Where subnetting sits in the blueprint
Three v1.1 topics make up this area: configure and verify IPv4 addressing and subnetting (1.6), describe private IPv4 addressing (1.7), and verify IP parameters on Windows, macOS and Linux clients (1.10). Topic 1.6 carries the configure-and-verify verbs, so practice the arithmetic at a router prompt as well as on paper: assign an address, then confirm it in the show output.
The skill travels further than its weight suggests. A wildcard mask in an access list or an OSPF network statement is the subnet mask inverted (wildcard vs subnet mask), and every lookup on the routing table page is a comparison of prefix lengths.
The block-size method, worked once
Find the interesting octet
Take 172.16.77.130/21. A /21 leaves 11 host bits, so the mask is 255.255.248.0, and the octet that is neither 255 nor 0 is the third.
Get the block size
Subtract that mask octet from 256: 256 − 248 = 8. Subnets in the third octet start at 0, 8, 16, and on through 64, 72, 80.
Drop to the boundary
77 falls between 72 and 80, so the subnet is 172.16.72.0/21.
Find the broadcast
One below the next subnet: 172.16.80.0 minus one is 172.16.79.255.
Read the usable range
172.16.72.1 through 172.16.79.254, which is 211 − 2 = 2,046 hosts once the subnet address and the broadcast are set aside.
One /24, carved with VLSM
| Segment | Hosts needed | Prefix | Subnet to broadcast | Usable |
|---|---|---|---|---|
| Floor LAN | 120 | /25 | 10.20.0.0 – 10.20.0.127 | 126 |
| Lab VLAN | 25 | /27 | 10.20.0.128 – 10.20.0.159 | 30 |
| Printers | 5 | /29 | 10.20.0.160 – 10.20.0.167 | 6 |
| WAN link A | 2 | /30 | 10.20.0.168 – 10.20.0.171 | 2 |
| WAN link B | 2 | /31 | 10.20.0.172 – 10.20.0.173 | 2 (RFC 3021) |
Variable-length subnet masking (VLSM) sizes each subnet to its segment. Allocating the largest block first keeps every block aligned, and 10.20.0.174 onward stays free for growth.
Running the method backward
Design questions start from a requirement instead of an address. For a host count, find the smallest number of host bits h where 2h − 2 covers the hosts, then the prefix is 32 − h. A segment of 4,000 hosts needs h = 12, since 212 − 2 = 4,094 and 211 − 2 = 2,046 falls short, so the prefix is /20.
For a subnet count, borrow s bits from the host part until 2s reaches the number of subnets. Splitting 172.16.0.0/16 into 50 subnets needs s = 6 (64 subnets), which gives /22 subnets with a block size of 4 in the third octet: 172.16.0.0, 172.16.4.0, 172.16.8.0 and onward.
Both directions use the same landmarks: host bits, block size, boundary. When a mask arrives in dotted decimal, convert it to a prefix first and the rest follows.
Private space and the client-side check
RFC 1918 reserves one block from each of the old class A, B and C spaces for internal use. Internet routers do not carry those blocks, which is why the NAT, DHCP and DNS study area exists. A neighbor that is often confused with them, 169.254.0.0/16, is the link-local range a client assigns itself when DHCP fails (RFC 3927); it is a symptom, not a design choice.
Topic 1.10 checks that you can read an address, a mask and a gateway off a client. On Windows that is ipconfig, with /all for DNS servers and the MAC address; on current Linux distributions it is ip address and ip route; on macOS, networksetup -getinfo Wi-Fi prints the address, mask and router of the Wi-Fi service, and netstat -rn lists the default route. A host with the right address and the wrong gateway still reaches its own subnet and nothing past it, which is the pattern to look for.
The same habits, with 128 bits and hexadecimal, carry into IPv6 addressing, the next study area on this site.
Frames: IPv4 & subnetting
Masks, prefix lengths, host counts, private ranges and client commands. For a second pass in a different order, the practice test has an IPv4 filter.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 015 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 015
What is the range of IPv4 addresses reserved for private use according to RFC 1918?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
10.0.0.0/8 is right, but the 192.168 block is a /16, and this list leaves out 172.16.0.0/12 entirely.
