Core CS · Computer Networks

One line through thirty-two bits, and you get to move it

Q: Take 192.168.10.100 with a /26. Give me the network and broadcast addresses.

Network 192.168.10.64 , broadcast 192.168.10.127 . The mask is 255.255.255.192 , and only the last octet does anything: 01100100 AND 11000000 = 01000000 , which is 64. For the broadcast take that network and set all six host bits, 01000000 OR 00111111 = 01111111 , which is 127. The usable range is .65 to .126 , so 62 hosts. The broadcast is not .255 ; that one belongs to the fourth subnet, not this one.

Q: A host is 172.16.135.70 with mask 255.255.240.0. Prefix, number of subnets, hosts per subnet?

That mask is /20 , because 240 is 11110000 , so 16 plus 4 is 20 ones. The first octet 172 makes it class B with a default /16 , so 4 bits are borrowed and there are 2⁴ = 16 subnets. Twelve host bits remain, so 2¹² − 2 = 4,094 usable hosts each. The interesting octet is the third, block size 256 − 240 = 16 , and 135 rounds down to 128, so this host sits in 172.16.128.0/20 with broadcast 172.16.143.255 .

Q: A router holds 192.168.0.0/16 and 192.168.10.0/24 pointing different ways, and a packet arrives for 192.168.10.100. Which entry wins?

The /24 , by longest prefix match. A router always forwards on the most specific matching entry, meaning the one with the most network bits, and 24 matching bits beat 16. Overlapping entries are normal rather than a misconfiguration; that is precisely how a provider can advertise one aggregate while a customer advertises a more specific piece of it. The same rule explains why 0.0.0.0/0 is the default route of last resort: zero matching bits is the shortest possible prefix, so literally every other entry outranks it.

A class B network handed to a company with four sites uses about six per cent of its addresses and puts every machine into one broadcast domain. Borrowing bits from the host part fixes both. Every value an interviewer asks you for then falls out of one AND and one OR.

Step any address and mask through all eight derivations, in binary →

A subnet mask is a line drawn through 32 bits. Everything left of the line names the network, everything right of it names one host inside that network, and subnetting is nothing but moving the line to the right. Each bit you move it doubles the number of networks and halves the addresses in each one.

01 The idea

The boundary used to be fixed, and that was the whole problem

An IPv4 address is 32 bits and it is not one number. It is two, glued together: a network part that says which wire the machine is on, and a host part that says which machine on that wire. Every router on the planet reads the network part, ignores the host part, and forwards on that alone. So the only interesting question about an address is where the join sits, and for the twelve years between RFC 791 in 1981 and CIDR in 1993 the answer was decided for you by the first few bits.

That was classful addressing. If the first octet was 128 to 191 you had a class B, the join sat after 16 bits, and you owned one network with 65,534 usable addresses. There was no other option. Now take a real company: four sites, about a thousand machines at each. It is handed 172.16.0.0/16 and both things that follow are bad. It uses 4,000 of 65,534 addresses, which is about six per cent, and the other 94 per cent can be given to nobody else because the block is allocated. Worse, a class B is one network, which means one broadcast domain: the ARP request from the previous lesson would be flooded to all four sites, and there is no way to put a router between them, because a router routes between networks and this is one network.

Subnetting moves the join. You take bits off the front of the host part and hand them to the network part. Borrow four bits from 172.16.0.0/16 and the join moves to 20 bits: you now have 2⁴ = 16 separate networks of 2¹² − 2 = 4,094 usable addresses each. Four of them go to the four sites, twelve are held for growth, and each site is its own broadcast domain with a router between it and the rest. Nothing outside the company changed. The world still sees one 172.16.0.0/16 and routes to your border router; the split is a decision you made inside your own block.

The mask is how you write that decision down. It is 32 bits with ones over the network part and zeros over the host part, and it comes in two spellings for the same thing: dotted decimal 255.255.240.0, or slash notation /20 counting the ones. CIDR, Classless Inter-Domain Routing, standardised in 1993, is the decision to carry that mask everywhere and stop inferring anything from the first octet. Under CIDR the class of an address is a historical curiosity; a prefix can be any length, and blocks can be split downward or glued upward with the same arithmetic.

