Introduction

To derive an Internet Protocol version 4 (IPv4) subnet, convert the prefix length into a mask, calculate the network boundary, and identify the host range. Then compare the destination with the connected prefix and inspect the selected route: for an ordinary on-link Ethernet destination, Address Resolution Protocol (ARP) resolves that destination's address; for a remote destination reached through a gateway, ARP resolves the gateway's local address. The IP destination remains the remote endpoint.

This procedure connects IPv4 subnetting, ARP and the next-hop decision through one original address plan. It assumes a host with a connected route and a default gateway, without more-specific routes, proxy ARP or address translation. The arithmetic and host reasoning are general IPv4 concepts; product references use the series baseline of AOS-CX 10.13 on CX 6300. No switch routing configuration or executed command output is presented.

Architecture Overview: Three Different Pieces of State

A subnet mask identifies the network portion of an IPv4 address. A route selects an outgoing path and, when necessary, a gateway. An ARP entry maps an on-link IPv4 neighbor to its Media Access Control (MAC) address for Ethernet delivery. These pieces cooperate, but none replaces another.

A virtual local area network (VLAN) supplies the Layer 2 broadcast domain in this example. The intended host and gateway must also share a working local Ethernet path. Matching IP calculations cannot repair incorrect VLAN membership, a disconnected interface or a missing return route.

Derive the Subnet Step by Step

Convert the Prefix to a Mask

Assume a workstation has 192.0.2.77/26. These are illustrative documentation addresses, not values to apply to a production interface.

An IPv4 address has 32 bits. The 26-bit prefix assigns 26 bits to the network and leaves 6 for host values. The mask therefore has 26 leading binary ones: three complete octets of ones, followed by 11000000. In decimal, that is 255.255.255.192.

The final octet contains the subnet boundary. Its block size is 256 minus 192, or 64. Within this example's 192.0.2.0/24 range, these subnet blocks begin at .0, .64, .128 and .192. Address .77 falls in the block beginning at .64.

Calculate Network, Broadcast and Usable Addresses

Applying a bitwise AND to the host address and mask produces the network address. Only the final octet needs calculation here:

Address: 77  = 01001101
Mask:    192 = 11000000
AND:     64  = 01000000

The subnet is 192.0.2.64/26. Setting all six host bits to one produces 192.0.2.127, the subnet-directed broadcast address. The ordinary host range is 192.0.2.65 through 192.0.2.126: 64 total addresses minus the network and broadcast addresses gives 62 usable host addresses.

This count applies to the conventional subnet being illustrated. Do not extend the subtraction rule blindly to special cases such as 31-bit point-to-point prefixes or 32-bit host routes.

Choose 192.0.2.65 as the example gateway and reserve it in the address plan. Confirm that .77 is neither a boundary address nor a duplicate assignment. The arithmetic identifies eligible addresses; it does not prove that an address is unused.

Determine Which Neighbor ARP Must Resolve

Apply the same mask to each destination and compare the result with the workstation's network address. Under the stated simple route assumptions, this distinguishes direct delivery from delivery through the default gateway.

Intended destinationDestination AND 255.255.255.192Selected local recipientARP target if no usable cache entry exists
192.0.2.93192.0.2.64Destination host192.0.2.93
192.0.2.140192.0.2.128Default gateway192.0.2.65

For .93, both network results are .64. The workstation broadcasts an ARP request for .93 on its local VLAN when resolution is needed. A reply supplies the neighbor mapping. The outgoing data frame uses the workstation's source MAC address and .93's destination MAC address; its IP destination is .93.

For .140, the destination network differs. The workstation selects its default route through .65 and resolves .65's MAC address. Its data frame is addressed to the gateway, while the encapsulated IP packet still names .140 as the destination. It does not broadcast locally to discover .140's MAC address across the router.

The initial ARP resolution requests in this example are local broadcasts and are not forwarded by routers. Cache validation can instead use unicast ARP requests. Each subsequent Ethernet link uses its own local neighbor resolution as needed. A valid cached mapping can avoid a new request, so absence of an ARP broadcast during one attempt is not evidence that ARP is irrelevant.

Validate the Address Plan Before Changing Anything

Use the following reasoning checks on an isolated example or an authorized network. They are checks to perform using the applicable host and switch tools, not fabricated command results:

  1. Confirm the host's actual address, prefix and selected interface. Calculate the network from those actual values.
  2. Confirm that the intended gateway is reachable on the local link under this design and has the expected address. A remote gateway value does not become usable simply because it was entered in a settings field.
  3. Inspect the route selected for the test destination. Additional routes can override the simple connected/default choice used above.
  4. Compare the neighbor entry with the selected next hop. For the remote test, expect evidence about the gateway's local mapping rather than a remote server mapping.
  5. Check the peer's address plan and return path before interpreting one successful outbound observation as complete connectivity.

On AOS-CX, keep routing evidence and ARP evidence separate, and use the matching IP Routing and IP Services guides for their respective interpretation. Learning a neighbor mapping does not prove that routing, policy or the destination service will permit the full exchange.

Common Mistakes and Their Consequences

A common mistake is assuming that addresses sharing the first three octets are always local. In this example, .77 and .140 share those octets but belong to different networks under the 26-bit prefix. The prefix, rather than the visual resemblance, determines the connected network.

Mismatched masks can produce inconsistent peer decisions. Record the mask on both endpoints; do not correct only the device from which a test was launched. Similarly, a gateway must belong to the intended reachable local network in this conventional design, and an assigned address must be unique.

An empty or unresolved ARP entry identifies a local resolution problem to investigate, not its complete cause. Check the selected interface, VLAN path and neighbor identity before changing addresses. Record existing settings and preserve recovery access before an authorized change; this conceptual exercise requires no production changes.

Certification Relevance and Conclusion

The practical outcome is to explain the address calculation and name the next hop before discussing Ethernet delivery. For .77/26, .93 is local and .140 uses the example gateway. Keep network boundaries, selected routes and ARP mappings distinct: each answers a different question about how the host sends a packet.

Authoritative Sources