Subnetting Cheat Sheet for Network+ and CCNA (2026)

You need exactly eight numbers to subnet anything on the Network+ or CCNA exam: 128, 64, 32, 16, 8, 4, 2, 1. That's it. Every mask, every block size, every "how many usable hosts" question comes out of that row of powers of two. The rest of this subnetting cheat sheet is just teaching you where to look and what to subtract.

Here's the deal. On the N10-009 you get 90 minutes for up to 90 questions (CompTIA Network+ exam page). You can't afford to convert to binary on paper every time an IP address shows up. So this guide gives you the table, the four-step method that replaces binary, and twelve drills with the answers worked out. Want to see where you stand first? Our free Network+ N10-009 practice test has subnet math in it, no signup required.

Independent study resource. Not affiliated with or endorsed by CompTIA or Cisco. Exam codes, objectives, and weightings are set by the vendors. Always confirm current details on the official exam pages before booking.

What Does Each Exam Actually Test on Subnetting?

Less than you fear, and more precisely than you'd like. Network+ N10-009 lists IPv4 addressing under Domain 1, Networking Concepts, which carries 23% of the exam. CompTIA's topic list spells it out: public vs. private addressing, APIPA, RFC 1918, loopback, subnetting (VLSM and CIDR), and address classes A through E (CompTIA Network+ exam page). In the current objectives that's objective 1.7, "Given a scenario, use appropriate IPv4 network addressing."

Cisco is blunter. The CCNA 200-301 v1.1 exam topics include 1.6, "Configure and verify IPv4 addressing and subnetting," and 1.7, "Describe private IPv4 addressing." Both sit inside Network Fundamentals, which is 20% of the exam (Cisco 200-301 CCNA exam topics). The word "configure" matters. On CCNA you may have to type the mask into an interface, so you need to know both the slash form and the dotted-decimal form cold. One date to know: Cisco has set February 2, 2027 as the last day to test on v1.1, with CCNA v2.0 starting February 3, 2027 (Cisco CCNA v2.0 exam topics). This sheet reflects v1.1, the exam you can book today.

Security+ (SY0-701) is a different story. Its Domain 3, Security Architecture, covers architecture models, enterprise infrastructure, data protection, and resilience, and subnet calculation isn't listed among its objectives (CompTIA Security+ exam page). You still need to read a CIDR block when one appears in a firewall rule or a segmentation scenario, but computing a broadcast address isn't on that objective list. If that's the exam you're sitting, the free SY0-701 practice test is where to spend your time instead.

Exam	Where subnetting lives	What you have to do
CompTIA Network+ N10-009	Domain 1, Networking Concepts (23%), IPv4 addressing topic	Find network and broadcast addresses, count usable hosts, pick a mask for a host count, spot private/APIPA/loopback ranges
Cisco CCNA 200-301 v1.1	1.0 Network Fundamentals (20%), topics 1.6 and 1.7	Everything above, plus configure and verify the mask on a device and explain RFC 1918 private addressing
CompTIA Security+ SY0-701	Domain 3, Security Architecture (segmentation scenarios)	Read CIDR notation in rules and diagrams. No subnet arithmetic in the objectives

One more data point from our side. Two of the 50 questions in our own free Network+ practice test are straight subnet arithmetic, and both sit in the Domain 1 review. One of the troubleshooting scenarios later in the test then turns on a host with the wrong subnet mask. That's the pattern to expect: a couple of pure math questions, then subnetting hiding inside troubleshooting.

The Subnetting Cheat Sheet (Print This Part)

The table below is the whole thing. Every row follows the same two rules: total addresses double each time the prefix drops by one, and the block size is 256 minus the interesting octet. "Interesting octet" just means the one mask octet that isn't 255 or 0. Usable hosts are the total minus two, because the all-zeros host value means the network itself and the all-ones value is the broadcast (RFC 950). The /n prefix notation itself comes from RFC 4632, CIDR.

