There are two kinds of Network+ candidates. The ones who can subnet in their heads in under 30 seconds, and the ones who can’t and run out of time on the exam. The gap between those two is one technique: the magic-number method.
This post is the complete walkthrough — the trick, why it works, how to apply it to any prefix length, the worked example for /29 that comes up on every Network+ exam attempt, and the 5-minute practice routine that turns this from “I sort of remember the trick” into reflex.
Why binary subnetting will kill you on the exam
Every textbook teaches subnetting by converting to binary first. You write out the 32-bit address in binary, write out the subnet mask in binary, AND them together to get the network address, and figure out the rest from there.
That works. It’s how subnetting actually functions under the hood. But on a 90-question exam where you have ~60 seconds per question, you do not have time to convert 192.168.47.213 to binary, AND it with 11111111.11111111.11111111.11100000, convert back to decimal, and write out the network and broadcast.
You need a method that works in decimal, in your head, in 30 seconds. The magic-number method is that method.
The magic number — one rule to learn
The entire trick is this one sentence:
Subtract the interesting octet of the subnet mask from 256. The result is your block size.
That’s it. Everything else flows from that single calculation.
The “interesting octet” is the one that isn’t 0 or 255. For 255.255.255.224, the interesting octet is 224, so the magic number (block size) is 256 - 224 = 32. For 255.255.240.0, the interesting octet is 240, so the magic number is 256 - 240 = 16.
Once you have the block size, three answers fall out:
- The subnet boundaries — start at 0, add the block size repeatedly. For a /27 (block size 32), the subnets in the interesting octet are 0, 32, 64, 96, 128, 160, 192, 224.
- The network address for any IP — find the subnet boundary that the IP falls into. 192.168.1.100 with a /27 falls in the 96 subnet, so the network is 192.168.1.96.
- The broadcast address — find the next subnet boundary and subtract 1. 192.168.1.96/27 has the next boundary at 128, so the broadcast is 192.168.1.127.
That’s the whole method. Three values from one subtraction.
Why this works (in case you want the math)
A subnet mask of 255.255.255.224 in binary is 11111111.11111111.11111111.11100000. The interesting octet 224 is 11100000 — the top 3 bits are network, bottom 5 bits are host.
5 host bits = 2^5 = 32 addresses per subnet. That’s your block size. The “subtract from 256” trick works because the mask values you’ll encounter (128, 192, 224, 240, 248, 252, 254) are the exact complements of the powers of 2 host counts (128, 64, 32, 16, 8, 4, 2).
| Mask octet | 256 minus | Block size | Host bits | Total addresses | Usable hosts |
|---|---|---|---|---|---|
| 128 | 128 | 128 | 7 | 128 | 126 |
| 192 | 64 | 64 | 6 | 64 | 62 |
| 224 | 32 | 32 | 5 | 32 | 30 |
| 240 | 16 | 16 | 4 | 16 | 14 |
| 248 | 8 | 8 | 3 | 8 | 6 |
| 252 | 4 | 4 | 2 | 4 | 2 |
| 254 | 2 | 2 | 1 | 2 | 0 (point-to-point) |
| 255 | 1 | 1 | 0 | 1 | (single host) |
Memorize the left and middle columns. That’s your subnetting cheat sheet, 16 numbers total.
The /29 walkthrough — the most-tested subnet on the exam
The /29 shows up on every Network+ exam because it’s small enough to bracket exactly 8 addresses, and 8 is the smallest subnet most real-world LANs use. Here’s the full breakdown.
Given: 10.0.1.0/29 — list every subnet, network address, host range, and broadcast for the first six subnets.
Step 1 — convert /29 to dotted-decimal mask: 29 ones, then 3 zeros. 11111111.11111111.11111111.11111000 = 255.255.255.248. (Or: memorize that /29 = 248 in the last octet.)
Step 2 — apply the magic number: 256 - 248 = 8. Block size = 8.
Step 3 — write the subnets in the interesting octet, stepping by 8:
| Subnet | Network | First host | Last host | Broadcast |
|---|---|---|---|---|
| /29 #1 | 10.0.1.0 | 10.0.1.1 | 10.0.1.6 | 10.0.1.7 |
| /29 #2 | 10.0.1.8 | 10.0.1.9 | 10.0.1.14 | 10.0.1.15 |
| /29 #3 | 10.0.1.16 | 10.0.1.17 | 10.0.1.22 | 10.0.1.23 |
| /29 #4 | 10.0.1.24 | 10.0.1.25 | 10.0.1.30 | 10.0.1.31 |
| /29 #5 | 10.0.1.32 | 10.0.1.33 | 10.0.1.38 | 10.0.1.39 |
| /29 #6 | 10.0.1.40 | 10.0.1.41 | 10.0.1.46 | 10.0.1.47 |
Notice the pattern. Every subnet boundary is a multiple of 8. The network address is the boundary. The broadcast is the next boundary minus 1. The first host is the network+1. The last host is the broadcast-1.
Six numbers per row, and only the first column required actual calculation. Once you have the first row, the rest are addition by 8.
The 5-question drill that builds the reflex
The way to make this automatic is volume. Practice 5 problems per day for 2 weeks before the exam. Format every problem the same way:
Given: IP = 172.16.45.87
Mask = /20
Find: Subnet mask in dotted decimal: ?
Magic number: ?
Network address: ?
Broadcast address: ?
Usable host range: ?
Number of usable hosts: ?
