Chapter 11 — Subnetting practice: designing a real network

In one sentence

Given a block of addresses and a list of departments, split the block so each gets what it needs without waste — this is called VLSM, and it's a standard interview task.

The problem

Your company has been given 192.168.10.0/24 (256 addresses). You must split it between:

Department	Devices needed
Staff laptops	100
Guest Wi-Fi	50
Servers	12
Printers/IoT	10
Link between two routers	2

You cannot just give each a quarter — the sizes are wildly different. You need Variable Length Subnet Masking (VLSM): different mask sizes for different subnets.

The method

   STEP 1: For each requirement, find the SMALLEST subnet that fits.
           Remember: usable = 2^(host bits) - 2

   STEP 2: Sort them LARGEST FIRST.  (This is the crucial step -- see below.)

   STEP 3: Allocate from the start of your block, in order,
           stepping forward by each subnet's block size.

Step 1 — size each subnet

Need	Smallest fit	Why	Block size
100 staff	/25	/26 gives 62 (too small), /25 gives 126	128
50 guests	/26	/27 gives 30 (too small), /26 gives 62	64
12 servers	/28	/29 gives 6 (too small), /28 gives 14	16
10 printers	/28	same reasoning	16
2 for the link	/30	exactly 2 usable	4

Step 2 & 3 — allocate, largest first

   Start at 192.168.10.0

   1. STAFF      /25   block 128   ->  192.168.10.0   -  192.168.10.127
                                       network .0     broadcast .127
                                       usable  .1  to .126        (126 addresses)

   2. GUESTS     /26   block  64   ->  192.168.10.128 -  192.168.10.191
                                       usable  .129 to .190       (62)

   3. SERVERS    /28   block  16   ->  192.168.10.192 -  192.168.10.207
                                       usable  .193 to .206       (14)

   4. PRINTERS   /28   block  16   ->  192.168.10.208 -  192.168.10.223
                                       usable  .209 to .222       (14)

   5. ROUTER LINK /30  block   4   ->  192.168.10.224 -  192.168.10.227
                                       usable  .225 to .226       (2)

   LEFT OVER: 192.168.10.228 - 192.168.10.255  (28 addresses for growth)

Why "largest first" matters

Watch what happens if you allocate the /30 first:

   1. ROUTER LINK /30  ->  192.168.10.0  -  192.168.10.3

   2. STAFF /25 needs a block of 128, and a /25 must START on a multiple
      of 128.  The next multiple of 128 after .3 is .128.

      -> addresses .4 through .127 (124 addresses) are STRANDED and unusable.

Subnets must start on a boundary that is a multiple of their own block size. That's why big ones go first. Remember this; it's the point of the exercise.

Practice (45 min)

Problem 1. You have 10.20.0.0/24. Allocate for:

Sales: 60 devices
Engineering: 25 devices
Management: 10 devices
Wi-Fi guests: 100 devices
Two point-to-point router links: 2 devices each

Give the network address, mask, usable range, and broadcast for each.

Problem 2. You have 172.16.0.0/22 (1024 addresses). Allocate for:

Floor 1: 200 devices
Floor 2: 200 devices
Floor 3: 100 devices
Servers: 50 devices
Management VLAN: 20 devices

Problem 3 — reverse engineering. Given these three subnets, what is the smallest single block that contains all of them?

   192.168.4.0/24
   192.168.5.0/24
   192.168.6.0/24
   192.168.7.0/24

(Answers to all three: Appendix C.)

Verify with a tool:

python3 - <<'EOF'
import ipaddress
block = ipaddress.ip_network("192.168.10.0/24")
# subnet_of / supernet helpers are handy for checking your work
for pfx in [25, 26, 28, 28, 30]:
    sub = next(block.subnets(new_prefix=pfx))
    print(pfx, sub, list(sub.hosts())[0], list(sub.hosts())[-1], sub.broadcast_address)
    # then manually advance -- this is the exercise
EOF

Build it in Go (30 min) — check your design with code

Use the subnet tool from Chapter 10 to check the design you just did by hand:

$ go run ./subnet overlap 10.0.0.0/25 10.0.0.128/26 10.0.0.192/27 10.0.0.224/30
no overlaps

$ go run ./subnet overlap 10.0.0.0/16 10.0.128.0/20 172.16.0.0/12
OVERLAP  10.0.0.0/16  <->  10.0.128.0/20

$ go run ./subnet alloc 10.0.0.0/16 22 10.0.0.0/24 10.0.4.0/22
allocated 10.0.8.0/22

alloc is "largest first" turned into code: walk the pool in steps of the requested size and return the first block that overlaps nothing already used. Because it only ever proposes aligned blocks (/22s start on multiples of 4 in the third octet), it can't produce an invalid subnet. That is the mistake people make most often by hand.

Exercise: write plan that takes a pool and a list of host counts (subnet plan 10.0.0.0/24 100 50 20 2), sorts them largest first, works out the prefix length each needs (hosts + 2, rounded up to a power of two), and allocates them in order with alloc. You have just automated this chapter. Chapter 61 grows it into an IPAM.

Common confusions

"Can I start a /26 at .100?" No. A /26 (block 64) must start at 0, 64, 128, or 192. Subnets align to their own size.
"I have addresses left over — did I do it wrong?" Leftovers are fine and usually good (room to grow). Stranded addresses in the middle are the mistake.
"Why not give everyone a /24?" In private networks you often can and do — address space is free. VLSM matters when space is limited (public addresses, cloud VPCs with fixed CIDRs, or exams).

Check yourself

Why do you allocate the largest subnet first?
What's the smallest subnet that fits 30 devices? 60? 2?
Can a /28 subnet start at 192.168.1.20? Why not?