Prefix	Mask	Interesting octet	Block size	Total addresses	Usable hosts
/17	255.255.128.0	3rd	128	32,768	32,766
/18	255.255.192.0	3rd	64	16,384	16,382
/19	255.255.224.0	3rd	32	8,192	8,190
/20	255.255.240.0	3rd	16	4,096	4,094
/21	255.255.248.0	3rd	8	2,048	2,046
/22	255.255.252.0	3rd	4	1,024	1,022
/23	255.255.254.0	3rd	2	512	510
/24	255.255.255.0	none	256	256	254
/25	255.255.255.128	4th	128	128	126
/26	255.255.255.192	4th	64	64	62
/27	255.255.255.224	4th	32	32	30
/28	255.255.255.240	4th	16	16	14
/29	255.255.255.248	4th	8	8	6
/30	255.255.255.252	4th	4	4	2
/31	255.255.255.254	4th	2	2	2 (point-to-point only, RFC 3021)

Notice the mask octets repeat. The third-octet masks for /17 through /23 (128, 192, 224, 240, 248, 252, 254) are the same seven values as the fourth-octet masks for /25 through /31. Learn seven numbers and you've learned both halves of the table. And if a question hands you a /8 or /16, there's nothing to compute. The network address is the first one or two octets followed by zeros.

How Do You Subnet Fast Without Binary? The Magic-Number Method

Four steps. No binary. The method only needs the powers of two and simple subtraction, and with a bit of practice you'll do it in your head.

1. Find the interesting octet. Convert the prefix to a mask if you have to. The interesting octet is the one that isn't 255 or 0.
2. Get the block size. 256 minus the interesting octet.
3. Find the network address. In the same position of the IP address, round down to the nearest multiple of the block size. Every octet after it becomes 0.
4. Find the broadcast. Add the block size to the network octet, subtract one. Every octet after it becomes 255. The usable range sits between network + 1 and broadcast − 1.

Worked example 1: a fourth-octet mask

Host 192.168.10.200/27. A /27 is 255.255.255.224, so the fourth octet is interesting and the block size is 256 − 224 = 32. Multiples of 32 are 0, 32, 64, 96, 128, 160, 192, 224. The last one at or below 200 is 192. So the network is 192.168.10.192, the broadcast is 192 + 32 − 1 = 192.168.10.223, and the hosts run from .193 to .222. Thirty usable, which matches the table.

Worked example 2: a third-octet mask

Host 172.16.130.9/18. A /18 is 255.255.192.0, so the third octet is interesting and the block size is 64. Where does 130 fall? Multiples of 64 are 0, 64, 128, 192. Round down to 128. Network: 172.16.128.0. Broadcast: third octet 128 + 64 − 1 = 191, then 255 in the fourth octet, so 172.16.191.255. Hosts run from 172.16.128.1 to 172.16.191.254, which is 16,382 of them.

That second example is where people lose points. The moment the interesting octet moves to the third position, the fourth octet just rides along as 0 for the network and 255 for the broadcast. Don't touch it. Don't overthink it.

How Do You Pick a Mask From a Host Count?

This is the reverse problem and the exams love it. "A department needs 50 hosts. Which mask wastes the fewest addresses?" Walk up the powers of two until one is at least the host count plus two, then count how many host bits that is.

Hosts needed	Smallest block that fits (hosts + 2)	Prefix	Mask	Usable hosts
2	4	/30	255.255.255.252	2
10	16	/28	255.255.255.240	14
25	32	/27	255.255.255.224	30
50	64	/26	255.255.255.192	62
100	128	/25	255.255.255.128	126
200	256	/24	255.255.255.0	254
500	512	/23	255.255.254.0	510
1,000	1,024	/22	255.255.252.0	1,022
2,000	2,048	/21	255.255.248.0	2,046
4,000	4,096	/20	255.255.240.0	4,094

Watch the trap at the boundaries. A requirement for 62 hosts fits a /26 exactly. A requirement for 63 does not, because 63 + 2 = 65 needs a block of 128, which means a /25. CompTIA's VLSM wording is really just this table applied several times to one address space, largest group first.