Walkthrough:
- /20 mask: 20 ones, 12 zeros → 11111111.11111111.11110000.00000000 → 255.255.240.0
- Interesting octet: 240 (third octet). Magic number: 256 - 240 = 16
- Subnets step by 16 in the third octet: 0, 16, 32, 48, 64, 80, 96, 112, 128, 144…
- 45 falls between 32 and 48 → network is 172.16.32.0
- Next boundary is 172.16.48.0, so broadcast is 172.16.47.255
- Usable range: 172.16.32.1 through 172.16.47.254
- Total addresses: 12 host bits = 2^12 = 4096. Usable: 4094.
Done in 30 seconds with practice. The exam asks variations of this same question 8–12 times.
The mask-to-prefix conversion you have to know cold
You will not always be given a /xx prefix. Sometimes the exam gives 255.255.255.240 and asks for the prefix length. Memorize this table — the entire usable set is 16 entries:
| Mask | Prefix | Hosts per subnet (usable) |
|---|---|---|
| 255.0.0.0 | /8 | 16,777,214 |
| 255.128.0.0 | /9 | 8,388,606 |
| 255.255.0.0 | /16 | 65,534 |
| 255.255.128.0 | /17 | 32,766 |
| 255.255.192.0 | /18 | 16,382 |
| 255.255.224.0 | /19 | 8,190 |
| 255.255.240.0 | /20 | 4,094 |
| 255.255.248.0 | /21 | 2,046 |
| 255.255.252.0 | /22 | 1,022 |
| 255.255.254.0 | /23 | 510 |
| 255.255.255.0 | /24 | 254 |
| 255.255.255.128 | /25 | 126 |
| 255.255.255.192 | /26 | 62 |
| 255.255.255.224 | /27 | 30 |
| 255.255.255.240 | /28 | 14 |
| 255.255.255.248 | /29 | 6 |
| 255.255.255.252 | /30 | 2 |
Notice the pattern in usable hosts — they roughly double as you go up the table. Memorize the most common ones (/24 = 254, /28 = 14, /29 = 6, /30 = 2) cold; the rest you can derive from the magic number in seconds.
VLSM — variable-length subnet masks in 60 seconds
The exam loves VLSM questions: “split 192.168.10.0/24 into subnets for 50, 25, 12, and 5 hosts.” The trick is to always allocate the largest first, then work down.
50 hosts needs at least 50 + 2 = 52 addresses → smallest mask that fits 52 is /26 (62 usable). Allocate 192.168.10.0/26 (covers .0–.63).
25 hosts needs 27 addresses → /27 (30 usable). Allocate 192.168.10.64/27 (covers .64–.95).
12 hosts needs 14 addresses → /28 (14 usable). Allocate 192.168.10.96/28 (covers .96–.111).
5 hosts needs 7 addresses → /29 (6 usable). Allocate 192.168.10.112/29 (covers .112–.119).
Always allocate from largest to smallest. If you allocate the small ones first, you fragment the address space and the large allocations may not fit.
The traps that fail Network+ candidates
Five mistakes I see candidates make under exam pressure:
1. Off-by-one on usable hosts. A /29 has 8 total addresses but 6 usable. The exam will ask “how many usable hosts” specifically to catch people who answer 8. Always subtract 2 (network + broadcast) unless the question explicitly asks for total addresses.
2. Wrong interesting octet. For /20, the interesting octet is the third (240), not the fourth. The interesting octet is the one that is neither 0 nor 255 in the mask. If all four octets are 0 or 255, the mask is on a classful boundary and there’s no math required.
3. Block size in the wrong octet. When the interesting octet is the third, subnets step in the third octet. The fourth octet ranges 0–255 within each /20 subnet. Don’t apply the block size to the wrong octet — that’s a sign you forgot which octet is interesting.
4. Math errors under time pressure. 256 - 224 is 32, not 30. 256 - 248 is 8, not 6. Practice these specific subtractions until they’re reflex. The 8 mask values (128, 192, 224, 240, 248, 252, 254, 255) and their 256-complements are the entire arithmetic surface.
5. Forgetting /31 and /32 edge cases. A /31 has 2 addresses and 0 “usable” in the traditional sense — but per RFC 3021 it’s used for point-to-point links where both addresses are usable. A /32 is a single host. Exam may ask about both.
What this maps to on the N10-009 exam
The official CompTIA Network+ N10-009 objectives put subnetting under domain 1.4 (Given a scenario, configure IP networking). Specific topics:
- IPv4 addressing schemes (Class A/B/C, classless / CIDR)
- Subnetting (the magic-number territory)
- Public vs private addressing (RFC 1918 ranges)
- IPv4 special addresses (loopback, APIPA, broadcast)
The exam will test subnetting through PBQ (Performance-Based Questions) where you drag-and-drop subnet boundaries, plus standard multiple-choice. Both formats reward speed.
Where to take this next
If you want to drill 50+ subnetting questions with answer keys, network.it-learn.io has free flashcard decks and PBQ-style scenarios mapped to N10-009.
For the OSI vs TCP/IP layer mapping that the exam tests right next to subnetting, OSI vs TCP/IP Layer Mapping — A Cheat Sheet for the N10-009 Exam is the next post in this Network+ cluster.
For the port number memorization that everyone over-studies, Port Numbers Worth Memorizing for Network+ (and Which Ones You Can Skip) is the priority list.
Practice with free flashcards, subnetting drills, and exam-style scenarios at network.it-learn.io — aligned to the current N10-009 objectives. No signup required.





