First, the essential ideas
- Bit and octet
- A bit is one binary digit, 0 or 1. An octet contains eight bits and can represent a decimal value from 0 to 255.
- IPv4 address
- A 32-bit network address, commonly written as four decimal octets, assigned to an interface; one device can have several interfaces and addresses.
- Interface and host
- An interface is a network connection on a device. A host is an endpoint that sends or receives data, such as a computer.
- Prefix and subnet mask
- The prefix length counts the leading network bits. A contiguous mask represents those bits as ones followed by host-bit zeros.
- Subnet
- An IP address block defined by a network address and prefix length. The host uses its mask to decide whether a destination belongs to its local subnet.
- Network and broadcast
- For an ordinary IPv4 LAN subnet, all-zero host bits identify the network and all-one host bits identify its directed broadcast, not ordinary host assignments.
- Usable host range
- The addresses between network and broadcast in the ordinary LAN examples here. Special /31 point-to-point and /32 cases use different rules.
- Default gateway
- A router's local address used for destinations without a more specific route. No gateway is configured in this isolated same-subnet lab.
- VPCS and console
- VPCS is GNS3's lightweight Virtual PC Simulator. Its console is a text window opened by right-clicking the named PC and choosing Console.
- ICMP and ping
- ICMP is an IP control-message protocol. Ordinary ping sends echo requests and reports replies or missing replies; it does not prove application health.
- Baseline and rollback
- A baseline records the intended settings and working observations. Rollback restores those exact settings after a controlled test.
A layered explanation is useful only when the basic words are clear. Start with the definitions below, then separate the paper calculation from the actual device test. An address plan predicts which settings belong together; the isolated experiment checks a particular configured path. Neither is evidence that an application or production security policy works.
See the idea
A /28 block around 192.168.9.33
Calculate the containing block first, then distinguish its network, ordinary host range and broadcast.
Read address and prefix
192.168.9.33/28 uses mask 255.255.255.240. Four host bits give a 16-address block; the changing octet is the fourth.
What this model leaves out: This conceptual calculation omits physical devices and traffic because it explains address boundaries. The separate lab names PC1, Switch1 and PC2; this is not their wiring diagram.
Full visual explanation and references
For 192.168.9.33/28, the calculation identifies network .32, ordinary hosts .33 through .46 and broadcast .47. This is an address-block model, not a packet path.
This conceptual calculation omits physical devices and traffic because it explains address boundaries. The separate lab names PC1, Switch1 and PC2; this is not their wiring diagram.
- Read address and prefix
192.168.9.33/28 uses mask 255.255.255.240. Four host bits give a 16-address block; the changing octet is the fourth.
www.cisco.comwww.rfc-editor.org - Find the containing block
The fourth-octet increment is 16. Thirty-three lies in the block 32 through 47, so network 192.168.9.32 and broadcast 192.168.9.47 bound this example.
www.cisco.comwww.rfc-editor.org - Check ordinary host space
Ordinary hosts run from 192.168.9.33 through 192.168.9.46. The lab uses .33 and .34. A separate /20 paper example shows a boundary in an earlier octet.
www.cisco.comwww.rfc-editor.org
One idea at a time
Start with something familiar.
No router command knowledge is assumed. Read the definitions first and write the address plan on paper. A console is the text window opened by right-clicking the named GNS3 PC and choosing Console; do not type commands into the switch or your computer's operating-system terminal.
Why learn this?
Subnetting organizes IP address blocks and helps you identify which destinations belong to a local subnet. It does not itself guarantee faster communication or prevent transmission errors. Calculating boundaries correctly helps avoid invalid host assignments and mismatched subnet settings.
An everyday comparison
Dividing a building address into floors and apartments to find a place easily.
What happens in a network
Subnet mask divides network and host parts to segment devices into subnets.
Where the comparison stopsThis is a memory aid, not a literal delivery process. Devices compare binary address bits and routing information; they do not understand streets, buildings or floors. The analogy cannot prove connectivity or security.