Why do the exams care? Because wrong answer choices often include the mask that's one bit too small (not enough hosts) and the one that's one bit too large (wasteful). If you remember "hosts plus two, then round up to a power of two," you can rule out both.

Which Addresses Must You Recognize on Sight?

Many subnetting-flavoured questions on both exams aren't arithmetic at all. They hand you an address and expect you to know what kind of address it is. Learn these ranges the way you know your own phone number.

Range	Prefix	What it is	Defined in
10.0.0.0 – 10.255.255.255	10/8	Private	RFC 1918
172.16.0.0 – 172.31.255.255	172.16/12	Private
192.168.0.0 – 192.168.255.255	192.168/16	Private
169.254.0.0 – 169.254.255.255	169.254/16	Link-local (APIPA). A host assigns itself one when DHCP fails	RFC 3927
127.0.0.0 – 127.255.255.255	127/8	Loopback	RFC 1122

The private ranges are the ones that bite. 172.16/12 is a twelve-bit prefix, so it covers 172.16.0.0 through 172.31.255.255, and 172.32.0.1 is a public address. Exam writers know that 172.32 looks private to a tired candidate. Same with 192.169.x.x, which is public, and 10.x.x.x, which is always private no matter what follows.

Then there are the classes. The old classful rules in RFC 791 set Class A by a leading 0 bit, Class B by leading 10, and Class C by leading 110 (RFC 791). Once you set aside 0 and the 127 loopback block, that works out to first octets of 1–126, 128–191 and 192–223, with default masks of /8, /16 and /24. RFC 4632 deprecated classful address assignment in favour of explicit prefix lengths, so use the /n you're given rather than guessing a mask from the first bits (RFC 4632). But CompTIA still lists classes A to E in the N10-009 topic list, so you need both views: know the class, then ignore it and use the prefix you were given.

A note on APIPA. When you see a 169.254.x.x address on a workstation in a troubleshooting scenario, the answer is almost always "DHCP didn't respond." RFC 3927 is explicit that these addresses are for the local link only and must not be routed. So a host with one can talk to its neighbours, maybe, and to nothing beyond the switch.

Twelve Drills With Answers

Do these cold, with the table covered. Then check. If any of them takes you more than 30 seconds, that pattern is the one to drill tomorrow. If the key and your gut disagree, the key wins.

#	Problem	Network	Broadcast	Usable hosts	Watch out for
1	192.168.1.77/26	192.168.1.64	192.168.1.127	62 (.65–.126)	Block 64, round 77 down to 64
2	10.1.45.7/20	10.1.32.0	10.1.47.255	4,094	Third octet is interesting, block 16
3	10.200.33.1/29	10.200.33.0	10.200.33.7	6 (.1–.6)	The host is the first usable address
4	192.168.5.95/30	192.168.5.92	192.168.5.95	2 (.93–.94)	The address you were given is the broadcast
5	172.31.77.200/22	172.31.76.0	172.31.79.255	1,022	Block 4 in the third octet, 77 rounds to 76
6	10.10.250.14/25	10.10.250.0	10.10.250.127	126	Only two blocks per /24: .0 and .128
7	192.168.100.130/28	192.168.100.128	192.168.100.143	14 (.129–.142)	Block 16, 130 is just past 128
8	172.16.9.9/21	172.16.8.0	172.16.15.255	2,046	Block 8 in the third octet
9	192.168.1.100/30	192.168.1.100	192.168.1.103	2 (.101–.102)	The address you were given is the network address
10	172.20.47.255/20	172.20.32.0	172.20.47.255	4,094	Looks like a broadcast. It is one
11	Need 500 hosts	/23 (255.255.254.0)		510	502 rounds up to 512
12	Need 25 hosts per subnet in a /24	/27 (255.255.255.224), 8 subnets		30 each	27 rounds up to 32, and 256 ÷ 32 = 8

Drills 4, 9 and 10 are deliberately mean. Exam writers like to hand you the network or broadcast address itself and see whether you notice. When the mask lives in the fourth octet, a fourth octet that's a multiple of the block size is a network address, and one less than a multiple is the broadcast. When the mask lives in the third octet, run the same test there, with .255 behind it for the broadcast.

