Subnet masking

[Meresgi]

OK i'll try my hand at #1:

Let's say the current network is 192.168.16.0 with a /24 mask.

Riddle #1: split the given IP range into at least 5 new ranges, and give me network IP, SNM and broadcast IP for each of them.

IP:192.168.16.32 BROADCAST: 192.168.16.63
IP:192.168.16.64 BROADCAST: 192.168.16.95
IP:192.168.16.96 BROADCAST: 192.168.16.127
IP:192.168.16.128 BROADCAST: 192.168.16.159
IP:192.168.16.160 BROADCAST: 192.168.16.191

and the subnet masks = 255.255.255.224

I was unsure of these just from the chart, but it clicked when I read this. Hopefully I got them right

Spoiler: show

The technique that I just showed you works great if you want to evenly split a class A or a class B address block. Sometimes though, you may need to split a class C address block, or may need to divide a Class A or a Class B address in a way that would give you more or less addresses than you would get if you used the above technique.

In the above example, the numbers in the subnet mask were either 255 or they were zero. These numbers are actually derived from eight bit binary values. In binary math, 00000000=0, and 11111111=255. When we changed one of the numbers in the subnet mask from 0 to 255, we were borrowing eight bits from the address space. The trick to creating other types of subnets is to understand that you do not have to work in eight bit increments.

Suppose for example that you owned the class C address block 192.168.42.x, and you needed to split it into five subnets with 25 addresses each. Since this is a class C address, the host identifier portion of the IP address takes up 8 bits. If you want to subnet this address block, you will have to borrow some of the bits that are used for the host identifier and use them for the network identifier.

To determine how many bits you will have to use for a subnet, use the formula 2X-2, where X is the number of bits that you are using. For example, if you were to use 3 bits, then you could create six subnets (23-2=6). If you use three bits for the subnet, then that leaves you with five bits for the host identifier. If you apply the 2X-2 formula to the number of bits left for the host identifier, you will find that each subnet can contain up to 30 hosts (25-2=30).

As you will recall earlier when we subnetted the class B address, we had to increment the last portion of the network identifier for each subnet. We have to do the same thing here, but doing so is a little more difficult. As you will recall, the first three numbers in each IP address are 192.168.40. These numbers will remain constant. It’s only the last number that we have to worry about. We have split the last number into three bits for the network identifier, and five bits for the host identifier. We must now set the network identifier portion to 1. In binary form, it looks like this:

001 00000

The 1 will be incremented for each individual subnet. There are six subnets in all, and they will look like this:

001 00000
010 00000
011 00000
100 00000
101 00000
110 00000
111 00000

Now, you must determine the IP addresses that will fall into each subnet. The trick is to understand that the last five bits are used for the host identifier. They range from 00000 to 11111. To determine the IP addresses in each subnet, combine the network identifier with the host identifier and then convert it to decimal notation. For example, for the 001 subnet, the bit range is 001 00000 to 001 11111. When you concatenate these numbers they appear as 00100000 and 00111111. Convert these numbers to decimal and they become 33 and 62. This means that the IP address range for the first subnet is 192.168.40.33 to 192.168.40.62. You can repeat the process for the other subnets to calculate the IP address ranges for them.

The last step in the process is to compute the subnet mask. The old 255.255.255.0 isn’t going to work anymore because we borrowed three bits from the host identifier. The easiest way to come up with the subnet mask is to express the last number in binary notation, where the three bits that we have borrowed are expressed as ones and the bits that are being used for the host identifier are expressed as zero. This looks like: 11100000. Convert this value to decimal notation and the value is 224. As you will recall, the original subnet mask was 255.255.255.0. To create the new subnet mask, we simply replace the 0 with the new value (224). Our subnet mask becomes 255.255.255.224.

On the link, I think I finally understand the chart. as the numbers get lower the less and less ranges there are, but the more subnets are available?

[Bockage]

that's why i said he should try #1 first but thanks, didn't know this had its own name ^^;
i have to admit, only had subnetting for ~1 week in vocational school, so i'm not very deep into it. just happen to be good at understanding binary stuff xD

VLSM = Variable Length Subnet Mask.

I hate you for picking it up so fast . I suck w/ numbers. It took me a good 6 months to get subnetting and even now I can only do it in decimal. I get lost so fast when subnetting in binary lol.

