Designing Subnets

As established in the previous section, subnet bits cannot be all zeros or all ones in classful environments.
Likewise, an IP host address cannot have all its host bits set to zero— this setting is reserved for the
address router's use to represent the network or subnet itself. And the host bits cannot be set to all ones, as
this setting is the broadcast address. These restrictions apply to the host bits with no exceptions and are
starting points for designing subnets. Beyond these starting points, network designers need to choose the
most appropriate subnetting scheme in terms of matching the address space to the particulars of an
internetwork.
When designing subnets and their masks, the number of available subnets under a major network address
and the number of available hosts on each subnet are both calculated with the same formula: 2 n – 2,
where n is the number of bits in the subnet or host space and 2 is subtracted to account for the unavailable
all-zeros and all-ones addresses. For example, given a class A address of 10.0.0.0, a subnet mask of
10.0.0.0/16 (255.255.0.0) means that the 8-bit subnet space will yield 28 – 2 = 254 available subnets and
216 – 2 = 65,534 host addresses available on each of those subnets. On the other hand, a mask of
10.0.0.0/24 (255.255.255.0) means that a 16-bit subnet space is yielding 65,534 subnets and an 8-bit host
space is yielding 254 host addresses for each subnet.
The following steps are used to subnet an IP address:
NOTE
A stepwise method for designing subnets
1. Determine how many subnets are required and how many hosts per subnet are required.
2. Use the 2 n – 2 formula to determine the number of subnet bits and the number of host bits that will
satisfy the requirements established in step 1. If multiple subnet masks can satisfy the
requirements, choose the one that will best scale to future needs. For example, if the internetwork
is most likely to grow by adding subnets, choose more subnet bits; if the internetwork is most
likely to grow by adding hosts to existing subnets, choose more host bits. Avoid choosing a
scheme in which either all subnets or all host addresses within the subnets will be used up
immediately, leaving no room for future growth.
3. Working in binary, determine all available bit combinations in the subnet space; in each instance,
set all the host bits to zero. Convert the resulting subnet addresses to dotted decimal. These are the
subnet addresses.
4. For each subnet address, again working in binary, write all possible bit combinations for the host
space without changing the subnet bits. Convert the results to dotted decimal; these are the host
addresses available for each subnet.
NOTE
When configuring subnets, always work in binary instead of dotted decimal.
The importance of doing the last two steps in binary cannot be overemphasized. The single greatest
source of mistakes when working with subnets is trying to work with them in dotted deci mal without
under standing what is happening at the binary level. Again, dotted decimal is for convenience in reading
and writing IP addresses. Routers and hosts see the addresses as 32-bit binary strings; to successfully
work with IP addresses, they must be seen the way the routers and hosts see them.
The last paragraph may seem a bit overzealous in light of the examples given so far; the patterns of subnet
and host addresses have been quite apparent without having to see the addresses and masks in binary. The
next section uses the four design steps to derive a subnet design in which the dotted-decimal
representations are not so obvious. 37

Subnets and Subnet Masks

NOTE
The need for network-level addressing
Never lose sight of why network-level addresses are necessary in the first place. For routing to be
accomplished, each and every data link (network) must have a unique address; in addition, each and every
host on that data link must have an address that both identifies it as a member of the network and
distinguishes it from any other host on that network.
As defined so far, a single class A, B, or C address can be used only on a single data link. To build an
internetwork, separate addresses must be used for each data link so that those networks are uniquely
identifiable. If a separate class A, B, or C address were assigned to each data link, less than 17 million
data links could be addressed before all IP addresses were depleted. This approach is obviously
impractical, [7] as is the fact that to make full use of the host address space in the previous example, more
than 65,000 devices would have to reside on data link 172.21.0.0!
[7] Seventeen million data links may seem like a lot until you consider that even a single moderate-size business may have dozens or hundreds of
data links.
The only way to make class A, B, or C addresses practical is by dividing each major address, such as
172.21.0.0, into subnetwork addresses. Recall two facts:
1. The host portion of an address can be used as desired.
2. The network portion of an IP address is determined by the address mask assigned to that interface.
Figure 2.13 shows an internetwork to which the major class B address 172.21.0.0 has been assigned. Five
data links are interconnecting the routers, each one of which requires a network address. As it stands,
172.21.0.0 would have to be assigned to a single data link, and then four more addresses would have to be
requested for the other four data links.

