Legacy Haven University

Subnetting splits one large address block into smaller networks so routers can isolate traffic, conserve addresses, and match each LAN to the number of hosts it actually needs. CompTIA Network+ N10-009 tests that skill in two architectures at once: IPv4’s 32-bit class-and-mask model (objective 1.7) and IPv6’s 128-bit prefix model that exists to stop address exhaustion (objective 1.8).

A router does not “guess” which hosts share a network. It applies a mask or prefix length to an address, keeps the network bits, and treats every remaining bit as a host or interface identifier. Change the boundary and you change the size of the LAN, the broadcast domain (IPv4 only), and the routing table entry.

IPv4 Architecture: 32 Bits, Four Octets, One Mask

IPv4 writes a 32-bit address as four decimal octets, such as 192.168.10.25. Each octet is 8 bits. The subnet mask is the same length. Ones in the mask mark network bits. Zeros mark host bits.

Write the same address in CIDR (Classless Inter-Domain Routing) form by counting the ones: 192.168.10.25/24 means the first 24 bits are the network. The mask 255.255.255.0 says the same thing in dotted decimal.

Under the hood the host ANDs the address with the mask. Every bit that is 1 in the mask stays. Every bit that is 0 becomes 0. The result is the network ID. Flip all host bits to 1 and you get the broadcast address. Every address between those two values is a candidate host address. IPv4 burns two of them on every subnet: network ID and broadcast.

That is why the usable-host formula is $2^h – 2$2h−2, where $h$h is the number of host bits. A /30 leaves 2 host bits, so $2^2 – 2 = 2$22−2=2 usable addresses. Point-to-point WAN links use /30 (or /31 in some designs) because those two addresses are enough.

Address Classes Still Appear on the Exam

N10-009 still lists classes A through E even though the Internet stopped routing by class in the 1990s. Classes tell you the default mask if no CIDR prefix is given.

127.0.0.0/8 is loopback, not Class A. 127.0.0.1 is localhost. A packet to that address never leaves the device; it tests the local TCP/IP stack.

Classful thinking is a trap. A public 10.1.2.0/24 is not “Class A with a Class C mask” on the exam. It is a /24 network that happens to sit inside the historical Class A range. Always read the prefix first.

CIDR and VLSM: The Real IPv4 Subnetting Model

CIDR drops the class boundary. The prefix length can stop on any bit, not just /8, /16, or /24. An ISP can hand a customer 203.0.113.0/27 instead of wasting a full /24.

VLSM (Variable Length Subnet Mask) is CIDR used inside one organization. You take a block such as 10.0.0.0/16 and cut it into unequal pieces:

• /24 for a 100-host floor
• /26 for a 50-host VLAN
• /30 for each WAN link

You size each subnet to demand instead of cloning one mask everywhere. That is the “secret” IPv4 exam questions keep asking: borrow only as many bits as you need, then stop.

The borrow-bits workflow

1. Count required subnets or required hosts.
2. Subnets needed → $2^s \ge$2s≥ required subnets, where $s$s is bits borrowed from the host portion.
3. Hosts needed → $2^h – 2 \ge$2h−2≥ required hosts.
4. New prefix = old prefix + borrowed bits.
5. Block size = $2^h$2h in the interesting octet (or $256$256 minus the interesting mask octet).
6. List networks by adding the block size: 0, 32, 64, 96… for a /27.

Example: split 192.168.10.0/24 into four equal LANs.

• Four subnets need 2 borrowed bits because $2^2 = 4$22=4.
• New prefix is /26. Mask is 255.255.255.192.
• Host bits left: 6. Usable hosts: $2^6 – 2 = 62$26−2=62.
• Block size: 64.
• Networks: 192.168.10.0/26, .64/26, .128/26, .192/26.
• First subnet usable range: .1–.62. Broadcast: .63.

Performance-based questions (PBQs) expect you to fill those ranges without a calculator.

Public vs Private IPv4

RFC 1918 reserves three private blocks that routers on the public Internet must not route:

• 10.0.0.0/8
• 172.16.0.0/12 (172.16.0.0 through 172.31.255.255)
• 192.168.0.0/16

Hosts inside those ranges reach the Internet through NAT or PAT. The exam treats RFC 1918 as the internal design space and public space as anything else that IANA and the RIRs assign.

APIPA (Automatic Private IP Addressing) is the failure range 169.254.0.0/16. A Windows or many other clients assign themselves an address there when DHCP fails. APIPA is link-local. It is not RFC 1918. It is a troubleshooting flag: if you see 169.254.x.x, DHCP did not answer.

Why IPv6 Exists

IPv4 offers about 4.3 billion addresses. NAT stretched that pool, but it did not fix it. IPv6 uses 128 bits. That is $2^{128}$2128 addresses—about $3.4 \times 10^{38}$3.4×1038. N10-009 names the purpose in objective 1.8: mitigate address exhaustion.

IPv6 also drops broadcast. Neighbor Discovery Protocol (NDP) uses multicast and ICMPv6 instead of ARP broadcasts. That change is architectural, not cosmetic. A “subnet” in IPv6 is a prefix. It is not a broadcast domain in the IPv4 sense.

IPv6 Address Format

Write an IPv6 address as eight 16-bit hextets separated by colons:

2001:0db8:0000:0000:0000:ff00:0042:8329

Two compression rules apply:

• Strip leading zeros in a hextet: 0db8 becomes db8.
• Collapse one contiguous run of all-zero hextets to ::. Use :: only once.

The compressed form is 2001:db8::ff00:42:8329. Documentation and labs use the reserved prefix 2001:db8::/32 so examples never collide with live space.

