First, the essential ideas
- Bit and octet
- A bit is one binary digit, 0 or 1. An octet contains eight bits and can represent a decimal value from 0 to 255.
- IPv4 address
- A 32-bit network address, commonly written as four decimal octets, assigned to an interface; one device can have several interfaces and addresses.
- Interface and host
- An interface is a network connection on a device. A host is an endpoint that sends or receives data, such as a computer.
- Prefix and subnet mask
- The prefix length counts the leading network bits. A contiguous mask represents those bits as ones followed by host-bit zeros.
- Subnet
- An IP address block defined by a network address and prefix length. The host uses its mask to decide whether a destination belongs to its local subnet.
- Network and broadcast
- For an ordinary IPv4 LAN subnet, all-zero host bits identify the network and all-one host bits identify its directed broadcast, not ordinary host assignments.
- Usable host range
- The addresses between network and broadcast in the ordinary LAN examples here. Special /31 point-to-point and /32 cases use different rules.
- Default gateway
- A router's local address used for destinations without a more specific route. No gateway is configured in this isolated same-subnet lab.
- VPCS and console
- VPCS is GNS3's lightweight Virtual PC Simulator. Its console is a text window opened by right-clicking the named PC and choosing Console.
- ICMP and ping
- ICMP is an IP control-message protocol. Ordinary ping sends echo requests and reports replies or missing replies; it does not prove application health.
- Baseline and rollback
- A baseline records the intended settings and working observations. Rollback restores those exact settings after a controlled test.
A layered explanation is useful only when the basic words are clear. Start with the definitions below, then separate the paper calculation from the actual device test. An address plan predicts which settings belong together; the isolated experiment checks a particular configured path. Neither is evidence that an application or production security policy works.
See the idea
One address, three boundary roles
Calculate the containing block first, then distinguish its network, ordinary host range and broadcast.
Read address and prefix
192.168.8.10/24 uses mask 255.255.255.0. Twenty-four network bits leave eight host bits, giving 256 total addresses in the containing block.
What this model leaves out: This conceptual calculation omits physical devices and traffic because it explains address boundaries. The separate lab names PC1, Switch1 and PC2; this is not their wiring diagram.
Full visual explanation and references
The address 192.168.8.10/24 leads to network .0, usable hosts .1 through .254 and broadcast .255 within 192.168.8.0/24. This is a calculation, not a packet path.
This conceptual calculation omits physical devices and traffic because it explains address boundaries. The separate lab names PC1, Switch1 and PC2; this is not their wiring diagram.
- Read address and prefix
192.168.8.10/24 uses mask 255.255.255.0. Twenty-four network bits leave eight host bits, giving 256 total addresses in the containing block.
www.cisco.comwww.rfc-editor.org - Find the containing block
Set the eight host bits to zero for network 192.168.8.0 and to one for broadcast 192.168.8.255. The input address lies between these boundaries.
www.cisco.comwww.rfc-editor.org - Check ordinary host space
Ordinary hosts run from 192.168.8.1 through 192.168.8.254. The lab uses .10 and .20. Do not apply this ordinary-LAN rule unchanged to /31 or /32 cases.
www.cisco.comwww.rfc-editor.org
One idea at a time
Start with something familiar.
No router command knowledge is assumed. Read the definitions first and write the address plan on paper. A console is the text window opened by right-clicking the named GNS3 PC and choosing Console; do not type commands into the switch or your computer's operating-system terminal.
Why learn this?
The IPv4 endpoints in this lab need distinct addresses and compatible local subnet settings to exchange IP traffic. Switch1 forwards their Ethernet frames without needing its own IP address. Knowing which address bits identify the network helps you configure the endpoints and troubleshoot their connection.
An everyday comparison
Think of a postal address: the city name shows where the neighborhood is, and the house number identifies your home within that city.
What happens in a network
The city area is like the network part of an IP address, the house number is like the host part identifying a device within that network.
