Inside a private network built on RFC 1918 space, what should an addressing plan primarily optimize for?
Packing hosts into the smallest possible subnets to conserve addresses
A logical, readable numbering scheme with generous headroom for growth
Using public IPv4 ranges so the network is internet-routable
Minimizing the number of VLANs to reduce switch configuration
In the Acme Corp scheme 10.<site>.<VLAN>.<host>, what does the address 10.2.20.15 tell a reader at a glance?
Site 20, VLAN 15, host 2
Branch site (2), Servers VLAN (20), host 15
A public address that must be translated by NAT before use
HQ site, Users VLAN, gateway address
Why does the chapter warn against using 192.168.1.0/24 on a business LAN?
It is a public range and cannot be used internally
It is too large to be manageable as a single VLAN
It is a common home-router range, so VPN users' home networks overlap it and cause routing conflicts
It only supports 128 hosts, which is too few for any office
What is the standard relationship between VLANs and IP subnets in the recommended design?
One subnet is shared across all VLANs at a site
One-to-one: each VLAN gets exactly one subnet and each subnet serves exactly one VLAN
Each VLAN should span several subnets for redundancy
VLANs and subnets are unrelated and never mapped to each other
What is the main benefit of documenting every allocation in an IPAM record or spreadsheet?
It makes the subnets automatically routable on the public internet
It prevents overlap, speeds troubleshooting, and makes expansion predictable
It replaces the need to configure gateways on hosts
It increases the number of usable hosts in each subnet
Designing an Addressing Plan
Key Points
- An addressing plan is the master blueprint of which subnet each part of the network uses; getting it right up front avoids the costly task of renumbering a live network.
- Build on RFC 1918 private space — usually the large
10.0.0.0/8 block — and optimize for readability and headroom, not address conservation.
- Encode meaning into the octets (e.g., second octet = site, third octet = VLAN) so addresses are self-documenting and easy to summarize.
- Map VLANs one-to-one with subnets, and avoid the default consumer ranges like
192.168.1.0/24 to prevent VPN overlap.
- Document every allocation (purpose, VLAN ID, gateway, DHCP scope, reservations) in an IPAM record or spreadsheet.
An addressing plan is the master document that says which IP subnet each part of your network uses, what each subnet is for, and how the whole scheme can expand. On the public internet IPv4 addresses are scarce, so you conserve them; inside your own network, private space is effectively free, so the goal flips — you optimize for an admin-friendly numbering scheme with generous headroom.
Business networks are built on the RFC 1918 private ranges, which are not routable on the public internet:
| Range | CIDR | Size | Contains |
|---|
10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | ~16.7 million addresses | One large Class A block |
172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | ~1 million addresses | 16 contiguous Class B blocks |
192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | ~65,000 addresses | 256 contiguous Class C blocks |
Growth planning and self-documenting octets
Four practical techniques follow from optimizing for readability: allocate large top-level CIDRs per site and function up front and leave headroom; encode meaning into the octets so 10.20.30.x reads as "site 20, VLAN 30"; right-size subnets with room to spare (a /22 with 1,022 usable hosts is a common VLAN "sweet spot"); and group hosts with similar connectivity needs (users, servers, printers, IoT, management) onto their own subnets.
Avoid the default consumer subnets. Do not use 192.168.0.0/24 or 192.168.1.0/24 on a business LAN. Remote workers on home networks using the same range hit subnet overlap over VPN — their laptop cannot tell whether 192.168.1.50 is the office file server or their living-room printer.
