How to Find the Network and Broadcast Address of Any Subnet

Every IPv4 subnet has exactly one network address (all host bits set to 0) and one broadcast address (all host bits set to 1). To find them for any host, apply the mask: the network address is the host address with its host bits zeroed, and the broadcast address is the same value with those bits filled with ones. Everything strictly between the two is assignable to interfaces. Two methods get you there — a bitwise AND, which always works, and a block-size shortcut, which is far faster under time pressure.

Method one: the bitwise AND

The formal definition of the network address is the bitwise AND of the address and the mask. A bit in the result is 1 only where both inputs are 1, which has the effect of preserving every network bit and zeroing every host bit.

Take 192.168.130.77 with a /26 mask (255.255.255.192). The first three octets are unchanged because the mask is all ones there, so only the last octet needs work:

address  77  = 01001101
mask    192  = 11000000
AND          = 01000000  = 64

The network address is 192.168.130.64. To get the broadcast address, set every host bit — the six zero-bits in the mask — to 1:

network  64  = 01000000
host bits ON = 00111111
OR           = 01111111  = 127

The broadcast address is 192.168.130.127, and the usable range runs from 192.168.130.65 to 192.168.130.126 — 62 addresses, matching 2^6 − 2.

This method never fails, works on any octet, and is worth doing longhand a few times until the mechanic is obvious. It is also slow, which is why the second method exists.

Method two: the block-size shortcut

The faster approach skips binary entirely. Find the interesting octet — the one where the mask is neither 255 nor 0 — and compute its block size as 256 minus the mask value there. Network addresses occur at every multiple of that block size, starting at zero. Your subnet is the largest multiple that does not exceed the host’s value in that octet.

Work 10.101.37.155/20. The mask is 255.255.240.0, so the third octet is interesting and the block size is 256 − 240 = 16. Third-octet boundaries therefore fall at 0, 16, 32, 48, 64, and so on. The host’s third octet is 37, and the largest multiple of 16 not exceeding 37 is 32.

• Network address: 10.101.32.0
• Next network starts at third octet 48, so the broadcast is one address below it: 10.101.47.255
• Usable range: 10.101.32.1 through 10.101.47.254 (4,094 addresses)

Note what happens to the octets after the interesting one: in the network address they go to 0, and in the broadcast address they go to 255. That falls straight out of “all host bits zero” and “all host bits one” — those trailing octets are entirely host bits.

The same routine on 172.28.19.5/23: mask 255.255.254.0, block size 256 − 254 = 2, boundaries at 0, 2, 4, …, 18, 20. The largest even number not exceeding 19 is 18, so the network is 172.28.18.0, the next block starts at 172.28.20.0, and the broadcast is 172.28.19.255. The usable range spans 172.28.18.1 to 172.28.19.254 — a /23 covering two full third-octet values, which is exactly what “512 addresses” means.

The CIDR reference table lists the block size for every common prefix, and memorising that column is the single highest-value thing you can do for exam speed.

Fourth-octet examples, worked quickly

When the mask is /25 or longer, the interesting octet is the last one and the arithmetic is small:

• 172.19.86.240/28 — mask 255.255.255.240, block 16, boundaries at 0, 16, 32 … 240. Network 172.19.86.240, broadcast 172.19.86.255, usable 172.19.86.241–172.19.86.254 (14 hosts).
• 192.168.60.64/27 — block 32, boundaries 0, 32, 64, 96. Network 192.168.60.64, broadcast 192.168.60.95, usable .65–.94 (30 hosts).

Notice that in the first example the host address was the network address. That is a legitimate outcome and a favourite exam trap: 172.19.86.240 cannot be assigned to a device even though it looks like an ordinary address.

Deciding whether two hosts share a subnet

This is the most common practical application. Compute each host’s network address using its own configured mask and compare the results — matching leading octets prove nothing on their own.

Given 10.4.201.66/18 and 10.4.240.10/18: the mask 255.255.192.0 makes the third octet interesting with a block size of 64, giving boundaries at 0, 64, 128, 192. For 201 the enclosing boundary is 192, so the first host sits in 10.4.192.0 (broadcast 10.4.255.255). For 240 the boundary is also 192 — 240 falls between 192 and 255 — so the second host is in the same subnet. They can communicate directly without a router.

Change the second host to 10.4.100.10/18 and the picture flips: 100 falls in the 64 block, network 10.4.64.0, a different subnet entirely despite three matching octets.

A mismatch here is what produces the classic one-way symptom. If a workstation is configured /24 but the design calls for /26, it will consider a peer elsewhere in the /24 to be local and ARP for it, while the correctly configured peer sees the workstation as remote and sends replies to its default gateway. Connectivity fails in a way that looks like a routing problem but is a mask problem. There are worked examples of this pattern in the subnetting practice problems.

How the N10-009 exam tests this

• Given a host and mask, name the network or broadcast address. The distractor set almost always includes the host’s own address and the correct answer for an adjacent prefix, so identify the interesting octet before you start eliminating.
• Identify what an address is. You are shown one address inside a stated subnet and asked whether it is the network address, the broadcast address, or a valid host. Compute both boundaries and see where it lands.
• Same subnet or not. Two hosts and a mask; decide whether traffic between them needs a router. Compute both network addresses — never judge by how many octets match.
• Diagnose a mask typo. A host cannot reach a server on the same switch. When the stated masks differ between the two devices, the mask is the fault, not cabling or VLANs, because the two ends disagree about where the subnet boundary sits.

Every one of these comes down to speed — timed practice questions build it faster than re-reading ever will.

Quick reference

• Network address = address AND mask; broadcast = network with all host bits set to 1.
• Block size = 256 − the interesting octet’s mask value; networks land on its multiples.
• Broadcast address = the address immediately below the next network address.
• Octets after the interesting one are 0 in the network address and 255 in the broadcast address.
• Usable range = network + 1 through broadcast − 1, giving 2^(host bits) − 2 addresses.
• A host address can legitimately equal the network address of a differently masked block — always compute, never assume.
• Two hosts share a subnet only when their computed network addresses are identical, regardless of how similar the addresses look.

For the theory behind why these two addresses are reserved, see subnetting explained; for applying the same arithmetic to differently sized blocks, see VLSM.