Where the comparison stopsThis is a memory aid, not a literal delivery process. Devices compare binary address bits and routing information; they do not understand streets, buildings or floors. The analogy cannot prove connectivity or security.
Follow one worked example
- Write the address and its prefix together.
The same decimal address can belong to different-sized blocks when its prefix changes. Copy both values before doing arithmetic; do not infer the mask from an old class label.
Why: An address without the configured mask is incomplete evidence for a subnet calculation.
- Calculate boundaries before assigning a host.
Find the network, last address and ordinary usable host range. Check that the example host lies inside the intended block, not on a reserved LAN boundary.
Why: Planning first makes off-by-one errors visible before you type a value into a device.
- Compare the plan with actual observations.
Inspect both PC configurations, test the named remote peer, change one documented address and restore it. Record unexpected results without inventing a successful transcript.
Why: A controlled baseline, fault and recovery exercise connects arithmetic to observable behavior without claiming to test production applications.
Your first small task
On paper, write the network, broadcast and usable range for 192.168.8.10/24, then compare both proposed lab host addresses with that range before opening a console.
Show a hint
For this /24 only, keep the first three octets and vary the final eight host bits.
Check the expected result
Network 192.168.8.0, broadcast 192.168.8.255 and usable range .1 through .254 include both .10 and .20.
Pause and explain it in your own words
Does an address ending in .255 always mean broadcast?
Show a hint
The role depends on the prefix, not only the final printed number.
Show the explanation
No. Calculate using the full address and mask. In this specific /24 example .255 is the broadcast, but a different prefix can assign different roles to the same final octet.
Short answer
What should you understand today?
An IPv4 address has 32 bits. Its prefix or mask identifies which bits describe the network. In the ordinary LAN examples here, all-zero host bits identify the network and all-one host bits identify the broadcast. Host addresses lie between those boundaries; special /31 and /32 cases differ.
Before you begin
Learning targets
- Review the earlier endpoint and Ethernet lessons; all required addressing terms are defined here before the teaching body.
- Use GNS3 with its included VPCS and Ethernet switch nodes. No Cisco router image or IOS commands are required.
- Work in a fresh isolated project with no physical, Cloud, NAT or production-network connection.
- Have a plain-text notes application and a calculator or paper available; the calculation steps are explained before the lab.
- Read an IPv4 address and contiguous mask without assuming a classful default.
- Calculate network, broadcast and usable host boundaries for the supplied /24 and /26 examples.
- Explain that a broadcast destination does not guarantee every device responds.
- Compare a written address plan with a reversible isolated two-PC GNS3 test.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Bit and octet
A bit is one binary digit, 0 or 1. An octet contains eight bits and can represent a decimal value from 0 to 255.
IPv4 address
A 32-bit network address, commonly written as four decimal octets, assigned to an interface; one device can have several interfaces and addresses.
Interface and host
An interface is a network connection on a device. A host is an endpoint that sends or receives data, such as a computer.
Prefix and subnet mask
The prefix length counts the leading network bits. A contiguous mask represents those bits as ones followed by host-bit zeros.
Subnet
An IP address block defined by a network address and prefix length. The host uses its mask to decide whether a destination belongs to its local subnet.
Network and broadcast
For an ordinary IPv4 LAN subnet, all-zero host bits identify the network and all-one host bits identify its directed broadcast, not ordinary host assignments.
Usable host range
The addresses between network and broadcast in the ordinary LAN examples here. Special /31 point-to-point and /32 cases use different rules.
Default gateway
A router's local address used for destinations without a more specific route. No gateway is configured in this isolated same-subnet lab.
VPCS and console
VPCS is GNS3's lightweight Virtual PC Simulator. Its console is a text window opened by right-clicking the named PC and choosing Console.
ICMP and ping
ICMP is an IP control-message protocol. Ordinary ping sends echo requests and reports replies or missing replies; it does not prove application health.
