Each decimal numbers of an IP address represents 8-bit (or 1 byte), and is therefore called an octet. Hence, an IP address represents 32-bit (or 4 bytes). The range of each octet is between 0 and 255 inclusively.

Classes of Networks

For better understanding in IP addressing, let’s see a sample network diagram below.

On this diagram, there are 2 networks: 10.0.0.0 and 192.168.0.0 which is separated by a router. At this time, you may want to know how can I know that 192.168.0.101 and 192.168.0.102 are on the same network. Or if I want to add new PC on 10.0.0.0 network, what are valid IP addresses that I can choose? The answer is about classes of networks.

An IP address can be divided in 2 parts, network and host. RFC 790 defines IP protocol, including network classes which are Class A, Class B, and Class C. TCP/IP defines Class D and Class E as well. See the table below for details on each class.

	Class A, network part has 1 byte (8 bits) and 3 bytes (24 bytes) for host part. *Total number of this class of network: 2 ^ 7 – 2 Valid network numbers: 1.0.0.0 to 126.0.0.0 **Number of hosts per network: 2 ^ 24 – 2 Valid host addresses: 1.0.0.1 to 126.255.255.254
	Class B, network part has 2 bytes (16 bits) and 2 bytes (16 bits) for host part. *Total number of this class of network: 2 ^ 14 – 2 Valid Network numbers: 128.1.0.0 to 191.254.0.0 **Number of hosts per network: 2 ^ 16 – 2 Valid host addresses: 128.1.0.1 to 191.255.255.254
	Class C, network part has 3 bytes (24 bits) and 1 byte (8 bits) for host part. *Total number of this class of network: 2 ^ 21 – 2 Valid Network numbers: 192.0.1.0 to 223.255.254.0 **Number of hosts per network: 2 ^ 8 – 2 Valid host addresses: 192.0.1.1 to 223.255.254.254
	Class D is reserved for multicast address and used for communicate between router or gateway. Valid IP addresses: 224.0.0.0 to 239.255.255.255.
	Class E is reserved for experiment, development purpose, or future use. Valid IP addresses: 240.0.0.0 to 254.255.255.254.

Note:
*The valid network numbers shows actual network numbers. There are several reserved cases. For example, network 0.0.0.0, originally defined for use as a broadcast address, and 127.0.0.0, reserved for loopback address. Network 128.0.0.0, 191.255.0.0, 192.0.0.0 and 223.255.255.0 also are reserved.

**There are 2 reserved host addresses per network: its network address and network broadcast address.

Network Mask

Network mask or NetMask is a 32-bit binary number, usually written in dotted-decimal format. Network mask defines the size of the host part of an IP address, representing the host part of the IP address with binary 0s in the mask. For example, class A mask has its last 24 bits as binary 0, which means that the last three octets of the mask are 0s. You can see the default masks on the table below.

Network Address

Network address or network number is a number that uses dotted-decimal notation like IP addresses, but the number itself represents all hosts in a single Class A, B, or C IP network. For example, given an IP address 192.168.0.1 with network mask 255.255.255.0, the network address will be 192.168.0.0.

To calculate network address, we use logical AND operation between one IP address (any) in the network and its network mask. For example, an IP address 192.168.0.1 with network mask 255.255.255.0.

1. Convert the IP address 192.168.0.1 to binary format, we get 11000000 10101000 00000000 00000001.
2. Convert its network mask 255.255.255.0 to binary format, we get 11111111 11111111 11111111 00000000
3. Do logical AND operation on two binary numbers, we get 11000000 10101000 00000000 00000000.
   Note: A logical AND operation compares 2 bits. In each pair, the result is 1 if the first bit is 1 and the second bit is 1. Otherwise, the result is 0.
4. Convert the result back to decimal, we get 192.168.0.0.

You can see the example on the figure below:

Broadcast Address

Broadcast Address or Direct Broadcast Address is an IP address which refers to all nodes on a network or subnet instead of a single node. For example, a network address 192.168.0.0 with network mask 255.255.255.0, the broadcast address is 192.168.0.255 which refers to 192.168.0.1 to 192.168.0.254. If you send a packet to 192.168.0.255, all nodes on this network (192.168.0.1 to 192.168.0.254) will get the packet.