Worked example: Acme Corp
Acme bases its plan on 10.0.0.0/8, using the second octet for the site and the third octet for the VLAN. Anyone reading 10.2.20.15 immediately knows: Branch site, Servers VLAN, host 15. HQ summarizes on a WAN router as 10.1.0.0/16 and the branch as 10.2.0.0/16, keeping routing tables small.
| Site | VLAN | ID | Subnet | Gateway | Purpose |
|---|
| HQ | Users | 10 | 10.1.10.0/24 | 10.1.10.1 | Workstations |
| HQ | Servers | 20 | 10.1.20.0/24 | 10.1.20.1 | Internal servers |
| HQ | Printers | 30 | 10.1.30.0/24 | 10.1.30.1 | Print devices |
| HQ | IoT | 40 | 10.1.40.0/24 | 10.1.40.1 | Cameras, sensors |
| HQ | Management | 99 | 10.1.99.0/24 | 10.1.99.1 | Switch/router mgmt |
| Branch | Users | 10 | 10.2.10.0/24 | 10.2.10.1 | Workstations |
| Branch | Servers | 20 | 10.2.20.0/24 | 10.2.20.1 | Local servers |
| Branch | Management | 99 | 10.2.99.0/24 | 10.2.99.1 | Switch/router mgmt |
Figure 10.1: Acme Corp site-and-VLAN address hierarchy
graph TD
ROOT["10.0.0.0/8 (private space)"]
ROOT --> HQ["HQ site: 10.1.0.0/16"]
ROOT --> BR["Branch site: 10.2.0.0/16"]
HQ --> HQU["Users VLAN 10: 10.1.10.0/24"]
HQ --> HQS["Servers VLAN 20: 10.1.20.0/24"]
HQ --> HQP["Printers VLAN 30: 10.1.30.0/24"]
HQ --> HQI["IoT VLAN 40: 10.1.40.0/24"]
HQ --> HQM["Management VLAN 99: 10.1.99.0/24"]
BR --> BRU["Users VLAN 10: 10.2.10.0/24"]
BR --> BRS["Servers VLAN 20: 10.2.20.0/24"]
BR --> BRM["Management VLAN 99: 10.2.99.0/24"]
Visual animation — coming soon
An addressing plan is only as good as its documentation. Maintain an IPAM record — dedicated software or a well-maintained spreadsheet — mapping each subnet to its purpose, VLAN ID, gateway, DHCP scope, and static reservations. Good documentation prevents overlap, speeds troubleshooting, and makes expansion predictable.
Inside a private network built on RFC 1918 space, what should an addressing plan primarily optimize for?
Packing hosts into the smallest possible subnets to conserve addresses
A logical, readable numbering scheme with generous headroom for growth
Using public IPv4 ranges so the network is internet-routable
Minimizing the number of VLANs to reduce switch configuration
In the Acme Corp scheme 10.<site>.<VLAN>.<host>, what does the address 10.2.20.15 tell a reader at a glance?
Site 20, VLAN 15, host 2
Branch site (2), Servers VLAN (20), host 15
A public address that must be translated by NAT before use
HQ site, Users VLAN, gateway address
Why does the chapter warn against using 192.168.1.0/24 on a business LAN?
It is a public range and cannot be used internally
It is too large to be manageable as a single VLAN
It is a common home-router range, so VPN users' home networks overlap it and cause routing conflicts
It only supports 128 hosts, which is too few for any office
What is the standard relationship between VLANs and IP subnets in the recommended design?
One subnet is shared across all VLANs at a site
One-to-one: each VLAN gets exactly one subnet and each subnet serves exactly one VLAN
Each VLAN should span several subnets for redundancy
VLANs and subnets are unrelated and never mapped to each other
What is the main benefit of documenting every allocation in an IPAM record or spreadsheet?
It makes the subnets automatically routable on the public internet
It prevents overlap, speeds troubleshooting, and makes expansion predictable
It replaces the need to configure gateways on hosts
It increases the number of usable hosts in each subnet
What is the fundamental purpose shared by all subnet calculators, whether CLI, web, or spreadsheet?
To automatically configure the mask on live router interfaces
To independently confirm a subnet's network, broadcast, mask, usable range, and host count
To assign IP addresses to hosts via DHCP
To encrypt subnet traffic between sites
For ipcalc 202.54.1.2/27, why does the tool report exactly 30 usable hosts?