Note on B
172.0.0.0/8 and 192.0.0.0/8 are far too broad, and most of those addresses are public; the private blocks are 172.16.0.0/12 and 192.168.0.0/16.
Note on C
These are special-use blocks: loopback, link-local (APIPA) and multicast. None of them is in RFC 1918.
Note on D
Correct: RFC 1918 reserves exactly three blocks, 10.0.0.0/8, 172.16.0.0/12 (172.16 to 172.31) and 192.168.0.0/16.
Best answer: D · why
According to RFC 1918, three blocks of IPv4 addresses are reserved for private use: 10.0.0.0/8 (10.0.0.0 to 10.255.255.255), 172.16.0.0/12 (172.16.0.0 to 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 to 192.168.255.255). These addresses are not routable on the public internet.
- Frame 002 of 015
What is the primary function of the default gateway in a network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: a host sends traffic for any off-subnet destination to its default gateway, the router that forwards it toward other networks.
Note on B
Turning names into addresses is the job of DNS; the gateway’s address and the DNS server’s address are separate host settings.
Note on C
Wireless devices join through an access point; the default gateway is a Layer 3 hop and has nothing to do with Wi-Fi association.
Note on D
Traffic between hosts on the same subnet goes directly and is switched at Layer 2; the gateway is used only when the destination is on another network.
Best answer: A · why
A host compares each destination address with its own subnet. If the destination is local, it delivers the frame directly. If not, it sends the packet to its default gateway, a router interface on its own subnet, which forwards it toward the remote network. DNS resolves names, access points connect wireless clients, and switches carry traffic inside the local subnet.
- Frame 003 of 015
Which command in a Linux environment displays a device’s interface configuration, including IP addresses and subnet masks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
ipconfig is the Windows command; a typical Linux shell does not have it.
Note on B
netstat lists sockets, connections and network statistics; it is not the tool for viewing an interface’s address settings.
Note on C
nslookup queries DNS for names and records; it does not show local interface settings.
Note on D
Correct: ifconfig prints each interface’s IPv4 address, netmask and MAC address; newer distributions offer ip addr as its replacement.
Best answer: D · why
On Linux, ifconfig (from the older net-tools package) shows each interface with its IPv4 address, netmask, broadcast address and MAC address. Many current distributions use ip addr for the same view and ip route to see the default gateway. ipconfig is the Windows equivalent, netstat reports connections and statistics, and nslookup queries DNS.
- Frame 004 of 015
A router’s routing table contains two entries: 192.168.2.0/25 and 192.168.2.128/25. How do these entries affect IP connectivity within the original 192.168.2.0/24 network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Administrative distance belongs to a route source, not to a prefix; these are two different prefixes, so AD is not what separates them.
Note on B
Redundant paths would mean one prefix with two next hops; here each entry covers a different half of the address space.
Note on C
The two /25s do not overlap: one covers .0 to .127 and the other .128 to .255, so together they tile the /24 exactly.
Note on D
Correct: borrowing one host bit cuts the /24 into two /25 subnets of 126 usable hosts each, and each half is a separate broadcast domain.
Best answer: D · why
192.168.2.0/25 covers .0 to .127 and 192.168.2.128/25 covers .128 to .255. Borrowing one bit from the host part splits the original /24 into two equal subnets of 126 usable hosts each. Each subnet is its own broadcast domain, so broadcasts in one half do not reach the other, and the router routes between them. The entries do not overlap, and they are separate prefixes rather than redundant paths.
- Frame 005 of 015Choose 2
Which two statements are true about IP addresses in a subnet? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
The first address, with all host bits set to 0, identifies the subnet itself. The broadcast address is the last one.
Note on B
Correct. The last address has every host bit set to 1 and reaches all hosts in the subnet.
Note on C
Correct. The first address has every host bit set to 0 and names the subnet, so it is not given to a host.
Note on D
The last address, with all host bits set to 1, is the broadcast address, not the network address.
Best answers: B and C · why
In every IPv4 subnet the address with all host bits 0 is the network address and the address with all host bits 1 is the directed broadcast address. Neither is assigned to a host, which is why a subnet has 2^h - 2 usable host addresses. In 192.168.1.64/26, for example, 192.168.1.64 is the network, 192.168.1.127 the broadcast, and .65 to .126 are usable. A /31 point-to-point link is the exception, using both addresses.
