Splitting a network: subnets in practice

Building on the bit ruler from the course <i>ISO/OSI and TCP/IP: the network map</i>, this takes the next step: how to split one allocated network into several pieces of different sizes. How many addresses to ask for, where subnets begin, VLSM and the largest-first order, the /30 on router links – and the mistakes that break a plan (overlap, a wrong mask, exhausted addresses).

Lesson 1: Why split one network

One large network: noise and security

The provider hands you one network – say 192.168.10.0/24, meaning 254 usable addresses – and you could pour everything into it: office computers, the warehouse, servers, printers, cameras. It would work. And yet nobody does it, for three reasons you already know from earlier courses. Broadcast. Every broadcast frame (ARP, the DHCP Discover from the course DHCP: how a device gets an address) reaches everyone – the more devices, the more noise everyone has to process. Security. In one network everybody talks to everybody directly and there is nowhere to place a rule; a camera reaches the accounting server because nothing stops it (the courses Switching and VLANs and Network security). Clarity. When the warehouse has its own range, you can tell where traffic comes from by its address alone – and that holds for rules, for logs and for fault-finding. So splitting a network is first of all a design decision, not a math exercise. The math is merely the tool for writing it down.

Step by step

You got one network. Technically everything would fit into it – 254 usable addresses.
But a broadcast reaches everyone. The more devices in one network, the more noise everyone has to process.
And security: in one network everybody talks directly and a rule has nowhere to bite. The camera reaches the accounting server.
Splitting creates three boundaries. Broadcasts stop, rules have somewhere to bite, and the address alone tells you where traffic is from.

How many addresses you actually need

Before you reach for a mask you need one number: how many devices that particular part will hold. And note: it is not the number of people. A warehouse with twenty workers also holds scanners, a label printer, a tablet at the ramp and an access point – easily double. So add a reserve for the future to every number; a network is not rebuilt every six months. At the same time the opposite holds: a range should not be needlessly large. Inflating every subnet to a /24 “just in case” looks comfortable, but addresses are finite – out of one /24 you get either three sensible subnets or one huge one and then nothing. So the practical procedure is always the same: 1) list the parts of the network, 2) write the device count including reserve next to each, 3) and only then look for the prefix that fits it most tightly. That last sentence is the whole second lesson, and the key word in it is most tightly.

Step by step

Start with the device count, not the mask. Offices: fifty machines including printers and reserve.
Twenty people work in the warehouse, but there are more devices: scanners, a label printer, a tablet, an access point.
Servers grow more slowly than users – the reserve here can be smaller. Each part has a different character.
Inflating every part “just in case” does not work: out of one /24 you get three sensible subnets, or one huge one and then nothing.

Where to draw from: private ranges

Where do the numbers actually come from? Inside a company, from the private ranges – three blocks reserved for internal networks and not routed on the internet: 10.0.0.0/8 (enormous, over 16 million addresses), 172.16.0.0/12 and 192.168.0.0/16. For now read the number after the slash as the smaller it is, the bigger the block – the next lesson unpacks why. Anyone may use these addresses, because traffic reaches the outside through NAT anyway (the courses Routing and IP addresses and The router in depth) and nobody addresses them from outside. Which block you pick is a matter of convenience, not correctness. 192.168.x.x is familiar to everyone from home routers and suits small networks. 10.x.x.x is used in larger companies, because a legible plan builds nicely in it – say one digit for the branch, another octet for the VLAN. And one practical warning: if you plan a VPN between two sites (the course Networking to the cloud), avoid the utterly ordinary ranges such as 192.168.0.0/24 or 192.168.1.0/24. When both ends hold the same one, the tunnel comes up but the traffic will not know where it belongs.

Step by step

Inside a company you draw from three private blocks. Anyone may use them – they are not routed on the internet.
192.168.x.x is familiar from every home router and is the most convenient for a small network.
In a larger company 10.x.x.x fits: in such a large block you can build a legible plan – an octet for the branch, an octet for the VLAN.
Beware with VPNs: when both ends hold the same range, the tunnel comes up but traffic will not know where it belongs.