There is one cost, and it is the number students drop. Inside every block, two addresses are not assignable to a machine. The all-zeros host pattern is the network address, which is the name of the wire itself and what a routing table stores. The all-ones host pattern is the directed broadcast address, which reaches every host on that wire. So a block with h host bits holds 2ʰ addresses but only 2ʰ − 2 usable ones, and you pay that two once per subnet. Split a /24 four ways and you lose six addresses, because you went from one reserved pair to four.

Move the line right by b bits and you get 2ᵇ subnets, each with 2ʰ − 2 usable hosts where h = 32 − prefix. The minus two is the network address at the bottom of the block and the broadcast address at the top. Neither can be given to a machine, and you pay for both in every subnet you create.

Prefix length and subnet maskTwo spellings of one boundary. /26 counts the leading network bits; 255.255.255.192 writes the same 26 ones followed by 6 zeros across four octets. A machine is configured with one and a routing table prints the other, so you must be able to convert either way in your head.

Borrowed bitsThe bits you take from the host part and add to the network part, written b. Count them as the new prefix minus the prefix of the block you are splitting: /26 carved out of a /24 borrows 2. They multiply your subnets by 2ᵇ and they come out of your host count.

Block sizeHow far apart consecutive subnets sit, measured in the one octet where the mask is neither 255 nor 0. It is 256 − that octet, so 255.255.255.192 gives 256 − 192 = 64. Every network address in that split is a multiple of the block size, which is what makes the whole thing checkable without binary.

02 Worked example

Everything you can be asked about 192.168.10.100 slash 26

One address and one prefix, worked to the last bit. This is the scene for the rest of the lesson: it is the first preset in the console in section 04, it is the block the VLSM allocation later carves, and every number in the cheat sheet is checked against it. The address is 192.168.10.100 and the prefix is /26. Read left to right.

Write both in binary192.168.10.100 is 11000000 10101000 00001010 01100100. A /26 mask is 26 ones then 6 zeros: 255.255.255.192, because 11000000 = 128 + 64 = 192.

→

Count the borrowed bitsFirst octet 192, so this is class C territory and the parent block is a /24. 26 − 24 = 2 borrowed, so 2² = 4 subnets. That leaves 32 − 26 = 6 host bits.

→

AND for the networkLast octet only: 01100100 AND 11000000 = 01000000 = 64. The other three octets sit under all ones and pass through unchanged. Network address 192.168.10.64/26.

→

OR the host bits to oneTake the network and set all 6 host bits: 01000000 OR 00111111 = 01111111 = 127. Broadcast address 192.168.10.127. It is not .255, because the block stops at 127.

→

Read off the restUsable range .65 to .126, which is 2⁶ − 2 = 62 addresses. Block size 256 − 192 = 64. Next subnet 64 + 64, so 192.168.10.128/26.

Eight answers from one address and one prefix: mask 255.255.255.192, 4 subnets, network 192.168.10.64, broadcast 192.168.10.127, first usable .65, last usable .126, 62 usable hosts, block size 64. Check the count two ways, because that is where the marks go: 126 − 65 + 1 = 62 by counting, and 2⁶ − 2 = 64 − 2 = 62 by formula. If those two disagree you have miscounted the host bits.

The highlighted node is the one to slow down on, because the AND is the only step where the mask does real work rather than being described. A one in the mask means keep this bit, a zero means force it to zero. So ANDing an address with its mask does exactly one thing: it clears the host part and leaves the network part alone. That is why the result is called the network address. It is not a special address that was chosen, it is what your address becomes when you delete the part that identifies you specifically. Every host in the block produces the same result, and that is the definition of being in the same block.

Now the shortcut, and the reason to trust it. The block size or magic number method skips binary entirely: take the octet of the mask that is neither 255 nor 0, here the fourth at 192, subtract it from 256 to get 64, and then the network address is the largest multiple of 64 that does not exceed your address octet. Your octet is 100, and the multiples of 64 are 0, 64, 128, 192, so the answer is 64. The same 64 the AND produced. The broadcast is one below the next multiple, 128 − 1 = 127. The same 127 the OR produced.