Where Do People Lose Points?

After enough practice sets, the same five mistakes keep coming back.

• Forgetting the minus two. A /26 has 64 addresses and 62 hosts. If an answer choice says 64, it's the distractor.
• Working in the wrong octet. With a /20, the fourth octet of the address is irrelevant to the network address. Cover it with your thumb.
• Off-by-one on the broadcast. It's the next block minus one. The next block itself is the next network.
• Assuming a classful mask. 172.16.130.9 is not automatically a /16. Use the prefix in the question, and only fall back to the class if the question gives you nothing else.
• Treating /31 like /30. On CCNA especially, a /31 point-to-point link has two usable addresses and no broadcast, per RFC 3021 (RFC 3021). A /30, two usable hosts out of four addresses, is the classic point-to-point subnet in subnet math.

Have you noticed none of these are math errors? They're attention errors. That's good news, because attention is fixable with repetition in a way that arithmetic anxiety isn't. Our guide to active recall and spaced repetition explains how to space those drills so the method sticks past exam day.

FAQ

How many usable hosts are in a /26?

62. A /26 leaves 6 host bits, so 2⁶ = 64 total addresses, minus one for the network address and one for the broadcast. The mask is 255.255.255.192 and the block size is 64, so the four /26 subnets in a /24 start at .0, .64, .128 and .192.

Is subnetting on the Security+ exam?

Not as arithmetic. SY0-701's Domain 3 covers security architecture and segmentation, where you'll read CIDR blocks in firewall rules and network diagrams, and subnet calculation isn't a listed objective. Learn to read the notation and move on. Network+ N10-009 and CCNA 200-301 are the exams that test the math.

What's the difference between CIDR and VLSM?

CIDR (RFC 4632) is the notation and the idea: a prefix length instead of a class. VLSM, variable-length subnet masking, is what you do with it inside one network: carving a /24 into a /25, a /26 and two /27s so each department gets a block sized to its host count. The N10-009 topic list names both.

Do I need to subnet IPv6 for these exams?

Barely. Both exams list IPv6 addressing in their topic lists, so you should recognise the address types and the prefix notation, but the heavy arithmetic is IPv4. If you can do the twelve drills above in your head, you've covered the part of addressing that costs people the most points.

Why is 172.32.0.1 a public address?

Because the RFC 1918 private block is 172.16/12, which is twelve bits of prefix, not sixteen. Twelve bits covers 172.16.0.0 through 172.31.255.255. The moment the second octet hits 32, you're outside the block and on the public internet, at least on paper.

Drill It Until It's Boring

Keep this subnetting cheat sheet handy, because subnetting is the one Network+ topic where the questions are fair but fast, so speed is the skill. Learn the eight numbers, run the four steps, and get each of the twelve drills above under 30 seconds. Then go test it under time pressure in the free Network+ N10-009 practice test, where the subnet questions are mixed in with everything else the way they will be on exam day.

Studying for CCNA 200-301? The math is identical, so the drills above and the practice test transfer directly. Just remember that CCNA expects you to configure the mask, so practice writing both the slash and dotted-decimal forms.

Still deciding between the two exams this sheet covers? Our Network+ vs CCNA guide compares the two, and if you're earlier in the path, A+ vs Network+ settles which one to book first. The rest of our certification guides are free too.

Related reading

• CompTIA Network+ vs CCNA: Which Networking Cert Should You Get First? (2026)
• CompTIA A+ vs Network+: Which Certification First? (2026)
• How to Study for IT Certification Exams (Active Recall + Spaced Repetition)
• SY0-701 Network Attacks Explained (Objective 2.4)