▶ Open in the simulator

Lesson 2: Where the network ends and the host begins

The prefix as a line in the address

In the course ISO/OSI and TCP/IP: the network map, in the modules Bits and numbers and Subnetting, you got a feel for the bit ruler: the prefix is a line inside the address splitting it into the network part (left) and the host part (right). We build on that here, so just the one sentence you need under your skin: the further right you move the line, the smaller each subnet gets – and the more of them you have. Every extra bit in the prefix halves the size and doubles the count. Out of a /24 (256 addresses), a /25 makes two networks of 128, a /26 four of 64, a /27 eight of 32. From this follows how you find the right prefix for a known device count: you move right from /24 until the required count still fits. Fifty devices? A /26 gives 62 usable – it fits. A /27 would give 30 – it does not. So a /26. (Why not 64 and 32? Two addresses in every subnet are reserved – that is the very next module.) No arithmetic, just moving the line.

Step by step

The starting point: a /24, one piece of 256 addresses. The line sits after the third octet.
Move the line one bit right: a /25. You get two networks of 128 addresses.
Every further bit halves the size and doubles the count. A /26 gives four of 64, a /27 eight of 32.
That is how you find a prefix: move right while the count still fits. Fifty devices = a /26, because a /27 would give only 30.

Network address, broadcast and the rest

In every subnet there are two addresses no device gets. The first is the network address – the name of the whole subnet, what you write into the routing table and into rules. The last is the broadcast – “everyone in this subnet”. That is why two are always subtracted from the size: a /26 holds 64 addresses but 62 usable. With small subnets this hurts most: a /29 holds eight addresses and only six usable. It is also the most common place where a plan misses by one device – you count 30 addresses for a /27 and forget that only 30 of the 32 are usable. The practical consequence: when your device count comes out exactly at the subnet size, you are already over the line. Sixty-two devices do not belong in a /26, even though 64 looks like enough. And the last usable address is customarily the gateway – or the first, depending on convention; what matters is keeping it the same across the company.

Step by step

The first address is the name of the whole subnet. You write it into routing tables and rules – no device gets it.
The last address is the broadcast – “everyone in this subnet”. No device gets that one either.
That is why two are always subtracted. A /26 holds 64 addresses, but 62 are usable.
With small subnets it hurts most: a /29 holds eight addresses and six usable. This is where a plan most often misses by one device.

The step between subnets

One mechanical thing remains: where each subnet begins. Subnets follow one another in steps equal to their size. For a /26 (64 addresses) the starts are .0, .64, .128, .192. For a /27 (32 addresses) they are .0, .32, .64, .96 and so on. Nothing exists in between – a subnet cannot begin at .50 or .100, however much tidier that might look to you. This is exactly the source of plans that look pretty and do not work: splitting a /24 into pieces “of a hundred” simply cannot be done, because a hundred is not a power of two. That is just another name for what you know from the previous module: every extra bit halves the size, so subnet sizes are always 2, 4, 8, 16, 32, 64 – never 100. A trick worth having: write the starts down before you start assigning. Once you know that for a /26 they are .0, .64, .128 and .192, the whole plan almost assembles itself and can produce neither a gap nor an overlap. And one more connection: the network address from the previous module is always exactly one of those starts – so it doubles as a check on whether the mask is written correctly.

Step by step

The first /26 begins at .0 and takes 64 addresses, that is .0 to .63.
The next begins exactly where the previous ended: at .64. The step equals the size.
All the /26 starts inside one /24: .0, .64, .128, .192. Nothing exists in between.
That is why you cannot split “by hundreds” – a hundred is not a power of two. A plan can look pretty and still not work.