Baseline and rollback
A baseline records the intended settings and working observations. Rollback restores those exact settings after a controlled test.
Four numbers represent thirty-two bits
An IPv4 address such as 192.168.8.10 is written as four decimal octets. Each octet represents eight binary bits, so the full address has 32 bits. An octet's decimal value is between 0 and 255. An address belongs to a network interface, not permanently to a person or an entire device; a router can have several interfaces and addresses. The mask must be considered with the address. Do not conclude that an address beginning with 192 always uses /24, or that one beginning with 10 always uses /8. Modern classless addressing uses the supplied prefix. In our lab the addresses are private examples confined to a disconnected project, not instructions to change a home or office adapter.
- An IPv4 octet is an eight-bit value from 0 through 255.
- Always record the configured prefix along with the address.
- One device can have more than one addressed interface.
A mask marks the network bits
A contiguous subnet mask consists of leading ones followed by zeros in binary. The ones select the network portion; the zeros leave the host portion. For /24, three whole octets contain ones and the final octet contains zeros, giving 255.255.255.0. This whole-octet example is easy to see, but the division can occur inside an octet. In /26, the last mask octet is 11000000 in binary: 128 plus 64 equals 192. The full mask is 255.255.255.192 and six host bits remain. That is why the first three printed numbers alone are not a universal test for whether two addresses share a subnet. Read the actual prefix before using a shortcut.
- /24 corresponds to 255.255.255.0.
- /26 corresponds to 255.255.255.192 and leaves six host bits.
- A prefix boundary need not line up with a printed dot.
Find network, broadcast and usable hosts
For an ordinary IPv4 LAN subnet, keep the network bits and set every host bit to zero to obtain the network address. Set every host bit to one to obtain the broadcast address. Do not assign those two boundary addresses as ordinary hosts in the LAN examples here. With h host bits, a block has 2^h total addresses and these ordinary examples have 2^h minus 2 usable addresses. The notation 2^h means multiply two by itself h times. This subtract-two formula is not universal: /31 point-to-point links have a defined exception and a /32 identifies one address. We acknowledge those boundaries now; do not apply their rules to the /24 lab or assume that every /31 is suitable for an ordinary multi-host LAN.
- Network and broadcast are full addresses, not just final-octet numbers.
- Do not confuse total address count with usable host count.
- Special /31 and /32 cases require their own context.
Broadcast is a destination, not a response guarantee
A subnet-directed broadcast address identifies the hosts in the target IPv4 subnet. It does not guarantee that every machine is powered on, accepts a particular message or replies to a ping. Host software and network controls affect behavior. Directed broadcasts arriving from other networks are commonly restricted for security reasons; this beginner exercise does not enable them. Calculate the broadcast address on paper instead of probing a whole real network. The built-in GNS3 switch and two VPCS nodes are used only for individual peer checks. A broadcast calculation is not evidence that an application reached all intended recipients, and changing a mask alone does not create a firewall or reliable security separation.
- Identify broadcast boundaries without scanning or broadcasting to real networks.
- Never assume every host responds to a broadcast ping.
- Address planning and security-policy enforcement are different tasks.
Check a non-octet boundary before the lab
For 192.168.8.70/26, six host bits give blocks of 64 addresses. The fourth-octet blocks begin at 0, 64, 128 and 192. Seventy lies in the block starting at 64, so the network is 192.168.8.64 and the broadcast is 192.168.8.127. Ordinary usable hosts are .65 through .126. This is a paper comparison; the hands-on lab below deliberately stays with /24 so you can first connect the calculation to inspected settings and a controlled fault. Day 9 develops the broader four-step method. During any real change, confirm the existing address plan and permission first; do not replace a production mask just because a classroom example uses a different one.
- The containing block must include the given host address.
- Reserve network and broadcast in the ordinary LAN example.
- Changing the mask changes the boundary, not just its written label.