The two methods agree because they are the same statement. Forcing the low six bits to zero is rounding down to a multiple of 2⁶ = 64; that is what a binary place-value system means. Learn the shortcut for speed in an exam, but do the binary at least once for every mask you meet, because the shortcut has no defence against picking the wrong octet. On 255.255.240.0 the interesting octet is the third, the block size is 16, and it is the third octet you round down, not the fourth. Section 04 lets you watch both run side by side on any address you type.

03 Mechanics

The classes, the formulas, the mask table and VLSM

Four tables, in the order the questions come. First the classes, because half of subnetting questions are still phrased in terms of them even though the mechanism no longer uses them. The leading-bits column is where the boundaries actually come from: they are not arbitrary ranges, they are what the first one to four bits force the first octet to be.

Class	Leading bits	First octet	Default mask	Networks	Usable hosts each
A	`0`	`1 to 126`	`255.0.0.0 = /8`	126	16,777,214
B	`10`	`128 to 191`	`255.255.0.0 = /16`	16,384	65,534
C	`110`	`192 to 223`	`255.255.255.0 = /24`	2,097,152	254
D	`1110`	`224 to 239`	none, multicast	Group addresses. No host part, so nothing to subnet.
E	`1111`	`240 to 255`	none, reserved	Experimental, never assigned to hosts.
The gap at 127. Class A stops at 126 rather than 127 because 127.0.0.0/8 is loopback, and 0.0.0.0/8 is not usable either, so 128 possible values give 126 networks.

The private ranges, which are not a class rule and get misquoted constantly. RFC 1918 sets aside exactly three blocks that no router on the public Internet will carry: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Note the middle one carefully. A /12 means 12 fixed bits, so the second octet varies over its low four bits from 16 to 31: the range runs 172.16.0.0 to 172.31.255.255. It is not 172.16.255.255, and it does not reach 172.32.0.0. Separately, 169.254.0.0/16 is APIPA, the link-local block a host gives itself when DHCP fails, and seeing one of those addresses on a machine tells you DHCP is broken rather than that somebody subnetted badly.

Now the derivation set. Every subnetting question in an interview or a written paper is some subset of these twelve rows, and the last column is the specific wrong answer that gets written down, not a general caution.

What you want	How you get it	For 192.168.10.100/26	The mistake
Prefix length	Count the ones in the mask	`/26`	`calling it /24` because three octets are 255
Subnet mask	p ones, then 32 − p zeros	`255.255.255.192`	Writing 193. A mask byte can only be 0, 128, 192, 224, 240, 248, 252, 254 or 255.
Borrowed bits b	New prefix − parent prefix	`26 − 24 = 2`	Counting from /32, or counting host bits.
Number of subnets	2ᵇ	`2² = 4`	`2ᵇ − 2 = 2` — an obsolete rule, see the note below
Host bits h	32 − prefix	`32 − 26 = 6`	Using b here. They are different numbers.
Usable hosts	2ʰ − 2	`64 − 2 = 62`	`answering 64` — the classic dropped mark
Block size	256 − the mask octet that is neither 0 nor 255	`256 − 192 = 64`	`255 − 192 = 63`
Network address	Address AND mask	`192.168.10.64`	Guessing 192.168.10.0 from the third octet.
Broadcast address	Network with every host bit set to 1	`192.168.10.127`	`192.168.10.255` — that belongs to the last subnet
First usable host	Network + 1	`192.168.10.65`	Handing out the network address itself.
Last usable host	Broadcast − 1	`192.168.10.126`	Handing out the broadcast address.
Next subnet	Network + block size	`64 + 64 = 192.168.10.128`	Adding 1 to the broadcast in the wrong octet.

Why the subnet count is 2ᵇ and not 2ᵇ − 2. Older textbooks subtract two subnets as well as two hosts, on the grounds that the all-zeros subnet looked like the parent network and the all-ones subnet looked like a broadcast to it. RFC 1878 and RFC 1812 removed that restriction, and Cisco IOS has had ip subnet-zero enabled by default since release 12.0, so both subnets are ordinary and usable. Answer 2ᵇ. If a question explicitly says to exclude subnet zero, subtract two and say out loud that you are following the older convention — that sentence is worth more than the number.