Follow one worked example
- Write the address and its prefix together.
The same decimal address can belong to different-sized blocks when its prefix changes. Copy both values before doing arithmetic; do not infer the mask from an old class label.
Why: An address without the configured mask is incomplete evidence for a subnet calculation.
- Calculate boundaries before assigning a host.
Find the network, last address and ordinary usable host range. Check that the example host lies inside the intended block, not on a reserved LAN boundary.
Why: Planning first makes off-by-one errors visible before you type a value into a device.
- Compare the plan with actual observations.
Inspect both PC configurations, test the named remote peer, change one documented address and restore it. Record unexpected results without inventing a successful transcript.
Why: A controlled baseline, fault and recovery exercise connects arithmetic to observable behavior without claiming to test production applications.
Your first small task
Apply all four steps to 192.168.9.33/28 on paper. Write the mask, changing octet, block increment, network, broadcast and usable range, then check that .33 is included.
Show a hint
Choose the largest multiple of 16 that does not exceed 33, then use the next block start to locate the broadcast.
Check the expected result
Mask 255.255.255.240; fourth-octet increment 16; network .32, broadcast .47, ordinary hosts .33 through .46.
Pause and explain it in your own words
Why is subtracting the last mask octet unsafe as a universal rule?
Show a hint
Compare /28 with /20 and identify the octet that contains both ones and zeros.
Show the explanation
The boundary can be in an earlier octet. For /20, use the third mask octet 240 and increment 16; the last mask octet is zero and does not identify the containing third-octet block.
Short answer
What should you understand today?
Use four checks: read the prefix and mask, locate the changing octet and block size, find the block containing the address, then calculate broadcast and usable hosts. The /28 example has 16-address blocks; the method must also handle prefixes whose boundary is in an earlier octet.
Before you begin
Learning targets
- Review the earlier endpoint and Ethernet lessons; all required addressing terms are defined here before the teaching body.
- Use GNS3 with its included VPCS and Ethernet switch nodes. No Cisco router image or IOS commands are required.
- Work in a fresh isolated project with no physical, Cloud, NAT or production-network connection.
- Have a plain-text notes application and a calculator or paper available; the calculation steps are explained before the lab.
- Translate the prefix into network and host bits before applying a shortcut.
- Find the changing octet rather than always subtracting the last mask octet.
- Calculate /28 and /20 boundaries and check that the original host is inside the result.
- Apply a small /28 plan to two virtual endpoints and distinguish arithmetic from observed reachability.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Bit and octet
A bit is one binary digit, 0 or 1. An octet contains eight bits and can represent a decimal value from 0 to 255.
IPv4 address
A 32-bit network address, commonly written as four decimal octets, assigned to an interface; one device can have several interfaces and addresses.
Interface and host
An interface is a network connection on a device. A host is an endpoint that sends or receives data, such as a computer.
Prefix and subnet mask
The prefix length counts the leading network bits. A contiguous mask represents those bits as ones followed by host-bit zeros.
Subnet
An IP address block defined by a network address and prefix length. The host uses its mask to decide whether a destination belongs to its local subnet.
Network and broadcast
For an ordinary IPv4 LAN subnet, all-zero host bits identify the network and all-one host bits identify its directed broadcast, not ordinary host assignments.
Usable host range
The addresses between network and broadcast in the ordinary LAN examples here. Special /31 point-to-point and /32 cases use different rules.
Default gateway
A router's local address used for destinations without a more specific route. No gateway is configured in this isolated same-subnet lab.
VPCS and console
VPCS is GNS3's lightweight Virtual PC Simulator. Its console is a text window opened by right-clicking the named PC and choosing Console.
ICMP and ping
ICMP is an IP control-message protocol. Ordinary ping sends echo requests and reports replies or missing replies; it does not prove application health.