Real-world walkthrough
An address-plan review before a Day 8 lab change
A hypothetical training room needs an address plan that a second operator can check. A learner has written only a computer address and says it must be correct because it looks familiar. The reviewer asks for the prefix, boundary calculation, intended peer and a rollback record. This is a planning scenario, not a claim that the isolated lab implements an entire office network.
- Write the complete address and prefix for each proposed endpoint and identify the parent address block the exercise is allowed to use.
- Calculate the network, ordinary host range and broadcast before assigning anything; compare the results with the intended block and check for duplicate host addresses.
- Record exact lab cable endpoints and initial settings. Keep a copy of the baseline outside the device so an incorrect setting can be restored accurately.
- Configure only the two virtual endpoints in the isolated project, inspect both settings and test the remote peer. Keep actual output separate from expected results.
- Change just the documented fault value, record the failure, restore the baseline and repeat the original test. Escalate unexplained differences rather than claiming that subnetting alone created security.
Guided GNS3 lab
Day 8: calculate, configure, change and restore one subnet
Compare a calculated address plan with actual VPCS settings and remote ICMP results, then restore one deliberate wrong-subnet fault without changing shared or production networks.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| PC1 | Ethernet0 | 192.168.8.10/24 | First host in the planned local test. |
| PC2 | Ethernet0 | 192.168.8.20/24 | Remote peer; distinct from PC1. |
| Switch1 | Ethernet0 and Ethernet1 | No IP address required | Joins the two isolated local links. |
Set up the lab
- Create a fresh GNS3 project; use a configured local server or GNS3 VM appropriate to your installation.
- Drag two built-in VPCS nodes from End devices and a built-in Ethernet switch from Switches. Rename them PC1, PC2 and Switch1.
- Connect the exact interfaces in the topology. Start both PCs and leave the switch ports on their default access VLAN 1.
- Do not add a Cloud, NAT or physical network adapter. Perform these tests only in the isolated lab, never on production or shared traffic.
- Open Notepad on Windows, TextEdit in plain-text mode on macOS, or a plain-text editor on Linux. Save your baseline and observations as Day8-address-plan.txt.
Calculate before typing
On paper, record both endpoint addresses, the /24 prefix and mask 255.255.255.0. Calculate the full network and broadcast addresses before assigning anything. The /24 prefix leaves eight host bits, so the block contains 256 addresses; the ordinary usable range is 192.168.8.1 through 192.168.8.254. These are calculations, not commands to type in a console.
- What you should see
- Your written plan identifies network 192.168.8.0/24 and broadcast 192.168.8.255, and places both proposed host addresses strictly between them.
- Why this step matters
- The arithmetic and the device configuration are separate checks. Establishing the expected plan first makes later discrepancies visible instead of silently accepting a typo.
Configure and inspect PC1
Right-click PC1 and choose Console before typing. Confirm the PC1> or VPCS> prompt, then enter the commands separately without typing the prompt itself. Copy the displayed settings into your baseline note.
ip 192.168.8.10/24
show ipWhat each command means
ip 192.168.8.10/24- Assign PC1 address 192.168.8.10 and prefix /24; no gateway is needed for this isolated local path.
show ip- Display the actual settings rather than assuming the previous input was correct; compare address and mask with the plan.
- What you should see
- PC1 shows 192.168.8.10 with mask 255.255.255.0. Stop if it differs from the written baseline.
- Why this step matters
- A configured value and a planned value can differ. Inspecting the actual endpoint first prevents a typo from being interpreted as a failure of the subnet calculation.
Configure and inspect PC2
Right-click PC2 and choose Console before typing. Check that the window belongs to PC2 rather than PC1. Assign its distinct address, inspect the result and copy the actual values into the same baseline note.
ip 192.168.8.20/24
show ipWhat each command means
ip 192.168.8.20/24- Assign PC2 its unique address 192.168.8.20 using the same /24 prefix as PC1.
show ip- Read PC2's actual address and mask so the remote end is verified independently.