This is the table to memorise. Six rows, and once you know them you never compute a class C split again. Read the block-size column as the step between consecutive network addresses and the whole thing becomes a counting exercise.

Prefix	Mask	Block size	Subnets of a /24	Addresses	Usable hosts
`/25`	`255.255.255.128`	128	2	128	126
`/26`	`255.255.255.192`	64	4	64	62
`/27`	`255.255.255.224`	32	8	32	30
`/28`	`255.255.255.240`	16	16	16	14
`/29`	`255.255.255.248`	8	32	8	6
`/30`	`255.255.255.252`	4	64	4	`2`

The same six numbers, one octet to the left. When the prefix lands between /17 and /23 nothing changes except which octet you work in, and the block size counts in the third octet: /17 is 255.255.128.0 block 128 and 32,766 hosts, /18 is 255.255.192.0 block 64 and 16,382, /19 is 255.255.224.0 block 32 and 8,190, /20 is 255.255.240.0 block 16 and 4,094, /21 is 255.255.248.0 block 8 and 2,046, /22 is 255.255.252.0 block 4 and 1,022, /23 is 255.255.254.0 block 2 and 510. The mask bytes 128, 192, 224, 240, 248, 252, 254 are the same seven values in the same order wherever they appear, which is the only thing worth memorising.

Three prefixes behave unlike the rest, and the first of them is the one candidates trip on.

Prefix	Addresses	Usable	What it is for
`/30`	4	`2`	The classic router-to-router link. Two endpoints need two addresses, and the reserved pair costs you the other half of the block, so a point-to-point /30 runs at 50 per cent efficiency by design.
`/31`	2	`2`	RFC 3021. On a link with exactly two endpoints there is nobody a broadcast could usefully reach that a unicast would not, so both addresses are assignable. 2ʰ − 2 does not apply here, and quoting 0 is the trap.
`/32`	1	`1`	A host route: one exact address. Used for loopback interfaces, which are always up, and for pinning traffic for a single machine. 2ʰ − 2 does not apply here either.

VLSM, worked completely. Fixed-size subnetting gives every subnet the same prefix, which is wasteful the moment your groups differ in size. Variable Length Subnet Masking lets each subnet have its own prefix, carved out of one block. Take our 192.168.10.0/24 and five requirements: Sales 60 hosts, Engineering 55, Support 25, Lab 12, and one router-to-router link needing 2. Allocate the largest first. Sales needs 60, and 2⁵ − 2 = 30 is too small while 2⁶ − 2 = 62 fits, so Sales takes a /26, block 64: 192.168.10.0/26, range .0 to .63. Engineering needs 55, also a /26: next free address is .64, which is a multiple of 64, so 192.168.10.64/26, range .64 to .127 — the very block section 02 derived, which makes 192.168.10.100 an Engineering machine. Support needs 25 so a /27, block 32: next free is .128, a multiple of 32, giving 192.168.10.128/27, range .128 to .159. Lab needs 12 so a /28, block 16: .160 is a multiple of 16, giving 192.168.10.160/28, range .160 to .175. The link needs 2 so a /30, block 4: .176 is a multiple of 4, giving 192.168.10.176/30, range .176 to .179. Total consumed 64 + 64 + 32 + 16 + 4 = 180, so .180 to .255 stays free, which is 76 addresses still in hand. Fixed /26 subnetting could not have done this at all: four /26s consume the entire /24, leaving nothing for the link, and the Lab would sit on 62 addresses to hold 12.

And why largest first, specifically. The rule is not style, it is alignment. A block of size s must start on a multiple of s, so a small block placed early leaves a gap that a larger block cannot legally start in. Run the same five requirements smallest first and watch it happen. The /30 goes at .0 and ends at .3. The Lab /28 must start on a multiple of 16, and .4 is not one, so it jumps to .16 and strands .4 to .15, twelve addresses that no block of 16 or more can ever use. Support then takes .32 to .63, Engineering .64 to .127, Sales .128 to .191, and the free space left at the top is .192 to .255, only 64 addresses. Largest first left 76 free, smallest first left 64, and the difference is exactly the 12 addresses stranded in that hole. Descending order guarantees every start address is already a multiple of every smaller block size, so no hole can open.