Baseline and rollback
A baseline records the intended settings and working observations. Rollback restores those exact settings after a controlled test.
What the four-step method solves
Subnetting divides a parent address block into smaller aligned blocks. It helps organize an address plan, but arithmetic alone does not enforce a firewall policy, configure a VLAN or guarantee improved performance. Our task is precise: given an address and prefix, find its containing network, broadcast and ordinary host interval. Use four steps in the same order each time: read the prefix and mask, find the block size at the changing octet, locate the containing block, and check the boundaries. A changing octet is the mask octet that contains both network ones and host zeros. For whole-octet boundaries such as /24, use the boundary directly rather than forcing the partial-octet shortcut.
- Start from the given prefix, not an assumed address class.
- Subnet calculations do not configure routing or security controls.
- The final result must contain the original address.
Step one: identify the mask and host bits
An IPv4 address has 32 bits. For /28, 28 are network bits and four remain for hosts. The corresponding mask is 255.255.255.240 because the final octet 11110000 has decimal value 128 + 64 + 32 + 16 = 240. Four host bits give 2^4, or 16, total addresses. If a stated /24 parent is divided into /28 children, four additional network bits are used and the parent contains 16 equal child subnets. Without a stated parent prefix, do not call those four bits 'borrowed from a class C network'; the original block must be known. Separate the number of child subnets from the number of addresses in each child, even when those numbers happen to match.
- Host bits equal 32 minus prefix length.
- Borrowed bits require an explicitly identified parent prefix.
- Ordinary /28 LAN capacity is 14 usable hosts.
Steps two and three: locate the containing block
At a partial mask octet, subtract that octet from 256 to find its block increment. For /28, the changing octet is the fourth and 256 - 240 = 16. The blocks start at 0, 16, 32, 48 and so on. Choose the largest aligned start no greater than the address's changing octet. For a final octet of 33, choose 32, not 48. Preserve the earlier network octets and set any later octets to zero for the network address. This produces 192.168.9.32/28. The phrase 'subtract the last octet' is only correct when the boundary is actually in that last octet. Always identify where the network-host division occurs before using the decimal shortcut.
- Find the changing octet before calculating its increment.
- Round down to an aligned start, never up past the host.
- Keep earlier network octets and zero later host octets.
Step four: boundaries and an earlier-octet example
The broadcast is the address immediately before the next subnet. For 192.168.9.32/28 it is .47; ordinary usable hosts run from .33 to .46. Now test a wider block: 172.16.18.77/20 has mask 255.255.240.0, so the changing octet is the third. Its increment is 16. The third octet 18 belongs to the block 16 through 31, yielding network 172.16.16.0 and broadcast 172.16.31.255. Ordinary usable hosts range from 172.16.16.1 to 172.16.31.254. There are 12 host bits, 4096 total addresses and 4094 ordinary usable hosts. This example shows why repeatedly subtracting the final zero mask octet gives the wrong reasoning. Special /31 point-to-point links and /32 single-address prefixes are outside the ordinary subtract-two LAN rule.
- Broadcast is the last address of the containing block.
- For /20, the relevant increment is in the third octet.
- Do not apply ordinary LAN host rules to every /31 or /32.
Use the calculation without inventing connectivity
A correct paper answer does not install device settings. In the isolated lab, assign PC1 and PC2 separate addresses inside 192.168.9.32/28, inspect both masks and test the remote peer. The built-in switch does not route between subnets and requires no IOS commands. A deliberate change of PC2 to .50/28 puts it in a different block, .48 through .63. Because no gateway or router exists, the planned cross-subnet request should fail. Restore .34/28 and repeat the original test. Keep the failure claim specific to this controlled experiment: in real networks, missing replies can also result from filtering, host state, rate limits or link trouble. Do not promise every mismatched mask produces the same visible behavior.
- Validate actual settings separately from arithmetic.
- Test the named remote endpoint, never your own address.
- Restore the exact baseline and repeat the same check.
