Subnetting

Why it exists

The original address plan had three sizes: a /8, a /16 and a /24. An organisation needing three hundred addresses took a /16 and wasted sixty-five thousand, and the address space was exhausted by arithmetic rather than by demand.

Classless routing removed the fixed sizes. A prefix carries its own length, so a block can be any power of two and the boundary can sit anywhere in the thirty-two bits. Everything about modern addressing follows from that one change. RFC 4632 §1IntroductionRFC 4632 · BEST CURRENT PRACTICE · August 2006

The same change made routing tables aggregatable. A provider holding a contiguous block advertises one prefix rather than thousands, which is the only reason the global table is the size it is rather than orders of magnitude larger.

The boundary is a position, not a number

A prefix length says how many leading bits are fixed. Everything else about a subnet follows from that one fact.

How it works

A prefix length is a count of fixed leading bits. Everything else is derived: the mask is that many ones, the block holds two to the power of the remaining bits, the lowest address is the network and the highest is the broadcast. RFC 4632 §3.1Basic Concept and Prefix NotationRFC 4632 · BEST CURRENT PRACTICE · August 2006

Forwarding compares an address against every route and selects the one fixing the most bits. Nothing else participates: metric and administrative distance choose between two routes to the same prefix, and have nothing to say about a longer one. RFC 4632 §5.1Rules for Route AdvertisementRFC 4632 · BEST CURRENT PRACTICE · August 2006

Two lengths are special. A /31 gives a point-to-point link two usable addresses instead of the four a /30 consumed, and a /32 is a single host — a loopback, or a route to one address. RFC 3021 §2Considerations of 31-Bit PrefixesRFC 3021 · PROPOSED STANDARD · December 2000

Try it

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. A host reaches some addresses on its own subnet and sends others to the gateway, which may or may not return them.

   Narrow it down

   1. Compare the host mask against the mask on the router interface.
   2. Identify which destinations work and check whether they fall inside the narrower of the two.
   3. Look for proxy ARP masking the problem.

   Cause

   The masks disagree. Each host decides locally whether a destination is on-link, so a host with a narrower mask sends on-subnet traffic to the gateway and a host with a wider one tries to ARP for addresses that are not there.

   Fix

   Make the mask consistent on every device in the subnet, including the router. It is a per-host decision, so one wrong host produces asymmetric symptoms that look like a network fault.

2. A network nobody at this site owns becomes unreachable from part of the organisation after a summarisation change.

   Narrow it down

   1. Compare the advertised summary against the prefixes actually held.
   2. Check whether the covered-but-absent networks are advertised more specifically elsewhere.
   3. Trace where traffic for them is landing.

   Cause

   The summary covers addresses this site does not hold. While a more specific route exists elsewhere it is harmless; when that route is withdrawn, traffic follows the summary here and is dropped.

   Fix

   Advertise the prefixes separately, or add a discard route for the summary so the black hole is at least explicit and countable.

3. A routing protocol is converged and correct, and traffic to one destination goes somewhere else entirely.

   Narrow it down

   1. Look for a more specific route to that destination, from any source.
   2. Check static routes in particular — they are frequently more specific than what a protocol advertises.
   3. Compare prefix lengths rather than administrative distances.

   Cause

   A longer prefix from a different source. Administrative distance never enters into it: a /32 static route beats a /24 from any protocol, because they are not competing for the same prefix.

   Fix

   Remove the stray specific, or make it deliberate. This is the usual reason a working routing protocol appears to be ignored.

4. A block that should have been large enough runs out partway through an allocation.

   Narrow it down

   1. Check the order the subnets were allocated in.
   2. Look for a small subnet sitting on a boundary a larger one needed.
   3. Add the requirements and compare against the parent block.

   Cause

   Allocating smallest first. A block must start on its own boundary, so a /29 placed early can strand the alignment a /25 required even when the arithmetic says there is room.

   Fix

   Allocate largest first. This is the whole reason variable-length subnetting is taught as a procedure rather than as a sum.

5. Two hosts on the same wire can reach each other in one direction only, and neither can explain why.

   Narrow it down

   1. Compare the prefix length configured on each host, not just the addresses.
   2. Work out which host believes the other is local and which believes it is remote.
   3. Check whether the one that fails is sending to a gateway that has no route back.

   Cause

   The mask is local configuration and travels in no packet. A host with a longer prefix believes its neighbour is off-subnet and sends to the gateway; the other, with a shorter one, replies directly. One direction works and the other depends entirely on whether the gateway will help.