Supernetting, which is the same arithmetic run backwards. Subnetting moves the line right and makes many small blocks; route aggregation, also called supernetting, moves the line left and turns many blocks into one advertisement. Take 192.168.8.0/24, 192.168.9.0/24, 192.168.10.0/24 and 192.168.11.0/24. Write the third octets in binary: 00001000, 00001001, 00001010, 00001011. The first six bits are identical and only the last two vary, so the common prefix is 16 + 6 = 22 bits and the aggregate is 192.168.8.0/22, mask 255.255.252.0, covering 192.168.8.0 to 192.168.11.255, which is 2¹⁰ − 2 = 1,022 usable addresses. Four routing entries became one. Two conditions must hold: the blocks must be contiguous, and the aggregate must start on a multiple of its own size. Starting at 192.168.9.0 instead, 9 is not a multiple of 4, and no single /22 covers those four blocks. This is why the Internet still works: without CIDR every one of those /24s would be a separate line in the global BGP table, which already carries on the order of a million IPv4 prefixes.

Longest prefix match, and why aggregating is safe. A router can hold overlapping entries, and it does not treat that as a conflict. It forwards on the most specific match, meaning the one with the longest prefix. Given 192.168.0.0/16 pointing one way and 192.168.10.0/24 pointing another, a packet for 192.168.10.100 takes the /24, because 24 matching bits beat 16. That single rule is what lets a provider advertise one aggregate while a customer advertises a more specific piece of it, and it is why 0.0.0.0/0, the default route, is the last resort: zero matching bits is the shortest prefix there is, so every other entry outranks it.

05 Cheat sheet

Twelve answers to have ready on the morning

Every row is something you can be asked to state or compute in under ten seconds. The right-hand column is the specific wrong answer that gets given, not a general caution.

What they ask	The answer	The trap
Number of subnets from b borrowed bits	`2ᵇ`	`2ᵇ − 2` — obsolete since RFC 1878; subnet zero is legal
Usable hosts in a subnet	`2ʰ − 2, where h = 32 − prefix`	`2ʰ` — the network and broadcast addresses are real addresses
Block size	`256 − the mask octet that is neither 0 nor 255`	Subtracting from 255, or picking the wrong octet.
Network address	`address AND mask`	Assuming the host octet becomes 0. It becomes the nearest lower multiple of the block size.
Broadcast address	`network with every host bit set to 1`	`always ending .255` — only true for the last subnet
First and last usable	`network + 1 and broadcast − 1`	Off by one at the top. The last usable is one below the broadcast, not the broadcast.
Next subnet	`network + block size`	Adding 1 to the broadcast in the wrong octet.
Mask bytes, in order	`128 192 224 240 248 252 254 255`	`writing a mask like 255.255.255.193` — the ones must be contiguous
Class defaults	`A 1–126 /8, B 128–191 /16, C 192–223 /24`	Saying class A ends at 127. That block is loopback.
RFC 1918 private ranges	`10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16`	`ending the middle one at 172.16.255.255` — it runs to 172.31.255.255
Point-to-point link	`/30 gives 2 usable; /31 also gives 2, per RFC 3021`	Applying 2ʰ − 2 to a /31 and answering 0.
Aggregating n blocks into one	`count the common leading bits; that count is the prefix`	`forgetting alignment` — the aggregate must start on a multiple of its own size

One bit, twice as many, half as bigEvery borrowed bit doubles the subnet count and halves the addresses in each subnet. The product never changes, because you are relabelling the same 32 bits rather than creating any. If your two numbers do not multiply back to the parent size, you have miscounted.

The minus two is two real addressesThe all-zeros host pattern names the wire and is what a routing table stores; the all-ones pattern reaches every host on it. Neither can be configured on a machine, and you pay for both in every subnet, which is why splitting a /24 four ways costs six usable addresses.

Block size is the whole shortcutEvery network address in a split is a multiple of the block size, so rounding your octet down to the nearest multiple gives the network and one below the next multiple gives the broadcast. That agrees with the AND because clearing the low h bits is rounding down to a multiple of 2ʰ.