To calculate broadcast address, we first do bit inversion on network mask and use logical XOR operation between the inverted network mask and network address. For example, an IP address 192.168.0.1 with network mask 255.255.255.0

1. Convert network mask 255.255.255.0 to binary format, we get 11111111 11111111 11111111 00000000.
2. Do bit inversion on the network mask, we get 00000000 00000000 00000000 11111111.
3. Convert network address 192.168.0.0 to binary format, we get 11000000 10101000 00000000 00000000.
4. Do logical XOR operation on two binary numbers, we get 11000000 10101000 00000000 11111111.
   Note: A logical XOR (exclusive or) is a type of logical disjunction on two operands that results in a value of true if exactly one of the operands has a value of true. A simple way to state this is “one or the other but not both.”
5. Convert the result back to decimal, we get 192.168.0.255.

You can see the example on the figure below:

Loopback Address

Loopback address is a special IP address, usually 127.0.0.1. It is designated for the software loopback interface of a machine. The loopback interface has no hardware associated with it, and it is not physically connected to a network.

The loopback interface allows IT professionals to test IP software
without worrying about broken or corrupted drivers or hardware.

No related posts.

This post shows how to change MAC Address in Windows by edit Windows Registry. Before you read this post, I suggest you to read Change MAC Address in Windows, Part I: Introduction first. Also, if you haven’t try to change MAC Address by using feature on a NIC, I recommend to try it before on Part II: Feature on NIC.

If you have tried the first method and not succeed, it’s time to use this method to change MAC Address by modify the Windows Registry. It is a best practice to backup the Windows Registry before modify it.
Note: Changing MAC Address in Windows by this method is not supported by Microsoft. I’ll not be responsible on any damage or loss on your system. Do on your own risk!

Step-by-step

1. Before start, I’ll show the current MAC Address. It is 00-21-85-08-45-65.
   
2. Open command prompt by click Start -> Run -> type “cmd” -> Press Enter. Then, type command below to list all NICs on the current computer.

   net config rdr

   In this example, there are 3 NICs (on red mark). The NIC that I want to change MAC Address is the first one which I have observed by the MAC Address at the end of each line. Then, I have to note down the string in the bracket {}, the easiest way is to copy and paste to the Notepad. In this example, I have noted the string {F2B0CA68-D2F5-4907-938E-DD338B60A8A0}.
   

3. Next, open Registry Editor by type the command below:

   regedt32

   Note: You can also use “regedit.exe”. For more information about these tools, read Differences between Regedit.exe and Regedt32.exe on Microsoft KB.
   

4. On Registry Editor, navigate to HKEY_LOCAL_MACHINE -> SYSTEM -> CurrentControlSet -> Control -> Class ->
   {4D36E972-E325-11CE-BFC1-08002bE10318}.
   
5. You see lots of sub-folders in {4D36E972-E325-11CE-BFC1-08002bE10318} with 00xx format, for instance 0001,0002,0003, etc. Now I have to compare the value of NetCfgInstanceId on each of these sub-folders with the value that I have noted down on step 2. In this example, I have found the match on 0001 sub-folder. Normally, you should find the match on 0000 sub-folder.
   
6. Next, check if the key “NetworkAddress” is existed on the sub-folder in step 5 or not. If not, create a new key by right-click on the sub-folder -> New -> String Value. If there is already the key, goes to step 8.
   
7. Set name as “NetworkAddress”.
   
8. Double-click on the key NetworkAddress and assign MAC Addresss as you desire. In this example, I set to 0021850845AA.
   Note: Enter the MAC Address without dash (-), dot (.), semi-colon (:).
   
9. The configuration will look similar to the figure below.
   
10. Open Network Connection by Start -> Settings -> Control Panel -> Network Connections. Disable the Network Connection by right-click and select Disabled.
    
11. Enable the Network Connection by right-click and select Enabled.
    
12. Observe the Network Connection again. Now the MAC Address has been changed to 00-21-85-08-45-AA.
    
13. To change the MAC Address value back to the original (the built-in value), simply remove out the value that you have set on step 8 and restart the network connection again.

Related posts:

1. Change MAC Address in Windows, Part I: Introduction Introduction MAC Address (Media Access Control) or physical address is...
2. Change MAC Address in Windows, Part II: Feature on NIC Introduction Before you read this post, I suggest you to...