- Frame 006 of 015Choose 3
What are three types of information included in a basic ARP table? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Correct. Each entry is tied to the interface it was learned on, since ARP works only on the local segment.
Note on B
Correct. The IPv4 address is the lookup key that ARP resolves.
Note on C
A metric belongs to a routing table entry. ARP only maps addresses and has no path cost.
Note on D
The next hop is chosen by the routing table. ARP then resolves that next hop’s IPv4 address to a MAC address.
Note on E
Correct. The hardware (MAC) address is the result of the resolution, used to build the Ethernet frame.
Best answers: A, B and E · why
ARP maps an IPv4 address on the local segment to the MAC address needed to deliver a frame. Each entry in an ARP table, shown with ‘show ip arp’ on a router or ‘arp -a’ on a host, holds the IPv4 address, the hardware address and the interface it was learned on, with an age or type. Routing decisions such as next hop and metric come from the routing table, which is consulted first; ARP then resolves the chosen next hop.
- Frame 007 of 015
Why are subnet masks used in IPv4 addressing?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A mask does not change line rate; speed comes from the physical link and the hardware.
Note on B
A subnet mask is not a security tool; it encrypts nothing, and addresses travel in clear text in the IP header.
Note on C
Correct: the one-bits mark the network portion and the zero-bits the host portion, which tells a device whether a destination is local.
Note on D
Masks have no geographic meaning; registries allocate address blocks by region, but the mask only splits network bits from host bits.
Best answer: C · why
A subnet mask is a 32-bit pattern of ones followed by zeros. The ones mark the network part of the address and the zeros mark the host part. A host applies the mask to its own address and to the destination; if the network parts match, the destination is on the local subnet, otherwise the packet goes to the default gateway.
- Frame 008 of 015
An administrator needs to set the IP address and subnet mask for a port on a router. Which command should they use while in the interface configuration mode?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
ip helper-address relays DHCP broadcasts to a server on another subnet; it does not set the interface’s own address.
Note on B
interface loopback creates a virtual loopback interface from global configuration mode; it does not address a physical port.
Note on C
Correct: in interface configuration mode, ip address followed by the address and mask, for example ip address 10.1.1.1 255.255.255.0, sets the port’s IPv4 address.
Note on D
ip route is a global configuration command that adds a static route; it does not address an interface.
Best answer: C · why
In interface configuration mode, ip address followed by the address and the subnet mask, for example ip address 192.168.1.1 255.255.255.0, assigns the port its IPv4 address, and no shutdown brings it up. ip route adds a static route in global configuration mode, ip helper-address relays DHCP requests, and interface loopback creates a virtual interface.
- Frame 009 of 015
What is the prefix length notation for the subnet mask 255.255.255.192?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
/30 is 255.255.255.252, which leaves only two host bits.
Note on B
/28 is 255.255.255.240; its last octet is 11110000, four one-bits rather than two.
Note on C
/24 is 255.255.255.0, with no one-bits in the last octet; .192 adds two more.
Note on D
Correct: 192 is 11000000 in binary, so the mask has 8 + 8 + 8 + 2 = 26 one-bits.
Best answer: D · why
The subnet mask 255.255.255.192 in binary is 11111111.11111111.11111111.11000000. Counting the number of consecutive 1’s gives us 26. Therefore, the prefix length notation (CIDR notation) is /26.
- Frame 010 of 015
Which type of IPv4 address is used for data packets that should be sent to a specific group of hosts at the same time?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: a multicast address (224.0.0.0/4) names a group, and one packet reaches every host that has joined that group.
Note on B
Private addresses (RFC 1918) describe where an address may be used, not how many receivers a packet has.
Note on C
A broadcast reaches every host on the subnet whether or not it wants the traffic; it cannot be aimed at a chosen group.
Note on D
A public address is globally routable, but that says nothing about one-to-many delivery; it is usually unicast.
Best answer: A · why
IPv4 multicast uses 224.0.0.0/4. A sender transmits one packet to a group address, and only hosts that have joined the group receive and process it. A broadcast goes to every host on the subnet, while private and public describe where an address may be routed, not how many receivers a packet has.