▶ Open in the simulator

Lesson 3: Split one network into several

Equal-sized pieces

The simplest split is into equal-sized pieces. Need four parts? Move the line two bits (/24 → /26) and you have four subnets of 64 addresses, each with 62 usable. Done, no thinking required. This approach has a big advantage: it is easy to follow. Everyone on the team knows networks start every 64, and the plan can be worked out from memory a year later. As long as the addresses suffice, it is an entirely legitimate choice, and school examples use it almost always. The downside shows once the parts are very unequal. Three subnets of 62 addresses look fair, but when one of them holds fifty people, the second twenty and the third ten, you are wasting – and above all you are left with a single free /26 for everything else still to come. For such a case a more flexible procedure exists, and it is the next module’s content.

Step by step

The task: split one /24 into four parts. The simplest way is to give them all the same size.
A two-bit shift makes four subnets of 64 addresses. No extra arithmetic.
The result is legible: starts every 64, everyone on the team remembers them and can work the plan out a year later.
The cost shows with unequal parts: ten servers in a /26 leave 52 addresses idle, and you are left with a single free /26.

VLSM: pieces of different sizes

The more flexible procedure is called VLSM – variable length subnet masking (a mask is just another way to write a prefix, as you know from the course ISO/OSI and TCP/IP: the network map). It sounds academic but means something plain: each subnet gets its own prefix according to its size, not one shared by all. Offices with fifty devices get a /26 (62 usable), the warehouse with twenty a /27 (30), and the servers with ten a /28 (14). Together they take 64 + 32 + 16 = 112 addresses out of 256 – the rest stays free for whatever comes next. Had they been given equal masks, 192 addresses would have gone and a single /26 would remain. The difference lies exactly in that remainder. In practice VLSM is done by taking one large network and biting pieces off it – the largest subnet first, the next behind it, and what remains is still one contiguous free block. And because each piece begins at a multiple of its own size (the second lesson), they stack tightly, with no gaps.

Step by step

The largest part first: the offices get a /26 and take .0 to .63.
The warehouse needs less, so it gets a /27 – and begins exactly where the offices ended.
The servers get a /28. Three different masks in one network – that is exactly what the abbreviation VLSM means.
112 of 256 went and the rest stayed in one piece. With equal masks a single /26 would remain.

Largest first

One VLSM rule deserves its own module, because beginners break it almost every time: assign from the largest subnet to the smallest. The reason lies in the steps from the second lesson. A large subnet must begin at a multiple of its own size – a /26 only at .0, .64, .128 or .192. If you start with the small ones and crumble the beginning of the network into sixteens, you find that plenty of addresses remain, but not in one piece in the right place – there is nowhere to lay the large /26. Going from the largest cannot have this problem: every further piece is the same size or smaller, and a smaller piece always fits on a larger one’s boundary. So the practical recipe reads: 1) sort the parts by device count, descending, 2) put the first at the start of the network, 3) lay each next one right behind the previous. Then just check that the last one ended inside the original network.

Step by step

The wrong start: the smallest subnet at the beginning of the network. It looks innocent.
Another small one behind it. The beginning of the network is crumbled into small pieces.
And now the large /26: there would be enough addresses, but not in one piece at a multiple of 64. It has nowhere to go.
From largest to smallest this problem cannot arise: a smaller piece always fits on a larger one’s boundary.

/30 and /31 on a link

A special case you will hit in almost every plan: the link between two routers. It carries exactly two devices and never will carry more – yet it needs its own subnet, because it is a separate network between two L3 devices. Giving it a /24 would be waste in its purest form: 254 addresses for two machines. So such links use a /30: four addresses, of which two are usable (the first is the network address, the last the broadcast) – exactly enough for two routers, not one to spare. It is the most common prefix you will see in a real network outside user subnets. And there is an even thriftier variant, the /31: two addresses and both usable. It is a deliberate exception to the two-reserved-addresses rule: on a point-to-point link a broadcast would have nobody to serve anyway – the two neighbors already know each other – so both addresses were freed up for use. You need not use it, but you should recognize it when you meet it in somebody else’s configuration and start thinking that such a small mask surely makes no sense.