Before you read this post, I suggest you to read Change MAC Address in Windows, Part I: Introduction first.

This post shows how to change MAC Address in Windows. It requires that the Network Interface Card (NIC) supports virtual MAC Address feature. Most of NICs nowadays should has this feature. You can check if your NIC supports this feature by follow the step-by-step section until step 5.
Note: This method doesn’t change the burned-in (physical) MAC Address on a NIC.

If you can’t change MAC Address by this method, you still has another method which requires you to change values on Windows registry or using the tool such as SMAC tool to change MAC Address.
Note: Changing MAC Address in Windows by this method is not supported by Microsoft. I’ll not be responsible on any damage or loss on your system. Do on your own risk!

Change MAC Address in Windows, Part I: Introduction

Step-by-step

1. Before start, I’ll show the current MAC Address. It is 0021.8508.4565.
   
2. Open Control Panel. Click Start -> Settings -> Control Panel.
   
3. Open Network Connection Properties. Right-click on the network connection that you want to change MAC Address and select Properties.
   
4. On the Connection Properties, click Configure.
   
5. On Network Connection Properties, select Advanced tab -> select Locally Administrated Address or Network Address -> enter the MAC Address value that you want in the value box (without dot(.) or dash(-) between the MAC Address numbers). In this example, I’ll set to “000C29530036″. Then, click OK.
   Note: If you can’t find Locally Administrated Address or Network Address property, it means that the NIC doesn’t support virtual MAC Address feature so you can’t change MAC Address by this method.
   
6. The network connection will be restarted.
   
7. After that, observe the MAC Address of the network connection again. You’ll see that the MAC Address value has been changed to the value that I’ve just entered (00-0C-29-53-00-36).
   
8. To change the MAC Address value back to the original (the built-in value), just select Not Present or Use Default or delete out the configured MAC Address value on step 5 depends on which NIC you’re using.

Related posts:

1. Change MAC Address in Windows, Part I: Introduction Introduction MAC Address (Media Access Control) or physical address is...
2. Change MAC Address in Windows, Part III: Windows Registry Introduction This post shows how to change MAC Address in...
3. How to change IP Address on Linux Redhat Introduction Most of the time, I work in Windows environment....

MAC Address (Media Access Control) or physical address is a unique address assigned to NICs (Network Interface Card) by the manufacturer for identification. Even though MAC Address is a unique address which means that there shouldn’t be any MAC Address duplication occur in the world. But do you know that you can still change the MAC Address of NICs which is called MAC spoofing. It is a technique of hacking which you change the MAC Address to bypass access control lists on firewalls or routers.

For MAC Address, there are 2 types of address: Universally Administered Address (UAA) and Locally Administered Address (LAA).

• Universally Administered Address, also known as burned-in address (BIA), is uniquely assigned to NIC by its manufacturer.
• Locally Administered Address is assigned to NIC by user or network administrator to override the burned-in address.

For more information about MAC Address, see MAC address – Wikipedia, the free encyclopedia

Note: I write this article not for encourage hacking activity but to show that MAC Address can be changed easily so you shouldn’t define security policy that rely on MAC Address too much. It can also be use for troubleshoot or test network problems.

This article will cover changing MAC Address on Windows only. There are many ways you can change MAC Address. The first easiest method is to change MAC Address from NIC’s Properties. But the method requires that a NIC supports this feature. If your NIC doesn’t support the feature, you still can change MAC Address by modify Windows Registry. This method requires some knowledge about edit Windows Registry. If you doesn’t familiar with Windows Registry, you can try the last method which use a tool to change MAC Address (but it doesn’t free) – SMAC.

I’ll not write the last method since you can get documentation and help from the tool’s website. So only first and second methods that I’ll write which are:

1. Change MAC Address in Windows, Part II: Feature on NIC
2. Change MAC Address in Windows, Part III: Windows Registry

Note: Changing MAC Address in Windows by the methods above are not supported by Microsoft. I’ll not be responsible on any damage or loss on your system. Do on your own risk!

