In IPv4, how do you work out the usable host count for a prefix length, and the smallest prefix fitting a host requirement?
answer
- count bits, not addresses
- 32 minus the prefix length
- two host-part patterns are special
- round up, then check the minus two
basics
~20 sAn IPv4 /n prefix leaves 32 - n host bits: 2^(32 - n) addresses, minus the all-zeros network and all-ones broadcast addresses. To size a subnet, pick the fewest host bits h whose 2^h - 2 covers the hosts needed.
solid answer
~50 sCount host bits, not addresses: a /n prefix leaves `32 - n` bits for the host part, so the block holds `2^(32 - n)` addresses. Two are reserved - host bits all zeros is the subnet's network address and host bits all ones is its directed broadcast - so usable hosts are `2^(32 - n) - 2`: 254 for a /24, 62 for a /26, 14 for a /28, 2 for a /30. Going the other way, find the smallest `h` with `2^h - 2` at least the requirement and use `/(32 - h)`: 50 hosts need `h = 6` (62 usable), a /26, because `h = 5` gives only 30. The default gateway is an ordinary host and comes out of the usable count. The two exceptions are a /31 on a point-to-point link, where RFC 3021 makes both addresses hosts, and a /32, which is a single address.
go deeper
Recall the formula 2^(32 - n) - 2 and be able to produce 254, 126, 62, 30, 14, 6 and 2 for /24 to /30 without hesitation.
Explain which two host-part patterns are reserved and why, then size a subnet from a host requirement, catching the power-of-two trap where 64 hosts need a /25.
Size subnets with the gateway, appliances and growth counted in, and know that every extra subnet costs two more addresses, which matters when space is scarce.
Weigh tight address conservation against headroom: an undersized subnet forces renumbering later, and renumbering a live segment costs far more than the addresses saved.
## Host bits are the whole calculation An IPv4 address is 32 bits. A prefix length **/n** says the first *n* bits identify the subnet and the remaining **32 - n bits** identify a host inside it. Everything about a subnet's size follows from that one number, the count of **host bits**, written *h* below. - The block contains **2^h addresses** - every pattern the host bits can take. - Two of those patterns are reserved, so it has **2^h - 2 usable host addresses**. - The subnet mask is the same prefix written as 32 bits - *n* ones followed by *h* zeros - so `/26` and `255.255.255.192` say the same thing. Memorising a table is optional; counting host bits is not. A /26 leaves 6 host bits: 2^6 = 64 addresses, 62 usable hosts. ## Why exactly two addresses come off The reservation is defined on the **host part**, not on particular octet values: - **Host bits all zeros** - the address that names the subnet itself, its **network address**. For 192.0.2.64/26 that is `192.0.2.64`. - **Host bits all ones** - the subnet's **directed broadcast address**. For 192.0.2.64/26 that is `192.0.2.127`. The convention is older than CIDR. RFC 950 (1985) kept the rule that zero means "this" and all ones means "all" when it introduced subnets, and RFC 1122 (1989, section 3.2.1.3) states that a host-number field may not be all zeros or all ones outside those special meanings, noting that each field must therefore be at least two bits long. Nothing else inside an ordinary subnet is reserved by IPv4. The **default gateway** is an ordinary host address the administrator picks, so it is taken from the usable count; it is not one of the two. ## Common sizes at a glance | Prefix | Mask | Host bits | Addresses | Usable hosts | |---|---|---|---|---| | /22 | 255.255.252.0 | 10 | 1,024 | 1,022 | | /23 | 255.255.254.0 | 9 | 512 | 510 | | /24 | 255.255.255.0 | 8 | 256 | 254 | | /25 | 255.255.255.128 | 7 | 128 | 126 | | /26 | 255.255.255.192 | 6 | 64 | 62 | | /27 | 255.255.255.224 | 5 | 32 | 30 | | /28 | 255.255.255.240 | 4 | 16 | 14 | | /29 | 255.255.255.248 | 3 | 8 | 6 | | /30 | 255.255.255.252 | 2 | 4 | 2 | | /31 | 255.255.255.254 | 1 | 2 | 2, point-to-point only | | /32 | 255.255.255.255 | 0 | 1 | 1, a single address | RFC 4632, the current CIDR specification (it obsoletes RFC 1519), carries the same address counts in its prefix table and labels /32 a "host route" and /31 a "p2p link". ## Sizing a subnet for a requirement The reverse question - from "how many hosts" to "which prefix" - is asked just as often, and it is where the minus two bites: 1. Count every address the subnet must hold: hosts, the router interface or interfaces, any appliances, and the growth you expect. 2. Find the smallest *h* for which 2^h - 2 is at least that number. 3. The prefix is /(32 - h). Worked examples: - **50 hosts**: h = 5 gives 30, too few; h = 6 gives 62. Answer: **/26**. - **64 hosts**: h = 6 gives 62, two short; h = 7 gives 126. Answer: **/25**, not /26. - **100 hosts**: h = 7 gives 126. Answer: **/25**. - **500 hosts**: h = 8 gives 254; h = 9 gives 510. Answer: **/23**. A requirement that is exactly a power of two is the classic trap: a block of 2^h addresses never holds 2^h hosts. ## The exceptions and the traps - **/31**: 2^1 - 2 = 0, yet RFC 3021 lets both addresses be hosts on a point-to-point link, which has no use for a broadcast address. - **/32**: the formula gives -1, which is meaningless; a /32 names exactly one address rather than a subnet of hosts. - **One reserved pair per subnet, not per 256 addresses.** A /22 has 1,024 addresses and 1,022 usable hosts; an address ending in `.255` or `.0` in the middle of it is an ordinary host. - **The mask octet is not a host count.** `255.255.255.192` means 6 host bits, not 192 hosts. - **IPv4 only.** IPv6 has no broadcast address, so the minus-two arithmetic does not carry over.
- Why does an IPv4 /22 give 1,022 usable hosts rather than four times 254?A /22 is one subnet, not four /24s: it has one network address and one broadcast address for 2^10 = 1,024 addresses, so 1,022 usable. Four separate /24s would reserve two addresses each and give 1,016. Inside a /22, an address ending in .255 or .0 that is not at the block's edge is an ordinary host.
- Does the 2^n - 2 rule apply when sizing an IPv6 subnet?No. RFC 4291 says IPv6 has no broadcast addresses, so the all-ones pattern is not reserved for broadcast. It does predefine the Subnet-Router anycast address, the prefix with an all-zeros interface identifier. IPv6 sizing is about how many /64s a site needs, not hosts per subnet.
saying these in an interview costs you the question
- A /26 has 64 usable hosts because 2^6 is 64.
- The two subtracted addresses are the default gateway and the broadcast address.
- Only addresses ending in .0 and .255 are ever reserved, whatever the prefix.
- A /22 loses two addresses for each 256-address chunk inside it.
- The last octet of the mask, such as 192, is the number of hosts.