- What you should see
- PC2 shows 192.168.8.20 with mask 255.255.255.0. Both endpoints are inside 192.168.8.0/24.
- Why this step matters
- Matching only one side is not enough. Both endpoints must agree with the intended addressing plan, and they must not use the same host address.
Test the remote baseline
Right-click PC1 and choose Console before typing. Test PC2's address, not PC1's own address. Repeat the bounded command if an initial request times out; do not introduce the fault until repeated baseline requests receive replies.
ping 192.168.8.20 -c 3What each command means
ping 192.168.8.20 -c 3- Send three ICMP echo requests to PC2 at 192.168.8.20; -c 3 limits the count. This is a remote reachability test, not an application test.
- What you should see
- The remote endpoint replies during the working baseline. Record actual results, including any initial missing replies, rather than copying a sample transcript.
- Why this step matters
- A working baseline is necessary for a meaningful fault comparison. Initial address discovery can delay a reply; persistent loss needs investigation before the experiment continues.
Introduce one wrong address
Right-click PC2 and choose Console before typing. Change only PC2 to 192.168.9.20/24; keep the cables, mask and PC1 unchanged. Inspect the new settings and mark this clearly as an intentional fault, not the final configuration.
ip 192.168.9.20/24
show ipWhat each command means
ip 192.168.9.20/24- Move PC2 to 192.168.9.20, outside PC1's /24 subnet, without adding a gateway or router.
show ip- Confirm that the wrong address was actually applied so the next observation has a known cause in this controlled lab.
- What you should see
- PC2 now shows 192.168.9.20/24. The original PC2 address is no longer the correct target during this fault step.
- Why this step matters
- Changing one documented value isolates the experiment. The switch still has the same cables; an IP subnet mismatch is not the same as a missing physical link.
Test the changed destination
Right-click PC1 and choose Console before typing. Test PC2's current wrong address, 192.168.9.20. There is no default gateway or router in this project, so PC1 has no configured path to that different subnet.
ping 192.168.9.20 -c 3What each command means
ping 192.168.9.20 -c 3- Try three ICMP requests to the deliberately changed PC2 address 192.168.9.20; the expected failure concerns this exact isolated address plan.
- What you should see
- Expect no successful remote echo replies; VPCS may report a missing gateway, unreachable destination or timeouts. Record its exact wording. Do not claim a successful cross-subnet exchange.
- Why this step matters
- The observation demonstrates the boundary of this configured local path. It does not prove that every real-world ping failure is caused by a wrong IP address.
Restore the recorded address
Right-click PC2 and choose Console before typing. Read the original baseline first, restore the exact planned PC2 address and inspect it again. Do not change PC1 or add a router to make the test succeed.
ip 192.168.8.20/24
show ipWhat each command means
ip 192.168.8.20/24- Restore PC2 to its baseline address 192.168.8.20/24.
show ip- Confirm the address and mask match the original baseline before the recovery test.
- What you should see
- PC2 again shows 192.168.8.20 with mask 255.255.255.0. The planned local subnet is restored.
- Why this step matters
- Rollback is an exact restoration, not an unrelated workaround. Inspecting the restored value catches a second typing error before you judge recovery.
Verify forward recovery
Right-click PC1 and choose Console before typing. Repeat the same remote test used for the working baseline, now aimed at the restored PC2 address. Record the result beside the baseline and deliberate-fault observations.
ping 192.168.8.20 -c 3What each command means
ping 192.168.8.20 -c 3- Repeat three ICMP requests to the restored peer 192.168.8.20, using the same test as the baseline.
- What you should see
- Expect remote replies after restoration. If they remain absent, inspect both settings and exact cable endpoints instead of claiming the lab has recovered.
- Why this step matters
- Repeating the original check closes the experiment and distinguishes a restored configuration from an observed recovery.