06 Where & why

The mask is a value you type into real systems

Nothing in this lesson is a teaching abstraction. Every number here is something you configure, print, or are billed for on systems you will meet in your first year of work, and two of these four differ from the textbook in a way worth naming out loud.

Linux · ip route

Slash notation everywhere, and a tool that prints section 04

ip -4 addr show prints interface addresses as 192.168.10.100/26, and ip route add 192.168.10.64/26 dev eth0 installs the route in the same spelling; the kernel never wants a dotted-decimal mask. ipcalc 192.168.10.100/26 prints the network, broadcast, first and last usable host and the host count, which is exactly the eight values the console derives. When two routes overlap, ip route get 192.168.10.100 tells you which one actually wins, which is longest prefix match made visible.

Cisco IOS

Dotted decimal on interfaces, and one legacy switch

An interface takes the mask the long way: ip address 192.168.10.65 255.255.255.192, which is why the mask table in section 03 is the one you convert from under pressure. Aggregation is configured by hand rather than inferred: ip summary-address eigrp on an interface, or area range on an OSPF area border router. And the historical restriction on the all-zeros subnet lives here as ip subnet-zero, on by default since IOS 12.0, which is the concrete reason the modern answer to the subnet count is 2ᵇ.

AWS VPC

Five reserved addresses per subnet, not two

A VPC takes a CIDR block between /16 and /28, and you carve subnets out of it exactly as in section 03. The difference to name in an interview: AWS reserves the first four addresses and the last one in every subnet, for the network address, the VPC router, DNS, a future use, and broadcast. So a /28 holds 16 addresses and gives you 11 usable, not the 14 the textbook formula predicts. Size a subnet with 2ʰ − 5 there and you will not be short on launch day.

Google Public DNS 8.8.8.8

Why that address is announced as a whole /24

Google advertises 8.8.8.0/24 and 8.8.4.0/24 into BGP, not a single /32 for the resolver itself. Most operators filter anything longer than a /24 out of the global table, so a /24 is in practice the smallest piece of public IPv4 you can independently announce, whatever the arithmetic allows. That filter is aggregation policy doing its job: it is what stops a table already holding on the order of a million prefixes from being split into hundreds of millions.

The mask is not paperwork. It is the value every host consults before it sends anything: mask the destination, compare with your own network, and deliver directly if they match or hand the frame to the router if they do not. Get the mask wrong and nothing reports an error — the machine asks the wrong question, quietly, for as long as it is switched on.

07 Interview questions

What they ask, and what they change halfway through

This is the most computed topic in the subject, so expect a whiteboard. The reliable pattern is that they hand you an address and a mask, let you answer, then change one bit of the mask and watch whether you recompute or recite. Say the method out loud as you go; a right answer with no visible working reads as memorisation.

What is subnetting, and what does it actually buy you?

It is moving the boundary between the network part and the host part of an address to the right, by taking bits off the front of the host part. You do it for two reasons at once. It splits one block into 2ᵇ separately routable networks, so you stop wasting a block sized for 65,534 machines on a site that has a thousand, and it gives each one its own broadcast domain, so an ARP broadcast at one site is not flooded to the other three. The outside world sees no change at all, because the split is described by a mask that only your own routers carry.

Take 192.168.10.100 with a /26. Give me the network and broadcast addresses.

Network 192.168.10.64, broadcast 192.168.10.127. The mask is 255.255.255.192, and only the last octet does anything: 01100100 AND 11000000 = 01000000, which is 64. For the broadcast take that network and set all six host bits, 01000000 OR 00111111 = 01111111, which is 127. The usable range is .65 to .126, so 62 hosts. The broadcast is not .255; that one belongs to the fourth subnet, not this one.

Why is it 2 to the power h minus 2, and is there anywhere that minus 2 does not apply?

Because two of the addresses in every block are already spoken for. The all-zeros host pattern is the network address, which names the wire itself and is what a routing table stores, and the all-ones pattern is the directed broadcast, which reaches every host on that wire. Neither can be configured on a machine. It does not apply to a /31, where RFC 3021 makes both addresses usable because a link with exactly two endpoints has no use for a broadcast, and it does not apply to a /32 host route. Quoting 0 usable hosts for a /31 is the standard slip.