Related posts:

1. Change MAC Address in Windows, Part II: Feature on NIC Introduction Before you read this post, I suggest you to...
2. Change MAC Address in Windows, Part III: Windows Registry Introduction This post shows how to change MAC Address in...

1. Secure the Network using Cisco Port Security, Part I: Concept
2. Secure the Network using Cisco Port Security, Part II: Configuration

From the previous, you know basic concept about Port Security. Now let’s see it in the real action.

Step-by-step

1. Telnet to the switch.

   c:\telnet 10.0.0.1

2. Enter configuration mode.

   switch#config t

3. Enter interface configuration mode. I’m going to enable port security on the first interface (GigabitEthernet 0/1).

   switch(config)#interface GigabitEthernet 0/1

4. Sets the interface mode as access.

   switch(config-if)#switchport mode access

5. Enables port security on this interface. When you’ve enabled port security, all the connection on the interface

   switch(config-if)#switchport port-security

   Note:When you’ve enabled port security, all connections on this interface will be resetted so don’t try to enable on a working interface.

6. Set the maximum number of secure MAC Addresses on the interface to 2. Some interfaces may have more than a device connected to. Default is 1.

   switch(config-if)#switchport port-security maximum 2

7. Set the violation mode to restrict. For more information about violation mode, see Port Security Options section above.

   switch(config-if)#switchport port-security violation restrict

8. If there is any device connected to this interface, the switch will learn and insert into Secure Mac Address Table. This is Dynamic secure MAC Addresses. These MAC Addresses will be removed if the port shut down or the switch restarts.
   To view the current Secure Mac Address Table, exit the configuration mode and enters the command below.

   switch(config-if)#exit
   switch(config)#exit
   switch#show port-security interface GigabitEthernet 0/1 address

   Note: If the port shuts down, all dynamically learned addresses are removed.
   You’ll see the figure as below. This example has 2 PCs connect to the interface so there are 2 MAC Addresses on the table. It may takes some time for the switch to learn MAC Addresses.
   

9. After the interface has reached the maximum number of secure MAC Addresses. In this example is 2. No more devices can access the network’s resource anymore. To check if there is any violation on the interface, type the command below.

   switch#show port-security interface GigabitEthernet 0/1

   In this example, I have connected a third device to the interface so you’ll see the last line Security Violation Count. If this value is more than 0, then there is a violation occur on the interface.
   

10. If you want MAC Addresses to be deleted after a period of time from the Secure Mac Addresses Table, you’ll have to set aging of the interface. In this example, I’m going to set to delete a MAC Address after no activity of the device for 5 minutes.

    switch#conf t
    switch(config)#interface GigabitEthernet 0/1
    switch(config-if)#switchport port-security aging type inactivity
    switch(config-if)#swtichport port-security aging time 5

11. View Secure Mac Address Table again. You’ll the Remaining Age is change to 5 (I) which I indicates inactivity type of aging. So if there is an inactivity device for 5 minutes, the MAC Address of the device will be removed from the Secure Mac Address Table.
    
12. You can add a Static secure MAC Address by type the command below.

    switch#conf t
    switch(config)#interface GigabitEthernet 0/1
    switch(config-if)#switchport port-security mac-address 000C.29E9.F24A

13. To enable sticky learning, type the command below.

    switch(config-if)#switchport port-security mac-address sticky

    When you’ve enabled sticky learning, it converts the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration automatically.
    

14. Now when you want to add a new device to the interface, you only have 2 options: delete one sticky secure MAC Address or increase maximum allowed secure MAC Addresses.
    To delete one sticky secure MAC Address,

    switch(config-if)#no switchport port-security mac-address sticky 000c.29e9.f24a

    To increase maximum allowed secure MAC Addresses

    switch(config-if)#no switchport port-security maximum 3

15. Next, to disable sticky learning.

    switch(config-if)#no switchport port-security mac-address sticky

16. To disable port security

    switch(config-if)#no switchport port-security

Summary

Port Security can protect network from unauthorized access efficiency (if it is applied properly). But it requires some work for administrator. For example, add/remove secure MAC Addresses in sticky secure MAC Address type. There is also another way to implement Network Access Control by implement IEEE 802.1X which authenticate through RADIUS server.

Related posts:

1. Secure the Network using Cisco Port Security, Part I: Concept This topic separates into 2 posts: Secure the Network using...