A /27 has 32 total addresses, minus the network (.0) and broadcast (.31), leaving 30
A /27 always reserves 2 addresses for DHCP and gives the rest to hosts
A /27 has 30 total addresses and all of them are usable
A /27 borrows 5 host bits, leaving 30 network bits
Which capability makes sipcalc especially useful for troubleshooting a live device?
It can only accept masks in dotted-quad format
It can retrieve address information directly from a live network interface
It automatically fixes wrong masks it detects
It refuses to process IPv6 addresses, avoiding confusion
A /22 subnet reports a usable range spanning four third-octet values (e.g., .0 through .3). Why?
Because a /22 has 256 addresses split into four equal groups
Because a /22 has 1,024 total addresses, which spans four full /24 blocks
Because /22 subnets always start at the .0 boundary of four random octets
Because the mask 255.255.252.0 removes the third octet entirely
What is the professional "plan-verify-document" workflow described in the chapter?
Verify with a calculator first, then guess the blocks, then deploy
Plan blocks in a spreadsheet, verify each with ipcalc/sipcalc, then record confirmed values as the source of truth
Configure the routers first, then document whatever they ended up with
Use only web calculators because CLI tools cannot be trusted
Tools of the Trade
Key Points
- Never trust hand-done binary math on a production network — a single flipped bit can take down a subnet.
- A subnet calculator (CLI, web, or spreadsheet) independently confirms network, broadcast, mask, usable range, and host count in seconds.
ipcalc is great for quick per-subnet checks and color-codes binary bits as a teaching aid; sipcalc adds IPv6, scripting, and reading live interfaces.- Spreadsheets are the best design-phase tool and double as your IPAM documentation.
- The workflow is: plan in a spreadsheet, verify with a CLI calculator, then record confirmed values as the documented source of truth.
A subnet calculator takes an address and mask and returns the derived facts about that subnet. Consider verifying a /27 with ipcalc 202.54.1.2/27:
| Field | Value |
|---|
| Netmask | 255.255.255.224 (/27) |
| Network address | 202.54.1.0 |
| HostMin | 202.54.1.1 |
| HostMax | 202.54.1.30 |
| Broadcast | 202.54.1.31 |
| Hosts/Net | 30 |
A /27 leaves 5 host bits, so 2⁵ = 32 addresses, minus the network (.0) and broadcast (.31), gives exactly 30 usable hosts. sipcalc is a more advanced console calculator that supports IPv4 and IPv6, can read a live interface, and accepts masks as dotted-quad, hex, or bit-count. Widen the mask to the /22 sweet spot and the usable range spans four third-octet values (.0 – .3) — that is the 1,022 usable hosts (1,024 minus network and broadcast) that make it comfortable.
Tool comparison
| Tool | Type | Best for | IPv6? | Notable feature |
|---|
ipcalc | CLI | Quick per-subnet checks; teaching | Limited | Color-codes binary bits |
sipcalc | CLI | Verification, scripting, live interfaces | Yes | Reads from an interface; -a bitmap |
whatmask | CLI | Fast mask-format conversion | No | CIDR ↔ dotted-quad ↔ wildcard |
| Web calculators | Web | Interactive VLSM design | Varies | No install; visual carving |
| Spreadsheet | Manual | Whole-network planning + IPAM docs | N/A | Doubles as documentation |
Figure 10.2: The plan-verify-document workflow
flowchart TD
A["Plan blocks in spreadsheet (subnet, VLAN, gateway, range)"] --> B["Verify each block with ipcalc / sipcalc"]
B --> C{"Math matches the plan?"}
C -->|"No"| D["Adjust mask or block boundary"]
D --> B
C -->|"Yes"| E["Record confirmed values in spreadsheet"]
E --> F["Spreadsheet is the documented source of truth"]
What is the fundamental purpose shared by all subnet calculators, whether CLI, web, or spreadsheet?
To automatically configure the mask on live router interfaces
To independently confirm a subnet's network, broadcast, mask, usable range, and host count
To assign IP addresses to hosts via DHCP
To encrypt subnet traffic between sites
For ipcalc 202.54.1.2/27, why does the tool report exactly 30 usable hosts?