The prefix length still uses slash notation: 2001:db8:abcd::/48. There is no dotted-decimal mask. The number after the slash is the mask.

How IPv6 “Subnetting” Actually Works

A typical global unicast address splits like this:

• Global routing prefix (often /32 or /48 from the ISP or RIR)
• Subnet ID (the bits between the prefix and /64)
• Interface ID (the last 64 bits)

Enterprise practice and SLAAC both assume a /64 on each LAN. If an organization receives 2001:db8:abcd::/48, it has 16 bits of subnet ID because $64 – 48 = 16$64−48=16. That yields $2^{16} = 65{,}536$216=65,536 /64 networks. You do not borrow host bits to create more IPv6 subnets on a LAN. You increment the subnet ID.

Example first five /64s from 2001:db8:cafe::/48:

• 2001:db8:cafe:0::/64
• 2001:db8:cafe:1::/64
• 2001:db8:cafe:2::/64
• 2001:db8:cafe:3::/64
• 2001:db8:cafe:4::/64

You do not subtract 2 for network and broadcast. Every address in the /64 can identify an interface. Routers still reserve the all-zeros address as the subnet-router anycast address, but the exam’s core point is scale: one /64 holds more addresses than you will ever assign on a single link.

IPv6 address types the exam expects

• Global unicast — routable on the Internet; currently allocated from 2000::/3.
• Unique local — internal-only space fc00::/7 (locally assigned addresses start with fd). This is the IPv6 cousin of RFC 1918, not a 1:1 copy.
• Link-local — fe80::/10, in practice fe80::/64 on the wire. Every IPv6 interface builds one. Routers do not forward link-local traffic off the link.
• Multicast — ff00::/8. Replaces broadcast. Examples: ff02::1 (all nodes on the link), ff02::2 (all routers on the link).
• Anycast — one address shared by multiple interfaces; the packet goes to the “nearest” one by routing metric.
• Loopback — ::1/128.
• Unspecified — ::/128 (used while a host still has no address).

SLAAC, EUI-64, and DHCPv6

IPv6 hosts can build an address without a lease database. Stateless Address Autoconfiguration (SLAAC) works like this:

1. The host creates a link-local address and runs Duplicate Address Detection (DAD) through NDP Neighbor Solicitation.
2. The host sends a Router Solicitation.
3. A router answers with a Router Advertisement that carries the /64 prefix (and often DNS options).
4. The host appends a 64-bit interface identifier.

That identifier may be a modified EUI-64 from the MAC address or a random value (privacy extensions). EUI-64 splits the 48-bit MAC, inserts ff:fe in the middle, and flips the U/L bit (the seventh bit of the first octet). N10-009 wants you to recognize the process, not grind hex all day.

SLAAC is stateless: the router does not track who took which address. Stateful DHCPv6 does track assignments, like IPv4 DHCP. A common hybrid is SLAAC for the address plus stateless DHCPv6 for DNS. Objective 3.4 groups these as IPv6 network services.

Compatibility: Dual Stack, Tunneling, NAT64

Few networks flipped a switch from IPv4 to IPv6. Objective 1.8 lists the three compatibility tools:

• Dual stack — a host and router run IPv4 and IPv6 at the same time. This is the preferred transition. Each stack uses its own addresses, routing table, and services.
• Tunneling — IPv6 packets ride inside IPv4 (or the reverse) across a network that does not yet speak the inner protocol. The exam cares that you know tunneling exists as a compatibility method, not that you configure every historic tunnel type.
• NAT64 — a translator maps IPv6-only clients to IPv4-only servers. IPv4-mapped IPv6 form ::ffff:0:0/96 and the well-known NAT64 prefix 64:ff9b::/96 show up in that design.

NAT in IPv6 is not the default plan. The architecture gives every host a globally unique address so end-to-end connectivity can return. Dual stack is how most enterprises get there without breaking IPv4 applications.

Architecture Contrast That Wins Points

IPv4 hides the network boundary in a separate 32-bit mask and burns two addresses per subnet. IPv6 puts the boundary in the prefix length, standardizes /64 on the LAN, and uses multicast instead of broadcast. IPv4 rationed addresses with VLSM and NAT. IPv6 rations prefixes, not host bits.

That is why “subnetting secrets” change by version:

• On IPv4, the secret is binary: borrow bits, compute block size, list ranges, subtract 2.
• On IPv6, the secret is hierarchy: take the allocated prefix, keep /64 on each segment, and increment the subnet ID. Do not hunt for a broadcast address. Do not design a LAN as /120 just because IPv4 habits say “save hosts.”

When you study these calculations for the live exam, treat them as one skill set inside a larger plan to pass CompTIA Network+ N10-009 — addressing questions sit in Domain 1.0 (Networking Concepts, 23%) and return again when Domain 3.0 asks you to implement IPv4 and IPv6 services.

Exam-Day Checks

• If the question gives a class but also a prefix, obey the prefix.
• Private IPv4 is RFC 1918 only. 169.254.0.0/16 is APIPA. 127.0.0.0/8 is loopback.
• /30 → 2 usable hosts. /29 → 6. /28 → 14. /27 → 30. /26 → 62. /25 → 126. /24 → 254. Memorize that table.
• IPv6 LAN prefix is /64 unless the scenario explicitly says otherwise.
• fe80:: never routes. ff02:: is link-local multicast. ::1 is loopback.
• Dual stack is two protocols in parallel. Tunneling encapsulates. NAT64 translates.

Work every IPv4 problem in binary or block size, then confirm with the formula. Work every IPv6 subnet problem by counting bits between the assigned prefix and /64. The architectures differ. The exam scores both.