1. Secure the Network using Cisco Port Security, Part I: Concept
2. Secure the Network using Cisco Port Security, Part II: Configuration

Introduction

In every organization or even a home that has a network, security is one of the important issue. Having a strong network security means you have decreased a success chance of hackers or malicious people that try to break into your network. Hence, reduce the loss of damage from them. I’m using the word ‘decrease’ mean that there is no way to completely secure the network without any threat and risk. It is a challenge task for network administrators to harden the network to be secure as possible.

One way to enhance network security, you can implement Network Access Control (NAC) or Network Admission Control. This will allow only certain devices such as PC, laptop, PDA, etc. to access the network’s resources. Thus, limiting the potential damage from emerging security threats and risks. In this post, I’ll talk about a feature on Cisco’s products which is “Port Security”. Port Security is a feature on Cisco’s products that help you to protect unauthorized access to the network by restrict MAC Addresses that can be connected to interface on the switch. So only defined MAC Addresses can have accessed to the network. If a user attempts to connect a new device (E.g, laptop) on the port which has already enabled port security and the port has reach the maximum allow MAC Addresses, the device won’t have access to the network until an administrator changes the configuration on the swtich.

The features of Port Security are

• Restrict only specified MAC Addresses on a certain port. Devices that have other MAC Addresses can’t connect to the network.
• Restrict a number of MAC Addresses on a certain port. The port inserts MAC Address dynamically to the configuration when a new device has plugged in until it reach the maximum allowed MAC Addresses.
• Set aging time and type for secure MAC Addresses. This feature, remove and add PCs on a secure port without manually deleting the existing secure MAC addresses while still limiting the number of secure addresses on a port.
• Enable/Disable to send a SNMP Trap if there is any violation detected.

To configure a port security,

• A secure port cannot be a trunk port.
• A secure port cannot be a destination port for Switch Port Analyzer (SPAN).
• A secure port cannot belong to an EtherChannel port-channel interface.
• A secure port cannot be an 802.1X port. If you try to enable 802.1X on a secure port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to a secure port, an error message appears, and the security settings are not changed.
• A secure port and static MAC address configuration are mutually exclusive.

Secure MAC Addresses

Types of secure MAC Addresses

1. Static secure MAC addresses. These are manually configured by using the switchport port-security mac-address mac-address interface configuration command, stored in the address table, and added to the switch running configuration.
2. Dynamic secure MAC addresses. These are dynamically configured, stored only in the address table, and removed when the switch restarts.
3. Sticky secure MAC addresses. These can be dynamically learned or manually configured, stored in the address table, and added to the running configuration. If these addresses are saved in the configuration file, when the switch restarts, the interface does not need to dynamically reconfigure them.

You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. After you’ve enabled sticky learning, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses. All sticky secure MAC addresses are added to the running configuration.

The sticky secure MAC addresses do not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you save the sticky secure MAC addresses in the configuration file, when the switch restarts, the interface does not need to relearn these addresses. If you do not save the sticky secure addresses, they are lost.

If sticky learning is disabled, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration.

Port Security Options

Violation Mode

1. Protect. Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.
2. Restrict. Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter to increment.
3. Shutdown. Puts the interface into the error-disabled state immediately and sends an SNMP trap notification. You can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands. This is the default mode.

Security Violation Mode Actions

Aging

1. Static. Enables aging for statically configured secure addresses on this port.
2. Time. Specifies the aging time for this port. Valid range for aging time is from 0 to 1440 minutes. If the time is equal to 0, aging is disabled for this port.
3. Type. Sets the aging type as absolute or inactivity.

Aging Type

1. Absolute. All the secure addresses on this port ago out exactly after the time (minutes) specified and are removed from the secure address list.
2. Inactivity. The secure addresses on this port ago out only if there is no data traffic from the secure source address for the specified time period.

Now you have understand the basic. Next, I’ll show example configuration to enable port security on a Cisco Switch C2960 Serie. See Secure the Network using Cisco Port Security, Part II: Configuration.

Related posts:

1. Secure the Network using Cisco Port Security, Part II: Configuration This topic separates into 2 posts: Secure the Network using...

