Interview prep · 8 questions
Subnetting and IP addressing interview questions
What do interviewers test with subnetting questions?
They test whether you can turn a prefix length into networks, hosts and boundaries in your head, quickly and without a calculator. They also check that you know why the mask matters to a host: it decides what is local and what goes to the default gateway.
Updated
Mock interview
One question at a time. Answer it out loud as you would in the room, then reveal the model answer and rate yourself honestly. Your progress stays in this browser.
How many usable host addresses are in a /26, and how do you work it out?
Entry level
A /26 has 62 usable host addresses. It leaves 6 host bits, 2 to the power of 6 is 64 addresses, and the first (the network address) and the last (the broadcast address) cannot be given to hosts.
The general rule is 2^(32 − prefix) − 2. A /24 gives 254 hosts, a /25 gives 126, a /27 gives 30, a /28 gives 14 and a /30 gives 2.
Interviewers often ask it the other way round: the smallest subnet that fits 50 hosts. Fifty needs 6 host bits (62 usable), so the answer is a /26, mask 255.255.255.192.
Common weak answer: Answering 64. That is the number of addresses in the block, not the number you can assign to hosts.
Likely follow-ups
- What is a /26 mask in dotted decimal?
- How many /26 subnets fit in a /24?
- Why is the −2 not applied to a /31?
What are the network and broadcast addresses of 192.168.10.77/27?
Entry level
The network is 192.168.10.64 and the broadcast is 192.168.10.95, so hosts run from .65 to .94. A /27 cuts the last octet into blocks of 32, and 77 falls in the block that starts at 64.
The fast method is the block size: 256 minus the last non-255 octet of the mask. A /27 mask is 255.255.255.224, and 256 − 224 = 32, so subnets start at 0, 32, 64, 96 and so on.
Find the block the address sits in; the start of the next block, minus one, is the broadcast. Once the block size is automatic for you, no binary conversion is needed.
Common weak answer: Converting the whole address to binary under pressure. It works, but it is slow, and a slow answer sounds like an unsure one.
Likely follow-ups
- What is the block size of a /29?
- Is 192.168.10.95/27 a valid host address?
- Which /27 does 192.168.10.130 belong to?
Why are /30 subnets used on point-to-point links, and when would you use a /31 instead?
Mid level
A /30 gives exactly two usable addresses, one for each end of the link, so it wastes almost nothing. A /31 goes further: a point-to-point link needs no network or broadcast address, so both of its two addresses are usable, which halves the space spent on links.
On a network with hundreds of router-to-router links, /31s save a real share of the address plan. They are meant for point-to-point links only, and both ends must support them.
A /30 is still the safe default when you cannot be sure every device on the link accepts a /31.
Common weak answer: Saying a /31 is invalid because it has no host addresses. That is the old rule, not how point-to-point links are addressed today.
Likely follow-ups
- How many /30 links fit in a /24?
- What prefix would you give a router's loopback address?
- What happens if the two ends of a link use different masks?
What does a host actually do with its subnet mask?
Entry level
It uses the mask to decide whether a destination is on its own subnet. If it is, the host sends straight to it after an ARP for the destination's MAC address; if not, it sends the frame to its default gateway's MAC address instead.
The host compares the network part of its own address with the network part of the destination, both taken with its own mask. The router is only involved when that comparison says the destination is remote.
That is why a wrong mask causes such confusing faults. A mask that is too long makes a neighbour look remote, so the host sends to the gateway; a mask that is too short makes a remote address look local, so the host ARPs for it and nobody answers.
Common weak answer: Saying the switch uses the mask. Switches forward by MAC address and never look at it.
Likely follow-ups
- Which MAC address is in the frame when a host pings a server on another subnet?
- What happens if two hosts on one cable use different masks?
- Why must the default gateway be on the host's own subnet?
What is VLSM, and why do you assign the largest subnet first?
Mid level
Variable-length subnet masking gives each subnet only the prefix it needs instead of one size for all. You allocate the largest subnet first because larger blocks must start on larger boundaries, and placing them first keeps every block aligned with no overlaps and no stranded gaps.
Example: from 192.168.1.0/24, a 50-host LAN gets 192.168.1.0/26, a 20-host LAN gets 192.168.1.64/27 and a router link gets 192.168.1.96/30. Working smallest first can leave gaps that are too badly aligned for the big subnet to fit.
Mixed prefix lengths only work across a network when the routing protocol carries the mask with every route, as OSPF, EIGRP and RIP version 2 do.
Common weak answer: Describing VLSM as "subnetting a subnet" without saying why the order matters. The order is the part that shows you have done it.
Likely follow-ups
- Why could RIP version 1 not carry a VLSM design?
- How would you leave room for growth in a VLSM plan?
- What is the difference between VLSM and summarization?
Which IPv4 ranges are private, and why can't they be used on the internet?
Entry level
The private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, set aside for use inside organisations. Internet routers carry no routes to them and thousands of networks reuse the same addresses, so traffic from them is translated to a public address by NAT on the way out.
172.16.0.0/12 runs from 172.16.0.0 to 172.31.255.255, and it is the one people get wrong: 172.32.1.1 is a public address.
Two other ranges worth knowing: 127.0.0.0/8 for loopback, and 169.254.0.0/16 for the link-local address a host gives itself when DHCP does not answer.
Common weak answer: Giving 172.16.0.0/16 as the whole private block. The /12 covers sixteen /16s, from 172.16 to 172.31.
Likely follow-ups
- What does NAT change in the packet?
- Is 100.64.0.0/10 private, and what is it used for?
- Why can two merging companies have trouble with their private addressing?
What is route summarization, and how would you summarize 192.168.0.0/24 through 192.168.3.0/24?
Mid level
Summarization advertises one shorter prefix that covers several contiguous networks, so routers carry fewer routes. Those four /24s summarize to 192.168.0.0/22, because all four share their first 22 bits.
Write the third octet in binary: 0 is 00000000 and 3 is 00000011. The first six bits of that octet match, so the common prefix is 16 + 6 = 22 bits.
A summary works cleanly only when the block is aligned and every network inside it really lives behind the router that advertises it. Otherwise it attracts traffic for networks that router cannot reach.
Common weak answer: Picking a summary that is far too wide, such as a /16, and claiming address space the router cannot actually reach.
Likely follow-ups
- Can 192.168.1.0/24 through 192.168.4.0/24 be summarized into one /22?
- Where in a network would you summarize?
- What is the risk of a summary that covers networks that don't exist?
How is IPv6 addressing different from IPv4 on a typical LAN?
Mid level
IPv6 addresses are 128 bits written in hexadecimal, a LAN is normally a /64, and there is no broadcast: neighbours are found with multicast instead. Every interface also has a link-local address starting with fe80:: alongside any global address.
An address can be shortened by dropping leading zeros in each group and replacing one run of all-zero groups with ::, only once per address.
The address space is so large that NAT is not needed to save addresses, and a /64 per LAN is standard even when it holds three hosts.
Common weak answer: Saying IPv6 just has longer addresses. Interviewers listen for the removal of broadcast and the change in how neighbours are found.
Likely follow-ups
- How would you shorten 2001:0db8:0000:0000:0000:0000:0000:0001?
- What replaces ARP in IPv6?
- What is a link-local address used for?