Check the reverse direction
Right-click PC2 and choose Console before typing. Test PC1's address and record the result. This explicitly tests the other endpoint rather than PC2's own address, preventing a misleading self-test.
ping 192.168.8.10 -c 3What each command means
ping 192.168.8.10 -c 3- Send three ICMP echo requests from PC2 to the remote PC1 address 192.168.8.10.
- What you should see
- Expect replies from PC1 in the restored isolated topology. Keep this result separate from any claim about websites, throughput or Internet access.
- Why this step matters
- Two named remote checks make the test direction clear. A successful ping does not prove that every application or future route will work.
Verify
- Verify the arithmetic: network 192.168.8.0/24, mask 255.255.255.0, broadcast 192.168.8.255; neither PC uses a reserved boundary address.
- Inspect both show ip outputs and compare them to the saved baseline rather than relying on visual cable status alone.
- Record working baseline, deliberate wrong-subnet failure and restored remote replies as three separate observations.
- Confirm every ping targets the other PC's address appropriate to that step, not the sender's own address.
- Do not claim application health, VLAN security or routed connectivity from this local exercise.
Troubleshoot
- If a console does not open, start the intended VPCS node and check GNS3's configured console application. The built-in Ethernet switch does not provide an IOS command console.
- If the baseline repeatedly fails, compare both addresses and masks, inspect the two exact cable endpoints and confirm the switch ports use default access VLAN 1. Do not introduce the wrong address until baseline connectivity works.
- An initial timeout can accompany address discovery. In real networks, persistent loss may also involve filtering, host behavior, rate limits or link problems; ping alone does not identify a faulty layer.
- If the deliberate wrong-subnet test unexpectedly replies, stop and inspect the actual masks, routes and topology. Do not change the expected conclusion to fit an unexplained result.
- If recovery fails, restore the exact saved address and mask on PC2, inspect PC1 without changing it, and retest the baseline destination. Keep the project isolated throughout.
Built-in VPCS and Ethernet switch nodes require no Cisco image. GNS3 does not provide Cisco images. Use Cisco images only when the applicable license permits the intended use; do not share or redistribute image files. Cisco Modeling Labs is the official Cisco alternative.
- Restore the baseline PC2 address and verify the final remote results before stopping nodes.
- Save the topology and your text notes. VPCS address settings can be lost after a restart unless saved; re-enter and inspect the documented addresses when reopening.
- Stop the isolated project when finished. Never use these fault tests or rollback instructions on production or shared networks.
Practice set
Answer before you reveal
01What does /24 count?
It is not a host count. The remaining eight bits give 256 total addresses, of which 254 are ordinary usable host addresses in the /24 LAN example.
02What are the boundaries of 192.168.8.10/24?
Keep the first 24 bits and set the final eight host bits to zero or one. Both .10 and .20 lie inside the ordinary usable interval.
03What subnet contains 192.168.8.70/26?
A /26 has 64-address blocks in this fourth octet. Seventy lies between 64 and 127; ordinary host assignments range from .65 through .126.
04Why should you avoid assigning the broadcast address to PC2?
Use a unique address strictly inside the calculated host range. Do not extend this simplified host-assignment rule blindly to special /31 point-to-point or /32 cases.
05Does a failed ping identify the mask as the cause?
Real failures can involve hosts, filtering, rate limits or links. Our deliberate wrong-address experiment is interpretable because we first established a baseline and changed exactly one documented value.
06Why is no default gateway needed in the baseline lab?
No routed destination is tested. The wrong-subnet fault intentionally has no router or gateway path, and restoring the original address restores the planned local experiment.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Always read the address and configured prefix together.
- Use a defined method and check that the result contains the original host.
- Separate total addresses, ordinary usable hosts and special-prefix cases.
- A broadcast address is not a promise that every device will respond.
- Subnet arithmetic alone does not configure routing or enforce security.
- Inspect both endpoints, change one lab value and restore the recorded baseline.