If you need to connect more than one switch and going to have more than one VLAN, you need to configure trunk port in order to send traffic between switches. Below shows how to set trunk port (802.1Q) on 3Com Switch 3300XM.

Concept

You have to configure a port on each switch to be a trunk port (802.1Q). For 3Com Switch 3300XM, you need to assign the trunk port into both VLANs by set the first VLAN’s port tag type is none and other VLAN’s port tag type are 802.1Q. For example, you have two 3COM Switches and set VLAN 1(Default VLAN) on port 1-12 and VLAN 2 on port 13-23 on both switches. And you’ll set port 24 to be a trunk port on both switches. On the first switch, you assign port 24 to VLAN 1 with tag type is none and also assign port 24 again to VLAN 2 with tag type is 802.1Q. Then, you configure on the second switch as the same in the first switch. That’s it.

Step-by-step

1. The guide below will configure as the same situation which mentioned above(Concept section).
2. Telnet to switch, you’ll see menu option.
   
3. Select bridge -> vlan.
   
4. You’ll add port 24 to VLAN 1.
   Select ‘addPort’ -> select VLAN (in this case, we’ll assign port 24 to the VLAN 1 first) -> type 24 (port number) -> type ‘none’ to set tag type.
   
5. Next, add port 24 to VLAN 2 with tag type as 802.1Q.
   Select ‘addPort’ -> select VLAN 2 -> type 24 (port number) -> type ‘802.1Q’ to set tag type.
   
6. Now you have finished on the first switch. Try to repeat this configuration (step 1-5) on the second switch and you’re done.

Note: 3Com switch also has web-based configuration menu but it doesn’t flexible as in command-line.

No related posts.

Backup hardware’s configuration is the one important routine for network engineers so that when the hardware break down you can recover the failed system within an acceptable time. To backup the configuration, one effective way is to use TFTP to backup and restore configuration between remote hosts.
In the example below, I’ll show how to backup and restore configurations between TFTP Server and Cisco’s router. The TFTP Server will use Cisco TFTP Server software.

Configure TFTP Server

1. Download Cisco TFTP Server from cisco.com or old version at here. Run setup file to install the software on the computer that will be a TFTP Server (the computer that connected to Cisco router on Ethernet port).
   
2. After installed, you’ll see Cisco TFTP Server shortcut on desktop.
   
3. Open Cisco TFTP Server. You’ll see the window as below that means you have finished setup TFTP Server. You must leave this window open to send/receive configuration with Router.
   
4. You can customize TFTP Server root directory (the directory to keep configuration files) by click View -> Options on menu bar.
   

Backup running configuration from a router to the TFTP Server

1. Connect cable from the router to the TFTP Server. Assign IP on both and ensure that you can ping each other. In this example, the TFTP Server has IP address 192.168.11.10 and the router is 192.168.11.1
2. Connect to the router.
   
3. Type ‘copy running-config tftp:’ (without quote).
4. Enter the IP address of the remote host (the TFTP Server). In this example, it is 192.168.11.10
5. Enter the destination filename to save the configuration to. Or you can enter to accept the value in the bracket[].
   
6. You’ll see the file that has been created and the status on TFTP Server is updated.
   
   
7. The file contain the running configuration of the router.
   

Restore startup configuration from a file on TFTP Server

1. Connect cable from the router to the TFTP Server. Assign IP on both and ensure that you can ping each other. In this example, the TFTP Server has IP address 192.168.11.10 and the router is 192.168.11.1
2. Connect to the router.
3. Enter the IP address of the remote host (the TFTP Server)
4. Enter the source filename for restore to startup configuration.
5. The destination is startup-config.
6. Now the configuration file has been restored to startup-configuration.
   

Summary

The example above shows only one common way to backup and restore the configurations but there are other ways like FTP, HTTP, etc so that you can try which way will suit you best.

No related posts.

Before I start, let see the general table which will used to describe IP address. In each column will be the IP address that separate by octet, dot-notation (x.x.x.x). In each row is the IP address.

