Understanding network infrastructure · Part 1 · How does my PC get ready to communicate?

How do your IP address needs determine subnet size?

Turn address requirements into a prefix and block boundaries, then check overlap and summarization

Choosing an arbitrary prefix based only on the address count can leave too few addresses or waste a large range. The prefix length determines the address block size; its boundaries define the network address, broadcast address, and usable host range. We work through real address values, from a /26 calculation and VLSM layout to /31 and /32 uses and route summaries.

Count only today's needs, and your subnet can soon run out of addresses↑

Count only the endpoints you have now and the subnet may soon be too small. Include the gateway, network equipment, reserved addresses, and near-term expansion. Addresses excluded from the DHCP pool still occupy space in the same block.

For 50 endpoints, a /27 with 32 addresses is too small. A /26 has 64 addresses. On a conventional multi-access subnet, the network and broadcast addresses are excluded from the range assigned to hosts.

Address demand is greater than the number of endpoints powered on today. An office of 50 people may have personal endpoints, IP phones, printers, APs, a gateway, and replacement-device addresses in the same subnet. Allow for DHCP leases that are not reclaimed immediately and for future staffing growth. On the other hand, giving every department a /22 based on vague growth expectations needlessly enlarges the broadcast domain and the range of addresses to track.

In the design document, list current use, expected growth over 1–3 years, infrastructure and reserved addresses, the dynamic allocation range, and space held for expansion separately. Find the smallest address block that fits them all, then consider operating policy and failure scope. Saving addresses is not the only goal: leave room to grow without making one Layer 2 domain unnecessarily large.

A small address block that barely fits demand saves unused addresses but leaves little room to grow. Too large a block can expand broadcast and failure impact. Add growth capacity to the required count, then choose the block size with failure scope, security policy, and route summarization in mind.

Sources for this section IETF RFC 4632

When the prefix grows by one bit, how much smaller is the address block?↑

IPv4 has 32 bits, so a prefix of /p contains 2^(32-p) addresses. For /26, the host portion has 6 bits, giving 2^6 = 64 addresses.

Each extra prefix bit halves the address block. Split the 256 addresses of a /24 into two /25s and each has 128; split again into /26s and each has 64. This relationship lets you calculate neighboring prefix sizes without memorizing a table. A /23, for example, has 9 host bits and 2^9 = 512 addresses, with boundaries every 2 values of the third octet.

On a conventional broadcast LAN, subtract the network address and directed broadcast address from the total to get the host count. Standards-defined exceptions such as /31 point-to-point links mean that one formula cannot cover every link. To calculate DHCP availability for general dynamic allocation, start with the configured lease range and exclude addresses set aside for the gateway, static assignments, reservations, and other exclusions, counting overlapping exclusions only once. Record the prefix's total address count, capacity for general dynamic leases, and capacity reserved for specific clients separately.

Each extra prefix bit halves the block. After finding a prefix that meets your required count, check that the starting address is aligned to a multiple of that block size. Capacity alone does not make it a valid network boundary.

Sources for this section IETF RFC 4632

192.0.2.64/26
Network 192.0.2.64
Host range 192.0.2.65 – 192.0.2.126
Broadcast 192.0.2.127
Next block 192.0.2.128/26

Different subnet sizes: why allocate the largest first?↑

VLSM uses different prefix lengths within one parent block. For departments of 100, 50, and 20 people, allocate the largest block, /25, first. Place the /26 and /27 blocks at the next appropriate boundaries.

Scattering small blocks across the available space first can leave no contiguous space for a larger block. Addresses may still be free, but fragmentation prevents you from allocating a contiguous prefix that can be summarized.

To fit 100, 50, and 20 devices into 10.50.0.0/24, first allocate 10.50.0.0/25 for 100 devices. Then place 10.50.0.128/26 for 50 and 10.50.0.192/27 for 20. This leaves 10.50.0.224/27 as a contiguous reserve. Placing a small /27 at an intermediate boundary first could have used up the aligned space needed for the /25.

Allocating the largest blocks first is only part of a good design. Where geographic, security zone, or route summary boundaries differ, fitting subnets into whatever space is free may work numerically but blur operational boundaries. A VLSM allocation table should record the purpose, VLAN, gateway, DHCP range, parent summary, and room for growth. The goal is not simply to minimize unused addresses, but to preserve contiguous space and clear ownership through future changes.

For example, if a site receives 10.20.0.0/22, allocate each floor's or function's subnets contiguously within it so upstream devices can summarize them as 10.20.0.0/22. Preserving ownership boundaries and route aggregation makes changes and fault isolation easier than packing today's allocations as tightly as possible. Check that the remaining space also aligns with the block sizes future expansion will require.

Sources for this section IETF RFC 4632

Where do two-address /31s and single-address /32s fit?↑

A /31 has only two addresses, but RFC 3021 allows both to be used on a point-to-point link, one for each end's interface. This rule does not apply unchanged to a conventional user broadcast LAN.

A /32 identifies exactly one host in a prefix. It is commonly used for loopback addresses, static host routes, and security policies. Do not infer from the prefix length alone that there are no usable hosts. Check the link type and intended use.

On a /31 point-to-point connection, each of the two addresses belongs to one end of the link; neither is reserved separately as a network or broadcast address. Verify that both devices support RFC 3021 and that the link really has only two endpoints. Older equipment or management tools may misinterpret /31, so test interoperability before deployment. Do not apply it merely to save addresses on a multi-host, broadcast-dependent Ethernet segment.

A /32 often describes not an address range but a single-host route. Advertising a router loopback as /32 lets an alternate path retain access to the same router ID and management address when one physical interface goes down, keeping the router reachable. A firewall may also use /32 to match one host, and a blackhole route may target it. Treating /31 and /32 as unusable because they lack enough host bits misses their purpose: standards define specific link and route uses for them.

A /32 identifies one address for a loopback, host route, policy object, or similar use. Even with an interface configured with /32, L2 connectivity alone does not guarantee IP communication with a neighbor. Reachability must also be designed—for example, through a peer route, an unnumbered arrangement, or separate neighbor handling. Verify support at both ends and check the actual FIB to confirm the intended behavior.

Sources for this section IETF RFC 3021

Glossary↑