Explain the block size or magic number method, and tell me why it is safe to use.

Look at the octet of the mask that is neither 255 nor 0, subtract it from 256, and that is the block size. Every network address in the split is a multiple of it, so you round your address octet down to the nearest multiple to get the network, and one below the next multiple is the broadcast. It is safe because it is not a different rule: clearing the low h bits of a binary number is exactly rounding it down to a multiple of 2ʰ, so the AND and the shortcut are the same operation described twice. Its one weakness is that nothing stops you picking the wrong octet, which is why 255.255.240.0 must be worked in the third octet and not the fourth.

What did CIDR change compared with classful addressing?

It stopped the first few bits of the address deciding the prefix length, and made the prefix an explicit value carried alongside the address. Under classes you got a /8, a /16 or a /24 and nothing in between, which meant an organisation needing 2,000 addresses either took a class B and wasted 63,000 or took eight class Cs and put eight lines into everybody’s routing table. CIDR lets the prefix be any length, so the block can be sized to the requirement, and it lets adjacent blocks be advertised as one shorter prefix. It was standardised in 1993, and both address exhaustion and routing-table growth were the reasons.

A host is 172.16.135.70 with mask 255.255.240.0. Prefix, number of subnets, hosts per subnet?

That mask is /20, because 240 is 11110000, so 16 plus 4 is 20 ones. The first octet 172 makes it class B with a default /16, so 4 bits are borrowed and there are 2⁴ = 16 subnets. Twelve host bits remain, so 2¹² − 2 = 4,094 usable hosts each. The interesting octet is the third, block size 256 − 240 = 16, and 135 rounds down to 128, so this host sits in 172.16.128.0/20 with broadcast 172.16.143.255.

What is VLSM, and why do you allocate the largest requirement first?

VLSM is giving each subnet its own prefix length inside one parent block, instead of splitting it into equal pieces, so a link that needs 2 addresses gets a /30 while a department that needs 60 gets a /26. Largest first is about alignment, not tidiness: a block of size s must start on an address that is a multiple of s. If you place small blocks first they leave the pointer at an address that a larger block cannot legally start on, so you have to skip forward and strand everything in between. Descending order guarantees each start address is already a multiple of every smaller size, so no hole can ever open.

What is route aggregation, and why does the Internet need it?

It is subnetting run backwards: several contiguous blocks are advertised as one shorter prefix, so several routing entries become one. You find it by writing the varying octet in binary and counting the bits that all the blocks share; that count is the aggregate prefix. Two conditions have to hold, that the blocks are contiguous and that the aggregate starts on a multiple of its own size. It matters because every router carrying a full view of the Internet holds the whole table in fast memory, and that table is already on the order of a million IPv4 prefixes. Without aggregation it would be a multiple of that, and the cost lands in router hardware everywhere at once.

A router holds 192.168.0.0/16 and 192.168.10.0/24 pointing different ways, and a packet arrives for 192.168.10.100. Which entry wins?

The /24, by longest prefix match. A router always forwards on the most specific matching entry, meaning the one with the most network bits, and 24 matching bits beat 16. Overlapping entries are normal rather than a misconfiguration; that is precisely how a provider can advertise one aggregate while a customer advertises a more specific piece of it. The same rule explains why 0.0.0.0/0 is the default route of last resort: zero matching bits is the shortest possible prefix, so literally every other entry outranks it.

Why is a point-to-point link between two routers usually a /30, and what is a /31 for?

Hard

A site has 192.168.30.0/24. It has four departments of 20 machines each today, each expected to reach 45 within a year, plus three router-to-router links. Show that the year-out requirement cannot be met from this block, give exactly how many addresses short it is, and name the smallest single CIDR block that would hold the whole design.

Follow-up

The requirement fits comfortably today and does not fit at all next year, and the total address count is not what decides it. Two designs can need the same number of addresses and only one of them can be laid out, because a block has to start on a multiple of its own size.

Show the hint

Size every department for the number it will hold next year rather than today, then add block sizes rather than host counts, and remember that the answer for the final part can only be a whole prefix length.