Notice what was done in Figure 2.13. The address mask is not a standard 16-bit mask for class B
addresses; the mask has been extended another eight bits so that the first 24 bits of the IP address are
interpreted as network bits. In other words, the routers and hosts have been given a mask that causes them
to read the first eight host bits as part of the network address. The result is that the major network address
applies to the entire internetwork, and each data link has become a subnetwork, or subnet. A subnet is a
subset of a major class A, B, or C address space.
NOTE
Subnet
NOTE
Subnet mask
The IP address now has three parts: the network part, the subnet part, and the host part. The address mask
is now a subnet mask, or a mask that is longer than the standard address mask. The first two octets of the
address will always be 172.21, but the third octet—whose bits are now subnet bits instead of host bits—
may range from 0 to 255. The internetwork in Figure 2.12 has subnets 1, 2, 3, 4, and 5 (172.21.1.0
through 172.21.5.0). Up to 256 subnets may be assigned under the single class B address, using the mask
shown.
Two words of caution are in order. First, not all routing protocols can support subnet addresses in which
the subnet bits are all zeros or all ones. The reason is that these protocols, called classful protocols, cannot
differentiate between an all-zero subnet and the major network number. For instance, subnet 0 in Figure
2.13 would be 172.21.0.0; the major IP address is also 172.21.0.0. The two cannot be distinguished
without further information.
NOTE
Classful protocols

Likewise, classful routing protocols cannot differentiate a broadcast on the all-ones subnet from an allsubnets
broadcast address.[8] For example, the all-ones subnet in Figure 2.13 would be 172.21.255.0. For
that subnet, the all-hosts broadcast address would be 172.21.255.255, but that is also the broadcast for all
hosts on all subnets of major network 172.21.0.0. Again, the two addresses cannot be distinguished
without further information. RIP version 1 and IGRP are both classful routing protocols; Chapter 7
introduces classless routing protocols, which can indeed use the all-zeros and all-ones subnets.
[8] The all-hosts IP broadcast address is all ones: 255.255.255.255. An all-hosts broadcast for a particular subnet would set all host bits to one; for
instance, an all hosts broadcast for subnet 172.21.1.0 would be 172.21.1.255. Finally, a broadcast for all hosts on all subnets sets the subnet bits
and the host bits to all ones: 172.21.255.255.
The second caution has to do with the verbal description of subnets and their masks. Subnetting the third
octet of a class B address, as is done is Figure 2.13, is very common; also common is hearing people
describe such a subnet design as "using a class C mask with a class B address," or "subnetting a class B
address into a class C." Both descriptions are wrong! Such descriptions frequently lead to
misunderstandings about the subnet design or to a poor understanding of subnetting itself. The proper
way to describe the subnetting scheme of Figure 2.12 is either as "a class B address with 8 bits of
subnetting," or as "a class B address with a 24-bit mask."
The subnet mask may be represented in any of three formats—dotted decimal, bitcount, and
hexadecimal—as shown in Figure 2.14. Dotted decimal is still the most common format, although the
bitcount format is becoming increasingly popular. Compared to dotted decimal, the bitcount format is
easier to write (the address is followed by a forward slash and the number of bits that are masked for the
network part). In addition, the bitcount format is more descriptive of what the mask is really doing and
therefore avoids the type of semantic misunderstandings described in the previous paragraph. Many
UNIX systems use the hexadecimal format.
Figure 2.14. The subnet mask in Figure 2.13 may be represented in three different formats.
Although the address mask must be specified to Cisco routers in dotted decimal, using the command
shown previously, the mask may be displayed by various show commands in any of the three formats by
using the command ip netmask-format [dec|hex|bit] in line configuration mode. For example, to
configure a router to display its masks in bitcount format, use:
Gladys(config)# line vty 0 4
Gladys(config-line)# ip netmask-format bit

Address Masksz

The address for an entire data link—a non-host-specific network address— is represented by the network
portion of an IP address, with all host bits set to zero. For instance, the InterNIC, the body that
administers IP addresses, might assign to an applicant an address of 172.21.0.0.[6] This address is a class B

address because 172 is between 128 and 191, so the last two octets make up the host bits. Notice that they
are all set to zero. The first 16 bits (172.21.) are assigned, but address owners are free to do whatever they
please with the host bits.
[6] Actually, this address would never be assigned. It is from a group of addresses reserved for private use; most of the addresses used in this book
are from this reserved pool, described in RFC 1918. Reserved addresses are: 10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, and
192.168.0.0-192.168.255.255.
Each device or interface will be assigned a unique, host-specific address such as 172.21.35.17. The
device, whether a host or a router, obviously needs to know its own address, but it also needs to be able to
determine the network to which it belongs— in this case, 172.21.0.0.
This task is accomplished by means of an address mask. The address mask is a 32-bit string, one bit for
each bit of the IP address. As a 32-bit string, the mask can be represented in dotted-decimal format just
like an IP address. This representation tends to be a stumbling block for some beginners: Although the
address mask can be written in dotted decimal, it is not an address. Table 2.3 shows the standard address
masks for the three classes of IP address.
Table 2.3. Address masks for class A, B, and C network addresses.
Class Mask Dotted Decimal
A 11111111000000000000000000000000 255.0.0.0
B 11111111111111110000000000000000 255.255.0.0
C 11111111111111111111111100000000 255.255.255.0
For each bit of the IP address, the device performs a Boolean (logical) AND function with the
corresponding bit of the address mask. The AND function can be stated as follows:
Compare two bits and derive a result. The result will be one if and only if both bits are one. If either or
both bits are zero, the result will be zero.
Figure 2.12 shows how, for a given IP address, the address mask is used to determine the network
address. The mask has a one in every bit position corresponding to a network bit of the address and a zero
in every bit position corresponding to a host bit. Because 172.21.35.17 is a class B address , the mask
must have the first two octets set to all ones and the last two octets, the host part, set to all zeros. As Table
2.3 shows, this mask can be represented in dotted decimal as 255.255.0.0.
Figure 2.12. Each bit of this class B address is ANDed with the corresponding bit of the address mask to
derive the network address.

