0.0, broadcast 172.20.15.255, usable 172.20.0.1-172.20.15.254 (4,094 hosts).

10.4.9.200/23: mask 255.255.254.0, third octet interesting (254 → block 2). Multiples: 8, 10, so .9 falls in 8-9, so network 10.4.8.0, broadcast 10.4.9.255, usable 10.4.8.1-10.4.9.254 (510 hosts). Note the trap: /23 pairs two third-octet values, the network is .8, not .9.

CIDR addition and design splits

"How many /26s fit in a /24?" Divide the blocks: 256/64 = 4. In prefix math each bit shorter doubles capacity: /24 holds two /25s, four /26s, eight /27s. For design questions, convert every requirement to a prefix first, then check that the sum fits. Example: split 10.0.0.0/24 for four departments of 50 hosts each. Four /26s give 62 usable addresses each, so four 64-blocks fit exactly (10.0.0.0/26, 10.0.0.64/26, 10.0.0.128/26, 10.0.0.192/26). Check both directions: enough subnets and enough hosts per subnet. Wrong answers on this shape fail one of the two checks.

Supernetting and route summarization

Supernetting runs the design logic in reverse: combine small blocks into one advertised route. Four /26s (192.168.5.0, .64, .128, .192) summarize as 192.168.5.0/24 because they fill it exactly. The exam tests whether the summary fits tightly: summarizing 10.0.0.0/26 and 10.0.0.64/26 gives 10.0.0.0/25, while adding 10.0.0.128/26 breaks the fit and needs the /24. Check summaries the same way you check splits: convert to blocks, confirm exact coverage, reject summaries that swallow addresses outside the set. A summary that includes networks you do not own misroutes traffic, which is why the exam treats sloppy summarization as a finding, not a shortcut.

Private ranges and APIPA (free points)

• 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. The three private ranges. Note the /12 on 172.16: it spans 172.16 through 172.31, and the exam loves asking whether 172.32.x.x is private (it is not).
• 169.254.0.0/16. APIPA self-assignment when DHCP fails. A workstation with a 169.254 address has a DHCP problem, not a cable problem. Start at the DHCP server.

The speed program

• Week 1: 10 calculator-checked problems daily, any speed. Accuracy only.
• Week 2: 20 drill problems daily against the clock. Target under 60 seconds each.
• Week 3+: 5 daily as warm-up forever. Subnetting decays fast; maintenance is cheap.

The three wrong answers you'll meet

Off-by-one networks ('.9' for a /23 starting at .8). Always verify the network is a block multiple. Broadcast-as-usable (assigning .255 to a host). Broadcast is never assignable. Forgetting minus-two on tiny subnets (/30 has 2 usable, not 4). The /31 exception: 255.255.255.254 gives 2 addresses with zero usable under classic math, but modern point-to-point links use both because no broadcast is needed. If the exam mentions /31, it is testing whether you know the exception exists. Each of these appears as a distractor constantly. Checking your answer against all four takes five seconds and saves the question.

Exam-day rule: if a subnetting problem resists 90 seconds. Circle back. It is one question, and later questions need your time more.

If speed is not the only gap, the Network+ resources comparison covers what else the exam asks you to do at a console, and where the practice for it comes from.

Sources

• CompTIA Network+ certification page
• CompTIA N10-009 exam objectives
• ARIN CIDR primer and number resources

By SecLern Editorial. Published October 16, 2026. Updated October 21, 2026. Subnet math verified by construction (powers of two from /8 through /30); private ranges per RFC 1918, APIPA per RFC 3927.