- Frame 011 of 015
What is the network address for the subnet with the IP 10.10.10.5/24?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: with a /24 mask the first three octets are the network, so setting the host octet to zero gives 10.10.10.0.
Note on B
10.10.10.5 is the host’s own address; the network address has every host bit set to zero.
Note on C
10.10.10.255 has every host bit set to one, which makes it the subnet’s broadcast address.
Note on D
10.10.10.1 is the first usable host, often given to the gateway, but it is not the network address.
Best answer: A · why
A /24 mask (255.255.255.0) keeps the first three octets as the network part. Setting the host octet to all zeros gives the network address, 10.10.10.0. All ones in the host octet gives the broadcast address, 10.10.10.255, and usable hosts run from .1 to .254.
- Frame 012 of 015
What is the IPv4 address class of 192.168.1.1?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: classful rules put first octets 192 to 223 in Class C, so 192.168.1.1 is Class C (and also RFC 1918 private).
Note on B
Class B covers first octets 128 to 191; 192 is just past that range.
Note on C
Class A covers first octets 1 to 126; 192 is far outside it.
Note on D
Class D (224 to 239) is reserved for multicast and is never assigned to a host such as 192.168.1.1.
Best answer: A · why
The IPv4 address 192.168.1.1 belongs to Class C. IPv4 class ranges are: Class A (1-126), Class B (128-191), Class C (192-223), Class D (224-239), and Class E (240-255). Since the first octet is 192, this address falls within the Class C range.
- Frame 013 of 015
Which of the following addresses belongs to a Class B private network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
10.153.7.12 is private, but it sits in the Class A block 10.0.0.0/8.
Note on B
192.168.100.100 is private, but 192.168.0.0/16 is the Class C private range.
Note on C
203.0.113.8 is in a block reserved for documentation (TEST-NET-3); it is Class C and not an RFC 1918 private address.
Note on D
Correct: the Class B private range is 172.16.0.0 to 172.31.255.255 (172.16.0.0/12), and 172.20 falls inside it.
Best answer: D · why
RFC 1918 reserves one private block per class: 10.0.0.0/8 for Class A, 172.16.0.0/12 (172.16 to 172.31) for Class B, and 192.168.0.0/16 for Class C. Only 172.20.5.4 sits in the Class B block. 203.0.113.0/24 is reserved for documentation, not for private networks.
- Frame 014 of 015
Which subnet mask would you use to create 16 subnets from a Class C network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
255.255.255.224 is /27: three borrowed bits give 8 subnets, not 16.
Note on B
255.255.255.248 is /29: five borrowed bits give 32 subnets of 6 hosts each.
Note on C
255.255.255.192 is /26: two borrowed bits give only 4 subnets.
Note on D
Correct: 16 subnets need 4 borrowed bits (2^4 = 16), which gives /28, or 255.255.255.240, with 14 usable hosts per subnet.
Best answer: D · why
To create 16 subnets from a Class C network, you need 4 bits for the subnet portion (2^4 = 16). Since a Class C network has 24 bits for the network portion by default, adding 4 more bits results in a /28 subnet mask, which is 255.255.255.240 in dotted decimal notation.
- Frame 015 of 015
What is the maximum number of hosts that can be addressed in a /23 network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
1022 is the usable count for a /22, which has 10 host bits.
Note on B
254 is the usable count for a /24; a /23 doubles the block.
Note on C
Correct: a /23 leaves 9 host bits, and 2^9 - 2 = 510 usable host addresses.
Note on D
512 is the total number of addresses in a /23; the network and broadcast addresses cannot be given to hosts.
Best answer: C · why
A /23 network has 9 host bits (32 - 23 = 9). The formula for calculating the number of usable host addresses is 2^h - 2, where h is the number of host bits. So, 2^9 - 2 = 512 - 2 = 510 usable host addresses. The subtraction of 2 accounts for the network address and broadcast address, which cannot be assigned to hosts.
Subnetting after the v2.0 refresh
The arithmetic survives the refresh and the verb hardens. Subnetting becomes a troubleshooting topic in v2.0 (1.3), and the client checks widen to wired and wireless clients on all three operating systems (1.6). Practice explaining why one host cannot reach another as well as naming its subnet; the v2.0 changeover page has the timing.