A /27 has 32 total addresses, minus the network (.0) and broadcast (.31), leaving 30
A /27 always reserves 2 addresses for DHCP and gives the rest to hosts
A /27 has 30 total addresses and all of them are usable
A /27 borrows 5 host bits, leaving 30 network bits
Which capability makes sipcalc especially useful for troubleshooting a live device?
It can only accept masks in dotted-quad format
It can retrieve address information directly from a live network interface
It automatically fixes wrong masks it detects
It refuses to process IPv6 addresses, avoiding confusion
A /22 subnet reports a usable range spanning four third-octet values (e.g., .0 through .3). Why?
Because a /22 has 256 addresses split into four equal groups
Because a /22 has 1,024 total addresses, which spans four full /24 blocks
Because /22 subnets always start at the .0 boundary of four random octets
Because the mask 255.255.252.0 removes the third octet entirely
What is the professional "plan-verify-document" workflow described in the chapter?
Verify with a calculator first, then guess the blocks, then deploy
Plan blocks in a spreadsheet, verify each with ipcalc/sipcalc, then record confirmed values as the source of truth
Configure the routers first, then document whatever they ended up with
Use only web calculators because CLI tools cannot be trusted
If both 192.168.1.0/24 and 192.168.1.128/25 are defined on the same network, which addresses overlap?
192.168.1.0 through 192.168.1.127
192.168.1.128 through 192.168.1.255 — 128 addresses claimed by both
No addresses overlap; the /25 fits neatly inside the /24 without conflict
Only the single address 192.168.1.128 overlaps
Dividing 192.168.123.0 into four /26 subnets, how many usable hosts does each provide, and why?
64 usable, because a /26 has 64 total addresses and all are assignable
62 usable, because each /26 has 64 total minus its network and broadcast address
30 usable, because a /26 borrows 3 host bits like a /27
126 usable, because a /26 spans two /24 blocks
A host can reach its own segment and distant remote networks, but cannot reach nearby networks of the same address class. What is the most likely cause?
Wrong subnet mask
Wrong default gateway
Overlapping subnets
A disconnected network cable
A host can talk to devices on its own segment but cannot reach any remote networks. Which fingerprint does this match?
Wrong subnet mask
Off-by-one host count
Wrong default gateway
Overlapping subnets
In the troubleshooting workflow, what does running ip route get <target-ip> reveal?
The DHCP lease time remaining on the host
How the host would actually route a packet — e.g., sending a same-LAN target to the gateway signals a wrong local mask
Whether the remote host has a firewall enabled
The number of usable hosts in the destination subnet
Common Mistakes and Fixes
Key Points
- Nearly all subnetting outages come from four mistakes: overlapping subnets, off-by-one host counts, wrong masks, and wrong gateways.
- An overlap occurs when two subnets cover the same addresses (e.g., a /24 and a /25 colliding on
.128–.255).
- The first (network) and last (broadcast) address in every subnet can never be a host — forgetting this causes off-by-one errors.
- Each mistake has a distinctive symptom fingerprint that tells you which one you are looking at.
- Diagnose systematically: check config, ping gateway then remote, use
ip route get, traceroute, and verify math against documentation.
An overlap occurs when two subnets cover the same ranges. If someone defines both 192.168.1.0/24 and 192.168.1.128/25, every address from 192.168.1.128 to 192.168.1.255 belongs to both — 128 overlapping addresses that routers and hosts cannot consistently place.