Real-world walkthrough
An address-plan review before a Day 9 lab change
A hypothetical training room needs an address plan that a second operator can check. A learner has written only a computer address and says it must be correct because it looks familiar. The reviewer asks for the prefix, boundary calculation, intended peer and a rollback record. This is a planning scenario, not a claim that the isolated lab implements an entire office network.
- Write the complete address and prefix for each proposed endpoint and identify the parent address block the exercise is allowed to use.
- Calculate the network, ordinary host range and broadcast before assigning anything; compare the results with the intended block and check for duplicate host addresses.
- Record exact lab cable endpoints and initial settings. Keep a copy of the baseline outside the device so an incorrect setting can be restored accurately.
- Configure only the two virtual endpoints in the isolated project, inspect both settings and test the remote peer. Keep actual output separate from expected results.
- Change just the documented fault value, record the failure, restore the baseline and repeat the original test. Escalate unexplained differences rather than claiming that subnetting alone created security.
Guided GNS3 lab
Day 9: calculate, configure, change and restore one subnet
Compare a calculated address plan with actual VPCS settings and remote ICMP results, then restore one deliberate wrong-subnet fault without changing shared or production networks.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| PC1 | Ethernet0 | 192.168.9.33/28 | First host in the planned local test. |
| PC2 | Ethernet0 | 192.168.9.34/28 | Remote peer; distinct from PC1. |
| Switch1 | Ethernet0 and Ethernet1 | No IP address required | Joins the two isolated local links. |
Set up the lab
- Create a fresh GNS3 project; use a configured local server or GNS3 VM appropriate to your installation.
- Drag two built-in VPCS nodes from End devices and a built-in Ethernet switch from Switches. Rename them PC1, PC2 and Switch1.
- Connect the exact interfaces in the topology. Start both PCs and leave the switch ports on their default access VLAN 1.
- Do not add a Cloud, NAT or physical network adapter. Perform these tests only in the isolated lab, never on production or shared traffic.
- Open Notepad on Windows, TextEdit in plain-text mode on macOS, or a plain-text editor on Linux. Save your baseline and observations as Day9-address-plan.txt.
Calculate before typing
On paper, record both endpoint addresses, the /28 prefix and mask 255.255.255.240. Calculate the full network and broadcast addresses before assigning anything. The increment is 16 in the fourth octet; .33 and .34 belong to the block .32 through .47, whose ordinary usable hosts are .33 through .46. These are calculations, not commands to type in a console.
- What you should see
- Your written plan identifies network 192.168.9.32/28 and broadcast 192.168.9.47, and places both proposed host addresses strictly between them.
- Why this step matters
- The arithmetic and the device configuration are separate checks. Establishing the expected plan first makes later discrepancies visible instead of silently accepting a typo.
Configure and inspect PC1
Right-click PC1 and choose Console before typing. Confirm the PC1> or VPCS> prompt, then enter the commands separately without typing the prompt itself. Copy the displayed settings into your baseline note.
ip 192.168.9.33/28
show ipWhat each command means
ip 192.168.9.33/28- Assign PC1 address 192.168.9.33 and prefix /28; no gateway is needed for this isolated local path.
show ip- Display the actual settings rather than assuming the previous input was correct; compare address and mask with the plan.
- What you should see
- PC1 shows 192.168.9.33 with mask 255.255.255.240. Stop if it differs from the written baseline.
- Why this step matters
- A configured value and a planned value can differ. Inspecting the actual endpoint first prevents a typo from being interpreted as a failure of the subnet calculation.
Configure and inspect PC2
Right-click PC2 and choose Console before typing. Check that the window belongs to PC2 rather than PC1. Assign its distinct address, inspect the result and copy the actual values into the same baseline note.
ip 192.168.9.34/28
show ipWhat each command means
ip 192.168.9.34/28- Assign PC2 its unique address 192.168.9.34 using the same /28 prefix as PC1.
show ip- Read PC2's actual address and mask so the remote end is verified independently.