[Niya]

Congrats Meres, you got it~ ^^ Had to calculate it myself to check if it's correct xD
For at least 5 new subnets you need to change 3 bits, since 2^3 = 8, 2 bits would only be 4

Taking it in binary:

192.168.16.0/24

11111111.11111111.11111111.00000000 Base SNM change to 1 to create space for subnets
11000000.10101000.0001000000.00000000 Base network IP part you change for creating the different subnets

Last byte of the new subnets:
00000000 - 00011111 -> 0 - 31
00100000 - 00111111 -> 32 - 63
01000000 - 01011111 -> 64 - 95
01100000 - 01111111 -> 96 - 127
10000000 - 10011111 -> 128 - 159
and so on ^^

@Bockage: hehe ^^ As long as the outcome is the same it shouldn't matter whether you do it in binary or decimal. I for myself think it's easier in binary since you only have to swap bit combinations around and there's pretty much no calculation involved. Just turning binary back to decimal in the end ^^

[Meresgi]

Ok so how would I segment it up for different sets of computers? Just create a different subnet mask for each set of computers and give them ranges?


Also thanks for the teaching, its clicking pretty easily now!

[Niya]

It's pretty similar to #1, just that you have the number of needed IPs per subnet instead of the desired number of subnets ^^ And forget about the "split subnet further down" hint for now, like Bockage pointed out that's already "advanced stuff" xD
This time, do the SNM change like before, but you'll have to calculate the needed bit shift by the host bits, not by the network bits ^^ So just split into subnets that have space for up to 45 PCs per subnet.

And np, every once in a while i really enjoy helping and teaching others. Plus, i can "refresh" my own knowledge as well xD

[Meresgi]

Riddle #2: you want to separate several groups of computers from each other. one group has 4 computers, one group has 15 computers, and the third group has 45 computers. create subnets inside the given network range that have enough space for all groups, and give me network IP, SNM and broadcast for each of them.

So for 4 computers, I would want 255.255.255.224
for 15 id go with 255.255.255.248
and for 45 it would be 255.255.255.252

4 computers would be

IP:192.168.16.32 BROADCAST: 192.168.16.63
IP:192.168.16.64 BROADCAST: 192.168.16.95
IP:192.168.16.96 BROADCAST: 192.168.16.127
IP:192.168.16.128 BROADCAST: 192.168.16.159

( I just used the ones from the other problem since that was for 5, this was for 4)

Next 15 would be with a subnet of 255.255.255.248

The ranges:

IP 192.168.16.8 - Broadcast 192.168.16.12
IP 192.168.16.13 - Broadcast 192.168.16.20
IP 192.168.16.21 - Broadcast 192.168.16.28
IP 192.168.16.29 - Broadcast 192.168.16.36
IP 192.168.16.37 - Broadcast 192.168.16.44
IP 192.168.16.45 - 192.168.16.52
IP 192.168.16.53 - 192.168.16,60
IP 192.168.16.61 - 192.168.16.68
IP 192.168.16.69 - 192.168.16.76
IP 192.168.16.77 - 192.168.16.84
IP 192.168.16.85 - 192.168.16.92
IP 192.168.16.93 - 192.168.16.100
IP 192.168.16.101 - 192.168.16.108
IP 192.168.16.109 - 192.168.16.116
IP 192.168.16.117 - 192.168.16.124

I'll stop there for now, i want to make sure those are correct and i'm doing it the right way.

[Niya]

So for 4 computers, I would want 255.255.255.224
for 15 id go with 255.255.255.248
and for 45 it would be 255.255.255.252

Um... no. You're making the subnets smaller for bigger IP pools? xD

Just take the last byte of your SNMs:
224 -> 11100000 -> 5 client bits -> 2^5 -2 = 30 IPs
248 -> 11111000 -> 3 client bits -> 6 IPs
252 -> 11111100 -> 2 client bits -> 2 IPs

See? ^^

[Meresgi]

Um... no. You're making the subnets smaller for bigger IP pools? xD

Just take the last byte of your SNMs:
224 -> 11100000 -> 5 client bits -> 2^5 -2 = 30 IPs
248 -> 11111000 -> 3 client bits -> 6 IPs
252 -> 11111100 -> 2 client bits -> 2 IPs

See? ^^

Oops, was going the wrong way haha.

4 computers would be 255.255.255.248
15 would be 255.255.255.224
and 45 would be 255.255.255.192

[Niya]

yup, correct ^^

[Meresgi]

A question for you Niya. Got out of class today and I was wondering, if you're setting up a network with 3 sections of computers, each with a different subnet. Do you need a router on each section? Can a cisco switch work in place of a router?

My project has their office network having hubs in place, and one of the things I want to do is take the hubs out and put cisco switches in, but I wasnt sure if i'll need a router for each section as well.

[Niya]

Hm... One router would be enough, just hook every subnet or their corresponding switch(es) to one of the router ports. Another way should be that you use layer 3 switches. Those are basically switches that also know routing, so kind of a hybrid between a switch and a router, just without WAN port, firewall etc. Or you use VLANs instead of subnets, but your switches will have to support that ^^

So it all depends on the switches and what functions they have ^^ Manageable cisco switches should at least support VLAN, and some of them also have L3 support.
And LOL at hubs... That example network is getting even more ancient than i thought xD

[Bockage]

Or you use VLANs instead of subnets, but your switches will have to support that ^^

Sadly, switches alone would not work in this scenario because they can't pass data between VLANS on their own, you'd need a router or an L3 switch for that to work. Setting up a router and switch to support inter VLAN routing gets a bit more advance since you have to know how to configure it both on the switch and the routers. Just stick with a router, it'll be much easier that way. Plug in the cables, add the interface ip addresses, in and you're done; and because they're all directly connected networks you don't even have to worry about setting up a routing protocol.

