ExamFinch.com My Study

Study guide

6.2 Subnetting & CIDR

Practice this exam

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

6.2 Subnetting & CIDR

Key Takeaways Explain This Topic AI

CIDR writes a network as address/prefix (e.g. 192.168.1.0/26) instead of relying on classful defaults

Host count for a subnet is 2^(host bits); usable hosts are usually 2^(host bits) − 2 (network and broadcast reserved)

Borrowing host bits creates more subnets; each borrowed bit doubles the number of subnets

Network address = all host bits 0; broadcast address = all host bits 1 within the prefix

  • Common exam prefixes: /24 (256 addresses), /25 (128), /26 (64), /27 (32), /28 (16), /30 (4)
  • Last updated: July 2026

Subnetting divides a larger address block into smaller networks. CIDR (Classless Inter-Domain Routing) is the modern way to write those blocks: network-address/prefix-length . On the Cyber Test, expect arithmetic: given an IP and a mask (or CIDR), find the network, broadcast, number of hosts, or the correct subnet for a host.

From Classful to Classless

Classful addressing forced /8 , /16 , or /24 based on the first octet. CIDR removes that restriction. An ISP can assign 203.0.113.0/26 even though the first octet looks "Class C." What matters is the prefix length , not the old class letter.

Writing forms you should recognize as equivalent:

  • 192.168.10.0/24
  • 192.168.10.0 with mask 255.255.255.0

Both mean: the first 24 bits identify the network; the last 8 bits identify the host.

The Core Formulas

Let n = prefix length (network bits). Then:

  • Host bits = 32 − n
  • Total addresses in the subnet = 2^(host bits)
  • Usable host addresses (typical Ethernet LAN) = 2^(host bits) − 2
  • Subtract 1 for the network address (host bits all 0)
  • Subtract 1 for the broadcast address (host bits all 1)
  • Prefix Mask Host bits Total addresses Usable hosts (typical)
  • /24 255.255.255.0 8 256 254
  • /25 255.255.255.128 7 128 126
  • /26 255.255.255.192 6 64 62
  • /27 255.255.255.224 5 32 30
  • /28 255.255.255.240 4 16 14
  • /29 255.255.255.248 3 8 6
  • /30 255.255.255.252 2 4 2
  • /32 255.255.255.255 0 1 1 (single host)

/30 is classic for point-to-point links (two usable addresses). /32 identifies one specific host in routing or firewall rules.

  • Worked Example 1: /24 Baseline
  • Given: 192.168.5.77/24
  • Host bits = 32 − 24 = 8
  • Block size in the last octet = 2^8 = 256 (the whole last octet)
  • Network: 192.168.5.0
  • Broadcast: 192.168.5.255
  • Usable hosts: 192.168.5.1 – 192.168.5.254 (254 hosts)
  • Host 192.168.5.77 is a valid usable address on that subnet
  • Worked Example 2: /26 Subnet Math

Given: Find network, broadcast, and usable range for 10.10.10.100/26 .

  • Host bits = 32 − 26 = 6
  • Addresses per subnet = 2^6 = 64
  • In the last octet, subnets jump by 64 : .0 , .64 , .128 , .192
  • Host .100 falls in the .64 block ( 64 ≤ 100 ≤ 127 )
  • Network: 10.10.10.64
  • Broadcast: 10.10.10.127 (64 + 64 − 1)
  • Usable hosts: 10.10.10.65 – 10.10.10.126 (62 hosts)
  • Confirm: 100 is between 65 and 126 → valid host on 10.10.10.64/26
  • Same problem with binary intuition

Mask /26 means the first 26 bits are network. The last octet binary for mask 255.255.255.192 is 11000000 — two network bits borrowed from what was a /24 , leaving six host bits. Those two borrowed bits create four /26 subnets inside a /24 .

Worked Example 3: Borrowing Bits Inside a /24

You own 192.168.20.0/24 and need 4 equal subnets .

  • Four subnets require 2^k ≥ 4 → borrow k = 2 bits
  • New prefix = /24 + 2 = /26
  • Each subnet has 2^(32−26) = 64 addresses and 62 usable hosts
  • Subnet Network Usable range Broadcast
  • 0 192.168.20.0/26 .1 – .62 .63
  • 1 192.168.20.64/26 .65 – .126 .127
  • 2 192.168.20.128/26 .129 – .190 .191
  • 3 192.168.20.192/26 .193 – .254 .255

If you instead needed at least 50 usable hosts per subnet inside that /24 :

  • Need 2^h − 2 ≥ 50 → 2^h ≥ 52 → h = 6 → prefix /26
  • Maximum equal /26 subnets from one /24 is still four — matches the table above
  • Worked Example 4: /28 and Broadcast Recognition

Given: What is the broadcast address of the subnet containing 172.16.8.19/28 ?

  • Host bits = 4 → block size = 16
  • Last-octet boundaries: .0 , .16 , .32 , …
  • .19 is in .16 – .31
  • Network: 172.16.8.16
  • Broadcast: 172.16.8.31
  • Usable: .17 – .30 (14 hosts)

A common trap is answering .19 or .16 as broadcast — broadcast is the last address in the block, not the host or network address.

Finding "Which Subnet?" Quickly

For prefixes that only change the last octet ( /24 through /30 ):

  • Compute block size = 256 − last mask octet (or 2^(32−prefix) )
  • Find the greatest multiple of the block size that is ≤ the host's last octet
  • That multiple is the subnet's network last octet; add block − 1 for broadcast
  • Example: mask 255.255.255.224 ( /27 ), host 192.168.1.70
  • Block size = 256 − 224 = 32
  • Multiples: 0, 32, 64, 96…
  • 70 → network .64 , broadcast .95
  • Classful vs Classless on Exam Wording
  • Wording cue How to think
  • "Class B network" / "default Class C mask" Historical default /16 or /24
  • "subnet mask 255.255.255.192" / "/26" Classless — do the bit math

"how many subnets" after borrowing 2^(borrowed bits) (sometimes exam variants exclude all-zero/all-one; Cyber Test-style aptitude usually wants the simple 2^k power-of-two count unless stated otherwise)

  • "how many hosts" Prefer 2^h − 2 for usable LAN hosts
  • Operational Cyber Angle

Subnetting is not only math for routers. Analysts use CIDR in firewall allowlists ( 10.0.0.0/8 ), intrusion signatures, and VPN pools. Choosing too-large prefixes opens unnecessary attack surface; too-small prefixes break legitimate hosts. Practice until network/broadcast/host-count problems feel mechanical — speed matters under timed testing.