Generic Subnet Table

Let’s start

I divide into 2 categories which depend on subnet mask:

1. Do Maths with easy masks
   For the masks that contain only 255s and 0s. There are three masks which are 255.0.0.0, 255.255.0.0 and 255.255.255.0.
   I guess many people know this already, but l will explain a little bit to revise for someone.
   1. Find the subnet number
      • Copy first octet (mask 255.0.0.0), first two octets (mask 255.255.0.0) or first three octets (mask 255.255.255.0) from IP address
      • Put 0s in the remaining octets
   2. Find the broadcast the address
      • Copy first octet (mask 255.0.0.0), first two octets (mask 255.255.0.0) or first three octets (mask 255.255.255.0) from IP address. This is the same in ‘Find the subnet number’, step 1
      • Put 255s in the remaining octets
   3. Find range of valid IP addresses
      • To find the first valid IP address, copy the subnet number and add 1 to the fourth octet
      • To find the last valid IP address, copy the broadcast address and subtract 1 to the fourth octet
   4. Example
      • Mask 255.0.0.0
        

        Octet	1	2	3	4
        Address	10	110	140	1
        Subnet number	10	0	0	0
        First Address	10	0	0	1
        Broadcast Address	10	255	255	255
        Last Address	10	255	255	254

      • Mask 255.255.0.0
        

        Octet	1	2	3	4
        Address	10	110	140	1
        Subnet number	10	110	0	0
        First Address	10	110	0	1
        Broadcast Address	10	110	255	255
        Last Address	10	110	255	254

      • Mask 255.255.255.0
        

        Octet	1	2	3	4
        Address	10	110	140	1
        Subnet number	10	110	140	0
        First Address	10	110	140	1
        Broadcast Address	10	110	140	255
        Last Address	10	110	140	254

2. Do Maths with difficult masks
   In this case, most people find it’s difficult to calculate and some has to do by binary math which is time consuming. Let see the way to figure out in few seconds.
   1. Find the subnet number
      • I will define the column that contain the difficult number(not 255s and 0s) as the interesting column. For any octets fully to the left of the interesting column, copy value(s) from the original IP Address into all addresses(subnet number, first-last address and broadcast address).
        

        Octet	1	2	3	4
        Address	130	4	102	1
        Mask	255	255	252	0
        Subnet number	130	4
        First Address	130	4
        Broadcast Address	130	4
        Last Address	130	4

      • For any octets fully to the right of the interesting column, put 0s in the subnet number.
        

        Octet	1	2	3	4
        Address	130	4	102	1
        Mask	255	255	252	0
        Subnet number	130	4		0
        First Address	130	4
        Broadcast Address	130	4
        Last Address	130	4

      • Now the tricky part, find a ‘magic number’ which is 256 minus mask’s interesting octet. In this example, it is 256 – 252 = 4.
      • Find the multiple of the magic number that is closest to, but not greater than the the interesting octet of original IP address. For this case, it is 100 (4*25) which also not greater than 102.
      • Put the result from previous step in subnet number of the interesting column.
        

        Octet	1	2	3	4
        Address	130	4	102	1
        Mask	255	255	252	0
        Subnet number	130	4	100	0
        First Address	130	4
        Broadcast Address	130	4
        Last Address	130	4

   2. Find the broadcast address
      • For any octets fully to the right of the interesting column, put 255s in the broadcast address. The left part should be filled already in Find subnet number, the upper.
      • Again, use the magic number. By adding the magic number to the interesting octet of subnet number and subtract 1. In this example, the magic number is 256 – 252 = 4, 100 + 4 – 1 = 103.
      • Put the result from previous step in broadcast number of the interesting column.
        

        Octet	1	2	3	4
        Address	130	4	102	1
        Mask	255	255	252	0
        Subnet number	130	4	100	0
        First Address	130	4
        Broadcast Address	130	4	103	255
        Last Address	130	4

   3. Find range of valid IP addresses
      The way used to find the first and last IP addresses are the same in easy mask.
      • To find the first valid IP address, copy the subnet number and add 1 to the fourth octet
      • To find the last valid IP address, copy the broadcast address and subtract 1 to the fourth octet
        

        Octet	1	2	3	4
        Address	130	4	102	1
        Mask	255	255	252	0
        Subnet number	130	4	100	0
        First Address	130	4	100	1
        Broadcast Address	130	4	103	255
        Last Address	130	4	103	254

Reference: CCNA Self-Study, CCNA ICND, Chapter 4: IP Addressing and Subnetting

No related posts.