- What you should see
- PC2 shows 192.168.9.34 with mask 255.255.255.240. Both endpoints are inside 192.168.9.32/28.
- Why this step matters
- Matching only one side is not enough. Both endpoints must agree with the intended addressing plan, and they must not use the same host address.
Test the remote baseline
Right-click PC1 and choose Console before typing. Test PC2's address, not PC1's own address. Repeat the bounded command if an initial request times out; do not introduce the fault until repeated baseline requests receive replies.
ping 192.168.9.34 -c 3What each command means
ping 192.168.9.34 -c 3- Send three ICMP echo requests to PC2 at 192.168.9.34; -c 3 limits the count. This is a remote reachability test, not an application test.
- What you should see
- The remote endpoint replies during the working baseline. Record actual results, including any initial missing replies, rather than copying a sample transcript.
- Why this step matters
- A working baseline is necessary for a meaningful fault comparison. Initial address discovery can delay a reply; persistent loss needs investigation before the experiment continues.
Introduce one wrong address
Right-click PC2 and choose Console before typing. Change only PC2 to 192.168.9.50/28; keep the cables, mask and PC1 unchanged. Inspect the new settings and mark this clearly as an intentional fault, not the final configuration.
ip 192.168.9.50/28
show ipWhat each command means
ip 192.168.9.50/28- Move PC2 to 192.168.9.50, outside PC1's /28 subnet, without adding a gateway or router.
show ip- Confirm that the wrong address was actually applied so the next observation has a known cause in this controlled lab.
- What you should see
- PC2 now shows 192.168.9.50/28. The original PC2 address is no longer the correct target during this fault step.
- Why this step matters
- Changing one documented value isolates the experiment. The switch still has the same cables; an IP subnet mismatch is not the same as a missing physical link.
Test the changed destination
Right-click PC1 and choose Console before typing. Test PC2's current wrong address, 192.168.9.50. There is no default gateway or router in this project, so PC1 has no configured path to that different subnet.
ping 192.168.9.50 -c 3What each command means
ping 192.168.9.50 -c 3- Try three ICMP requests to the deliberately changed PC2 address 192.168.9.50; the expected failure concerns this exact isolated address plan.
- What you should see
- Expect no successful remote echo replies; VPCS may report a missing gateway, unreachable destination or timeouts. Record its exact wording. Do not claim a successful cross-subnet exchange.
- Why this step matters
- The observation demonstrates the boundary of this configured local path. It does not prove that every real-world ping failure is caused by a wrong IP address.
Restore the recorded address
Right-click PC2 and choose Console before typing. Read the original baseline first, restore the exact planned PC2 address and inspect it again. Do not change PC1 or add a router to make the test succeed.
ip 192.168.9.34/28
show ipWhat each command means
ip 192.168.9.34/28- Restore PC2 to its baseline address 192.168.9.34/28.
show ip- Confirm the address and mask match the original baseline before the recovery test.
- What you should see
- PC2 again shows 192.168.9.34 with mask 255.255.255.240. The planned local subnet is restored.
- Why this step matters
- Rollback is an exact restoration, not an unrelated workaround. Inspecting the restored value catches a second typing error before you judge recovery.
Verify forward recovery
Right-click PC1 and choose Console before typing. Repeat the same remote test used for the working baseline, now aimed at the restored PC2 address. Record the result beside the baseline and deliberate-fault observations.
ping 192.168.9.34 -c 3What each command means
ping 192.168.9.34 -c 3- Repeat three ICMP requests to the restored peer 192.168.9.34, using the same test as the baseline.
- What you should see
- Expect remote replies after restoration. If they remain absent, inspect both settings and exact cable endpoints instead of claiming the lab has recovered.
- Why this step matters
- Repeating the original check closes the experiment and distinguishes a restored configuration from an observed recovery.