For off-by-one errors, remember the first (all host bits zero) and last (all host bits one) addresses are never assignable. Dividing 192.168.123.0 into four /26 subnets:
| Subnet | Network (unusable) | Usable hosts | Broadcast (unusable) |
|---|
192.168.123.0/26 | .0 | .1 – .62 | .63 |
192.168.123.64/26 | .64 | .65 – .126 | .127 |
192.168.123.128/26 | .128 | .129 – .190 | .191 |
192.168.123.192/26 | .192 | .193 – .254 | .255 |
Each /26 yields 64 total but only 62 usable. Assigning a device the .63 broadcast, or expecting 64 hosts instead of 62, are classic off-by-one failures. A wrong subnet mask confuses hosts about which addresses are local versus remote. Its classic fingerprint: the host reaches its own segment and distant remote networks, but not nearby networks that share the same address class.
Symptom fingerprints
| Symptom | Most likely cause |
|---|
| Reaches own segment + distant networks, but not nearby same-class networks | Wrong subnet mask |
| Reaches own segment, but not remote networks | Wrong default gateway |
| Reaches remote networks, but not some/all local hosts | Wrong IP (host on wrong subnet) |
| Two subnets both claim the same addresses | Overlapping subnets |
Figure 10.3: Symptom-fingerprint decision tree
flowchart TD
START["Host cannot communicate"] --> Q1{"Do two subnets claim the same addresses?"}
Q1 -->|"Yes"| OVERLAP["Overlapping subnets"]
Q1 -->|"No"| Q2{"Can it reach remote networks?"}
Q2 -->|"No, only own segment"| GW["Wrong default gateway"]
Q2 -->|"Yes"| Q3{"Can it reach all local hosts?"}
Q3 -->|"No, missing some local hosts"| IP["Wrong IP (host on wrong subnet)"]
Q3 -->|"Reaches own + distant, not nearby same-class"| MASK["Wrong subnet mask"]
Visual animation — coming soon
When a host cannot communicate, work through the steps in order: check the local config (ip addr/ipconfig); ping the gateway; ping a known remote host; run ip route get <target-ip> to see actual routing (a same-LAN target sent to the gateway means a wrong local mask); traceroute to isolate the failing hop; and verify the math with a calculator against each device's config.
Figure 10.4: The repeatable troubleshooting workflow
flowchart TD
S1["1. Check local config (ip addr / ipconfig)"] --> S2["2. Ping the default gateway"]
S2 --> D1{"Gateway responds?"}
D1 -->|"No"| MASKHOST["Suspect wrong mask or host on wrong subnet"]
D1 -->|"Yes"| S3["3. Ping a known remote host"]
S3 --> D2{"Remote reachable?"}
D2 -->|"No"| GWERR["Suspect incorrect default gateway"]
D2 -->|"Yes"| S4["4. ip route get target-ip (check actual routing)"]
S4 --> S5["5. traceroute to isolate the failing hop"]
S5 --> S6["6. Verify math with ipcalc / sipcalc vs. each config"]
If both 192.168.1.0/24 and 192.168.1.128/25 are defined on the same network, which addresses overlap?
192.168.1.0 through 192.168.1.127
192.168.1.128 through 192.168.1.255 — 128 addresses claimed by both
No addresses overlap; the /25 fits neatly inside the /24 without conflict
Only the single address 192.168.1.128 overlaps
Dividing 192.168.123.0 into four /26 subnets, how many usable hosts does each provide, and why?
64 usable, because a /26 has 64 total addresses and all are assignable
62 usable, because each /26 has 64 total minus its network and broadcast address
30 usable, because a /26 borrows 3 host bits like a /27
126 usable, because a /26 spans two /24 blocks
A host can reach its own segment and distant remote networks, but cannot reach nearby networks of the same address class. What is the most likely cause?
Wrong subnet mask
Wrong default gateway
Overlapping subnets
A disconnected network cable
A host can talk to devices on its own segment but cannot reach any remote networks. Which fingerprint does this match?
Wrong subnet mask
Off-by-one host count
Wrong default gateway
Overlapping subnets
In the troubleshooting workflow, what does running ip route get <target-ip> reveal?
The DHCP lease time remaining on the host
How the host would actually route a packet — e.g., sending a same-LAN target to the gateway signals a wrong local mask
Whether the remote host has a firewall enabled
The number of usable hosts in the destination subnet