[Meresgi]

Oh another question I wanted to expand on, when I linked some of the project specs you guys commented on the server which was running Win2000 and DNS/WINS as being shit. Why is that? It's something else i'll have to learn soon, I have no real knowledge of servers (lol again, this class had NO PRQs XD)

for reference:

Spoiler: show

Current CRI Supplied Design Details:
•All CRI workstations, server, and networked equipment have a static public IP
addresses in the range of 164.214.2.0/24.
•The File Server is a Windows 2000 Server running DNS and WINS
•WIFI APs have WEP deployed
•CRI’s Windows 2000 Server services have recently started running much too
slowly
•The router is a commercial standard
•No networking equipment has physical protection
•Public must have access to Kiosks in lobby
•Realtor laptops need remote access to CRI data
The CEO of CRI would like to host the company’s web site and email server on site. He
also just bought a new laptop with a wireless network card so he would like to get that
working in his office and at home.
CRI’s CTO has stated that he is against hosting the web site and email server locally, but
what can he do. Since the CEO wants them hosted locally, he asks you to protect them as
much as possible, but explains they still need to meet the company’s needs.
The CTO also explains to you that there is a problem with employees surfing their days
away and downloading all types of viruses and worms. He would like you to write an
acceptable use policy for all CRI employees, and minimize or stop the virus infections
and unnecessary personal surfing.
The last concern for the CTO centers on some recent calls he’s received from two ISP’s
and local business. All three are threatening legal action. He’s been told that someone
inside CRI has been defacing websites. He’s not sure what to make of it, but doesn’t
think any of the realtors are smart enough to actually do what is being claimed. If a CRI
employee is behind this action, he would like to catch them in the act. If a CRI employee
is not behind the problem, he would like to determine who is. At a minimum, he wants to
avoid any legal action for CRI, and wants to solve this issue ASAP.
Current Design Details Your Team Has Uncovered Through Research:
•There is no sub-netting of the company’s address space
•The File Server’s file system is FAT32.
•A significant WIFI signal bleed-trough is found on floors above and below the
floor CRI occupies
•The Windows 2000 Server is found to have a root kit installed, making it a
member of a distributed Internet Bot Net
•Network equipment has no physical protection, or power/temperature
conditioning
•No UPS system is used in the design
•The File Server is set up as a Workgroup

[arshesney]

Windows 2000 is really obsolete, since it would only work as file server I'd backup the data, scrap the win2000 server and setup a Linux box with samba (for file sharing and wins resolution) and dnsmasq (as simple dns forwarder). It will also be able to host the website, email and act as PPTP server to allow laptops to connect via VPN to the main office. As a nice addiction you could finally setup a proxy with blacklisting for certain sites/categories. You can further secure it by giving each user credentials for proxy access, to identify who surfs where. I do not know if that is possible in the US, here in Italy it is doable and not a privacy violation, provided that every employee signs a note which states that for "security reasons" the internet traffic is being monitored.
Of course you could do everything with a Windows server, there are some nice freeware mail servers for hosting single domains (if on a budget), not sure about proxies.

[Niya]

The parts that probably bugged me and others about the example are:
- win2000: ~12 years old, no more support from Microsoft, so no security patches. Ancient and should be replaced ASAP
- FAT32 partitions: FAT32 was used by Windows before NTFS, and unless it's really needed (like on external drives that you want to run on any computer, no matter what OS runs on it) you should avoid it. NTFS is better in so many ways...
- WEP WLAN encryption: WEP has been known for several years now to be insecure, the encryption can be hacked within seconds!
- rootkit on the file server: do i really have to explain why?
- file server not member of domain: security issue and also a hassle since you'd have to create every domain user a second time as a local user on the file server...
- did i read that right? EVERY network-attached device has a PUBLIC IP? Oo Those guys must be crazy... <.<

Or in short: if your example network were real, it would be the worst case scenario for any company, and i'd really wonder how the hay they survived that long without data loss (due to hardware failure or someone breaking into the network)

[Meresgi]

One of the things I Thought about doing for the project was just advising the CEO to host the website offsite. I can't really think of a reason to host it onsite for them, especially since they don't have an employee to maintain the website and update it, etc etc. Not to mention they are a real estate firm so their website isn't going to be that super complex at all. I'll have to look into the Linux server and adding VPN for the laptops.

Thanks guys, a lot of help. Learning a lot just from this thread.