Check the reverse direction
Right-click PC2 and choose Console before typing. Test PC1's address and record the result. This explicitly tests the other endpoint rather than PC2's own address, preventing a misleading self-test.
ping 192.168.9.33 -c 3What each command means
ping 192.168.9.33 -c 3- Send three ICMP echo requests from PC2 to the remote PC1 address 192.168.9.33.
- What you should see
- Expect replies from PC1 in the restored isolated topology. Keep this result separate from any claim about websites, throughput or Internet access.
- Why this step matters
- Two named remote checks make the test direction clear. A successful ping does not prove that every application or future route will work.
Verify
- Verify the arithmetic: network 192.168.9.32/28, mask 255.255.255.240, broadcast 192.168.9.47; neither PC uses a reserved boundary address.
- Inspect both show ip outputs and compare them to the saved baseline rather than relying on visual cable status alone.
- Record working baseline, deliberate wrong-subnet failure and restored remote replies as three separate observations.
- Confirm every ping targets the other PC's address appropriate to that step, not the sender's own address.
- Do not claim application health, VLAN security or routed connectivity from this local exercise.
Troubleshoot
- If a console does not open, start the intended VPCS node and check GNS3's configured console application. The built-in Ethernet switch does not provide an IOS command console.
- If the baseline repeatedly fails, compare both addresses and masks, inspect the two exact cable endpoints and confirm the switch ports use default access VLAN 1. Do not introduce the wrong address until baseline connectivity works.
- An initial timeout can accompany address discovery. In real networks, persistent loss may also involve filtering, host behavior, rate limits or link problems; ping alone does not identify a faulty layer.
- If the deliberate wrong-subnet test unexpectedly replies, stop and inspect the actual masks, routes and topology. Do not change the expected conclusion to fit an unexplained result.
- If recovery fails, restore the exact saved address and mask on PC2, inspect PC1 without changing it, and retest the baseline destination. Keep the project isolated throughout.
Built-in VPCS and Ethernet switch nodes require no Cisco image. GNS3 does not provide Cisco images. Use Cisco images only when the applicable license permits the intended use; do not share or redistribute image files. Cisco Modeling Labs is the official Cisco alternative.
- Restore the baseline PC2 address and verify the final remote results before stopping nodes.
- Save the topology and your text notes. VPCS address settings can be lost after a restart unless saved; re-enter and inspect the documented addresses when reopening.
- Stop the isolated project when finished. Never use these fault tests or rollback instructions on production or shared networks.
Practice set
Answer before you reveal
01What is the ordinary host range for 192.168.9.33/28?
The containing network is .32 and broadcast is .47. Exclude those two boundaries for this ordinary LAN, leaving 14 usable host addresses.
02Which octet changes for 172.16.18.77/20?
Twenty network bits include 16 bits in the first two octets and four more in the third. The increment is 16 in that third octet, not 256 in the last.
03What are the /20 network and broadcast for 172.16.18.77?
The third octet 18 belongs to the 16-through-31 block. Set the remaining host bits to zero for the network and one for the broadcast.
04How many /28 children fit inside an explicitly given /24 parent?
The prefix increases by four bits, giving 2^4 child blocks. Each child also happens to have 16 total addresses, but that is a different calculation using its four host bits.
05Does subnetting alone enforce a firewall policy?
A network design may combine subnets, VLANs, routing and policy controls, but writing a prefix does not automatically create those configurations or prove isolation.
06Why does the .50/28 fault fail in this specific lab?
The conclusion depends on the documented two-PC topology and unchanged masks. It is not a claim that every failed ping in a real network has the same cause.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Always read the address and configured prefix together.
- Use a defined method and check that the result contains the original host.
- Separate total addresses, ordinary usable hosts and special-prefix cases.
- A broadcast address is not a promise that every device will respond.
- Subnet arithmetic alone does not configure routing or enforce security.
- Inspect both endpoints, change one lab value and restore the recorded baseline.