   Fix

   Make the prefix length identical on every host in the subnet. Nothing on the wire will tell you it is not — the comparison has to be made by looking.

Design notes

Allocate contiguous, aligned blocks per site from the beginning. Summarisation is a property of the address plan, not something configured later — a site holding 10.0.0.0/24 and 10.0.3.0/24 cannot summarise them without also claiming two networks it does not have.

Size subnets for the broadcast domain rather than for the host count. A /16 of hosts on one segment is an ARP problem long before it is an address problem, and the practical ceiling is far below what the addressing permits.

Private address space is not a security boundary and not unique. RFC 1918 blocks appear in every acquisition and every partner connection, and 10.0.0.0/8 in particular collides constantly. Allocating from an unusual part of it costs nothing and saves a renumbering. RFC 1918Address Allocation for Private InternetsRFC 1918 · BEST CURRENT PRACTICE · February 1996

Misconceptions

“A 10.x.x.x address is a class A, so it has a /8 mask.”

Classes were removed in 1993. The mask comes from configuration and nothing else — 10.1.2.0/24 is an ordinary prefix, and the first octet says nothing about its length. Classful defaults survive only in a few legacy CLI behaviours. RFC 4632 §1IntroductionRFC 4632 · BEST CURRENT PRACTICE · August 2006

“Usable hosts is always the block size minus two.”

It is for /30 and shorter. A /31 has two usable addresses because a point-to-point link needs no broadcast, and a /32 has one. Both are common on router links and loopbacks, so the exception is not obscure. RFC 3021 §2Considerations of 31-Bit PrefixesRFC 3021 · PROPOSED STANDARD · December 2000

“A route with a better metric or administrative distance wins.”

Only against another route to the same prefix. Longest match runs first and is absolute: a /32 from the worst possible source beats a /24 from the best one, because the two were never compared.

“RFC 1918 addresses cannot be reached from outside.”

They are not routed on the public internet, which is not the same as unreachable. Anything with a path in — a VPN, a partner link, an acquisition — reaches them, and because everyone uses the same blocks the collisions are constant. RFC 1918Address Allocation for Private InternetsRFC 1918 · BEST CURRENT PRACTICE · February 1996

More walkthroughs

Terms

Prefix length

The count of leading bits an address fixes. Everything else about a subnet — its size, its network address, its broadcast — is derived from this one number.

Longest prefix match

The forwarding rule: among all routes containing a destination, the one fixing the most bits is used. Metric and administrative distance only compare routes to the same prefix and never override this.

Summary route

One prefix advertised in place of several. Because a prefix is always a contiguous power-of-two block, a summary absorbs any gap between its components and claims reachability for it.

Check yourself

• A /24 is split into /26s. How many blocks result?

  • 2
  • 4
  • 8
  • 26
• How many usable host addresses does a /26 provide?

  • 64
  • 62
  • 60
  • 32
• How many usable addresses does a /31 provide?

  • 0
  • 1
  • 2
  • 4
• A /8 learned by OSPF and a /24 static route both contain the destination. Static routes have a worse administrative distance here. Which is used?

  • The OSPF /8, because its administrative distance is better
  • The /24, because longest match runs first and distance only compares routes to the same prefix
  • Both, load-shared
  • Neither; the router drops the packet
• What do 10.0.0.0/24 and 10.0.3.0/24 summarise to?

  • 10.0.0.0/23, exactly
  • 10.0.0.0/22, which also covers two networks the site does not hold
  • 10.0.0.0/24, dropping the second
  • They cannot be summarised
• Why does variable-length allocation start with the largest requirement?

  • It is conventional
  • A block must start on its own boundary, so a small block placed early can strand the alignment a larger one needed
  • Large subnets are more important
  • It reduces the number of routes
• Where does a packet carry the subnet mask it was sent under?

  • In the IPv4 header, beside the destination address
  • Nowhere — the mask is local configuration and never travels
  • In an IP option
  • In the Ethernet header
• Host A has /24 and host B has /25 on the same wire. A can reach B and B cannot reach A. Why?

  • B’s address is outside A’s subnet
  • B believes A is remote and sends to the gateway, while A believes B is local and replies directly
  • The broadcast addresses differ
  • B needs a longer prefix to reach a shorter one

Related

• ARP

  Finds the MAC address behind an IPv4 address on the local segment, by asking everyone and trusting whoever answers.

• OSPFv2

  Each router floods a description of its links, then independently computes the same shortest-path tree — so the forwarding tables agree without exchanging routes.

• BGP

  A TCP session that exchanges path attributes, then picks one path with a total-order waterfall — not a shortest-path flood.