Step by step

A link between two routers carries exactly two devices – and never will carry more.
Giving it a /24 is waste in its purest form: 254 addresses for two machines.
So a /30: four addresses, two of them usable – exactly enough for two routers, not one to spare.
Thriftier still is the /31 – only for point-to-point links where no broadcast is needed. Recognize it when you meet it.

▶ Open in the simulator

Lesson 4: Mistakes in a plan

Overlapping subnets

The most common mistake in a plan is an overlap: two subnets claiming the same addresses. It almost always arises by accident – somebody adds a new network and eyeballs the range, or forgets that a /26 reaches all the way to .63, so the next one starts at .32. The bad part is that it does not fail immediately. The router suddenly has two paths to the same addresses and picks one; some traffic goes correctly, some disappears, and it depends on which path is “better” in the table. The user describes it as “sometimes it works and sometimes it does not”, which is the hardest category of fault to track down. The defense is simple and boring: write the plan down before you click it in, and note the last address next to each subnet’s range. An overlap is then visible at a glance – one’s end is greater than the other’s start. The simulator also flags overlaps in the Topology check, so you can verify it there too.

Step by step

The first subnet: a /26 from .0, so it reaches all the way to .63. That last address is the crux.
The second begins at .32 – but that is still inside the first one. An overlap has appeared.
The router suddenly has two paths to the same addresses. It picks one – and some traffic quietly disappears.
The defense is boring: note the last address alongside each range. One’s end greater than another’s start = an overlap, at a glance.

A wrong mask: a neighbor that is not one

The second classic is a wrong mask on a single machine. The address is right, the cable holds, but the device carries, say, a /24 where a /26 belongs. What happens? The mask decides one single question: who is a neighbor. With a wrong mask the machine believes that somebody actually lying in a different subnet is a neighbor – and instead of sending the data to the gateway, it tries to deliver it directly. Nobody answers. From outside this looks like the strangest fault under the sun: it reaches some addresses and not others, while both are “in the same network”. And because a ping to the gateway often goes through – its address tends to sit near the start of the range, so it still comes out as a neighbor even under the wrong mask – you easily blame something else. A tip for practice: when one machine cannot see what the others see, compare its mask with a neighbor’s. It is a ten-second question and it resolves an unexpectedly large share of cases. You can try exactly this scenario in the challenge linked to this lesson.

Step by step

With the right mask the machine knows the target is in a different subnet and sends the data to the gateway.
Now the same machine holds a /24 instead of a /26. The address is right, the cable holds – only its idea of neighbors changed.
It believes the target is a neighbor, so it tries to reach it directly instead of via the gateway. Nobody answers.
From outside: it reaches some addresses and not others. When one machine cannot see what the others see, compare its mask.

When the addresses run out

The last mistake is not in the math but in the estimate: the subnet is small. The warehouse came out at twenty devices, got a /27 with thirty usable – and a year later a second scanner, a tablet and a printer arrive and that is that. It shows up inconspicuously: new devices get no address from DHCP, because the range is exhausted (the course DHCP: how a device gets an address), while the old ones carry on. That is exactly the fingerprint you know from there, only this time the cause is not an attack but a plan. Two ways out exist and neither is free. Enlarge the subnet – but that works only when free space lies behind it; when the next network follows immediately, there is nowhere to grow and you must renumber. Add another subnet – quicker, but the plan fragments. The cheapest is to leave room right behind every subnet at design time, not once it happens. That is exactly why 144 addresses remained in one piece in the VLSM module.

Step by step

The warehouse got a /27 for twenty devices. A reserve of ten addresses looked generous on design day.
A year on the range is full. New devices get no address while the old ones carry on – you know that fingerprint from the course DHCP: how a device gets an address.
Enlarging it is impossible: the next subnet starts right behind. That leaves renumbering, which is expensive.
The cheapest defense is leaving room right behind every subnet at design time – exactly why 144 addresses remained whole under VLSM.

▶ Open in the simulator