A logical AND is performed on the IP address and its mask for every bit position; the result is shown in
Figure 2.12. In the result, every network bit is repeated, and all the host bits become zeros. So by
assigning an address of 172.21.35.17 and a mask of 255.255.0.0 to an interface, the device will know that
the interface belongs to network 172.21.0.0. Applying the AND operator to an IP address and its address
mask always reveals the network address.
An address and mask are assigned to an interface of a Cisco router (in this example, the E0 interface) by
means of the following commands:
Smokey(config)# interface ethernet 0
Smokey(config-if)# ip address 172.21.35.17 255.255.0.0
But why use address masks at all? So far, using the first octet rule seems much simpler.

The First Octet Rule

Without putting too fine a point on it, it can be said that there are three sizes of internetworks as measured
by the number of hosts: big, medium, and small.
Big internetworks, by definition, have a huge number of hosts. Relatively few big internetworks
exist.
Small internetworks are just the opposite. Each one is small because it has a small number of
hosts; a huge number of small internetworks exist.
Medium internetworks are just that: a medium number of them (in relation to big and small ones)
and a medium number of hosts in each one.
This high level of addressing focus requires three types—classes—of network address for the three sizes
of internetworks. Addresses for big internetworks need to be capable of addressing many hosts, but
because so few big internetworks exist, only a few big-network addresses are required.
The situation is reversed for small internetworks. Because there are many small internetworks, a large
number of small-network addresses are needed. But because a small internetwork has a small number of
hosts, each of the many network addresses only requires a few host addresses.
For medium-sized internetworks, a medium number of network addresses and a medium number of host
addresses will be available for each network address.
Figure 2.10 shows how the network and host portions of IP addresses are divvied up for these three
classes.
Figure 2.10. Class A, B, and C IP address formats.
The big, medium, and small networks described thus far map to address classes as follows:
Class A IP addresses are for big internetworks. The first octet is the network portion, and the last
three octets are the host portion. Only 256 numbers are available in the eight-bit network part, but
224 or 16,777,216 numbers are available in the host part of each of those network addresses.

Class B addresses are for medium-size internetworks. The first two octets are the network portion
, and the last two octets are the host portion. There are 216 or 65,536 available numbers in the
network part and an equal number in the host part.
Class C addresses are just the opposite of class A. The first three octets are the network portion,
and the last octet is the host portion.
Because all IP addresses are 32-bit binary strings, a way of distinguishing the class to which a particular
address belongs is necessary. The first octet rule, illustrated in Figure 2.11, provides the means to make
such a distinction and can be described as follows:
Figure 2.11. The first octet rule.
For class A addresses, the first bit of the first octet— that is, the left-most bit of the entire 32-bit
string— is always set to zero. Therefore, we can find the minimum and maximum numbers in the
class A range by setting all the remaining bits in the first octet to zero (for the minimum) and one
(for the maximum). This action results in the decimal numbers 0 and 127 with a few exceptions: 0
is reserved as part of the default address (Chapter 12, "Default Routes and On-Demand Routing"
), and 127 is reserved for internal loopback addresses.[4] That leaves 1 through 126; any IP address
whose first octet is between 1 and 126 inclusive is a class A address.
[4] UNIX machines use an internal loopback address (typically 127.0.0.1) to send traffic to themselves. Data may be sent to this
address and returned to the transmitting process without ever leaving the device.
Class B addresses always have their left-most bit set to one and the second bit set to zero. Again
finding the minimum and maximum number of the first octet by setting all remaining bits to zero
and then to one, we see in Figure 2.9 that any address whose first octet is in the decimal range 128
through 191 is a class B address.
In class C addresses, the first two bits are set to one, and the third bit is set to zero. The result is a
first octet range of 192 through 223.[5]
[5] Notice that 223 does not exhaust all available numbers in the first octet. See Configuration Excerise 1 at the end of this chapter.
So far IP addressing doesn't seem so difficult. A router or host could easily determine the network part of
an IP address by using the first octet rule. If the first bit is 0, then read the first eight bits to find the
network address. If the first two bits are 10, then read the first 16 bits; and if the first three bits are 110,
then read 24 bits in to get the network address. Unfortunately, things are not that easy.