CyberKit

Subnetting: answer key

Every question with its answer and the reasoning. Work the drill first, or the key only tells you what, not how.

  1. A new lab segment needs a single CIDR block that exactly covers the 16 addresses from 10.30.6.0 through 10.30.6.15, no more and no fewer. Build the block.

    Answer: 10.30.6.0/28

    16 addresses is 2⁴, so the prefix is /28 (32 − 4). 10.30.6.0/28 has network address 10.30.6.0 and broadcast address 10.30.6.15, exactly the requested range, with 10.30.6.16 and 10.30.5.255 falling just outside it in the neighboring blocks.

  2. 100.64.55.10 falls inside 100.64.0.0/10 (Shared Address Space). What category does this block belong to?

    Answer: Shared address space (CGNAT)

    Reserved for carrier-grade NAT (CGNAT) between an ISP's customer-facing network and its own NAT devices: routable only within that provider's network, distinct from RFC 1918. Seeing this in a log usually means the traffic traversed an ISP's CGNAT layer, not a private LAN.

    Read more: RFC 6598

  3. Team A's workstation pool must include 172.20.14.10 and 172.20.14.200. Team B owns the /24 blocks immediately before and after it. Build a single CIDR block that covers both of Team A's addresses without reaching into Team B's space.

    Answer: 172.20.14.0/24

    A /25 only reaches 172.20.14.0-.127, too small to cover .200. Bumping up to /24 gives 172.20.14.0-172.20.14.255, which covers both required addresses while still stopping cleanly at the neighboring /24s on either side.

  4. A firewall rule must match traffic from 10.50.8.64 and 10.50.8.95 only, not from 10.50.8.63, 10.50.8.96, or the unrelated address 10.50.9.1. Build the CIDR block.

    Answer: 10.50.8.64/27

    64 through 95 inclusive is 32 addresses: 2⁵, a /27. 10.50.8.64/27 aligns cleanly (64 is a multiple of 32), giving network 10.50.8.64 and broadcast 10.50.8.95, with .63 and .96 falling just outside in the neighboring /27s and .9.1 sitting in an entirely different /24.

  5. 169.254.10.5 falls inside 169.254.0.0/16 (Link Local (APIPA)). What category does this block belong to?

    Answer: Link-local

    Auto-assigned by Windows/most OSes when DHCP fails: seeing this on a host is a strong signal it never reached a DHCP server, not evidence of a specific attack on its own.

    Read more: RFC 3927

  6. A WAN link uses an RFC 3021 point-to-point IPv4 addressing scheme with just two host addresses and no separate network/broadcast address: 10.255.255.0 and 10.255.255.1. Build the smallest CIDR block containing both.

    Answer: 10.255.255.0/31

    RFC 3021 repurposes /31 for exactly this case: a 2-address block with no wasted network/broadcast address, both addresses usable as hosts. 10.255.255.0/31 covers precisely 10.255.255.0 and .1, with the neighboring addresses on either side falling outside it.

  7. An incident report references two hosts inside the same site allocation: 10.4.1.5 and 10.7.254.20. Build the smallest single CIDR block that contains both addresses.

    Answer: 10.4.0.0/14

    10.4.1.5 and 10.7.254.20 are far enough apart (third octet 4 vs. 7) that no /24, or even /16, covers both while staying aligned. The smallest block that does is 10.4.0.0/14, spanning 10.4.0.0 through 10.7.255.255. That's a real supernetting move: the covering block is much bigger than either address individually needs, but it's the smallest one that's actually valid.

  8. 192.0.2.55 falls inside 192.0.2.0/24 (Documentation (TEST-NET-1)). What category does this block belong to?

    Answer: Documentation

    Reserved purely for documentation/examples: never routed on the real internet. This site's own fabricated Email Header Analyzer sample uses this range for exactly that reason.

    Read more: RFC 5737

  9. An analyst wants a single rule that flags any traffic from IANA's benchmarking address space (RFC 2544), reserved for testing network-interconnect throughput so a benchmark never floods a real internet address. A benchmarking host lives at 198.18.0.1, another at 198.19.255.254. Build the CIDR block that covers the whole benchmarking range.

    Answer: 198.18.0.0/15

    IANA reserves 198.18.0.0/15 for benchmarking (RFC 2544). A /15 spans two consecutive /16s (198.18.0.0-198.19.255.255), exactly the range needed to cover both sample hosts while stopping at the surrounding address space.

    Read more: RFC 2544

  10. A report cites hosts at 203.0.113.10 and 203.0.114.250, addresses in two adjacent /24s from this site's own documentation-range examples. Build the smallest single CIDR block that contains both addresses.

    Answer: 203.0.112.0/22

    203.0.113.10 and 203.0.114.250 sit in two different /24s, so the smallest block that contains both is 203.0.112.0/22, spanning 203.0.112.0 through 203.0.115.255. Notice that block also swallows 203.0.112.0/24 and 203.0.115.0/24, neither of which was asked for. That is inherent to supernetting, not a mistake: there's no smaller single CIDR block that covers two addresses this far apart.

    Read more: Try it in the CIDR & VLAN Calculator's Supernet mode

Back to the drill