I'm trying to understand subnet masks. I was given the question below and chose the answer of /30 since it seems that each subnet needs only one host IP. /31 was not a possible answer. However, the answer is /29. Can anyone clarify why that is correct?
"Which of the following would the security engineer set as the subnet mask for the servers below to utilize host addresses on separate broadcast domains?"
Server 1: 192.168.100.6
Server 2: 192.168.100.9
Server 3: 192.169.100.20
Convert everything to binary:
6 = 00000110
9 = 00001001
20 = 00010100
OK, so mask of 29:
29 = 00011101
30 = 00011110
The only difference between those two is which of the two lower-order bits of 6 and 9 you examine.
So I'd agree with you that, without further information, either 29 or 30 is a valid answer.
A /29 mask provides 6 usable addresses and creates the following subnets.
192.169.100.0 - 192.169.100.7
192.169.100.8 - 192.169.100.15
192.169.100.16 - 192.169.100.23
A /30 mask provides 2 usable addresses and creates the following subnets
192.169.100.0 - 192.169.100.3
192.169.100.4 - 192.169.100.7
192.169.100.8 - 192.169.100.11
192.169.100.12 - 192.169.100.15
192.169.100.16 - 192.169.100.19
192.169.100.20 - 192.169.100.23
So /30 isn't an option because the 192.169.100.20/30 is a network address and not usable as server IP address. /29 is the correct answer!
Related
I have read a number of articles and posts about VPCs, CIDR and subnets but I still find the explanations confusing.
Many of the explanation can't help avoiding using domain knowledge or technical terms.
Is there a more basic explanation for someone who gets basic programming, binary, etc. ?
I am wondering in the context of aws VPCs.
How does a CIDR represent an IP address range ?
Start with an IP address:
xx.xx.xx.xx
This actually represents Four 8 bit numbers.
With a dot between each.
As they are 8 bit numbers, they can be from 0 up to 255 (decimal).
They are frequently shown as xx.xx.xx.xx because this is referring to them as four 8 bit numbers, shown in hexadecimal (base 16) format. In 'hex' format 255 (decimal) is written as FF
So the numbers range from 00.00.00.00 to FF.FF.FF.FF - in hex
Or 0.0.0.0 to 255.255.255.255 in decimal
For the purpose of considering how many IP 'addresses' this represents - i.e. how many individual IP addresses - you can do 255 * 255 * 255 * 255 which is 4228250625. Because you have used FOUR 8 bit numbers you multiply them together to produce that number. It is 2*32. You'll notice that the 32 is 8 + 8 + 8 + 8 and that is the four 8 bit numbers in xx.xx.xx.xx
OK, so now to CIDR. Where all the above 8 bit, base 16 and hexadecimal / binary information will be useful...
So a CIDR is a range of IP's.
For example you might want a range of 10.0.0.0 to 10.0.0.255 which is 255 IPs. You can write this using the above format, i.e. 10.0.0.1 to 10.0.0.255 but there is another way to do it and that is by using CIDR - Classless Inter Domain Routing. Lets stick with calling it CIDR. so with CIDR you refer to a range using a format like this:
10.0.0.0/24
and that means the range 10.0.0.0 to 10.0.0.255, i.e. 255 numbers.
So has does that work ? !
ok, first we are given which might be thought of as the starting address of the range - 10.0.0.1, although this is actually a bit misleading because the CIDR number is going to affect it.
So lets go piece by piece.
The "/24" refers to the number of bits on the left that stay fixed.
This is probably the hardest but also most essential piece to understand.
So taking "24". this means (conveniently with 24!) that you consider the first 24 bits, i.e. the 10.0.0 to be fixed (see bitmask). Only the last 8 bits of the xx.xx.xx.xx can change, i.e. you have a range and it is from 10.0.0.0 to 10.0.0.255
Here's one of the most surprising facts initially:
The larger the CIDR number, e.g. /28, /30, etc. the smaller the available range of IP addresses !!!
This is because the /nn CIDR number refers to how many bits are FIXED and the more bits are FIXED the less bits are can be changed to produce a range, and thus the smaller the range. This is why with /32 there is NO range because you are saying all 4 xx.xx.xx.xx numbers (8 + 8 + 8 + 8 = 32) are fixed. Whereas with 10.0.0.1/24 you can have from 10.0.0.0 to 10.0.0.255 because the 24 indicates the first three numbers (again 8 + 8 + 8 bits = first 3 numbers) are fixed) and only the last 8 bits, i.e the 'zz' in xx.aa.bb.zz can change for this range. One more example: 10.0.0.0/16 (so first two 8 bit numbers are fixed) means 10.0.0.0 to 10.0.255.255.
Because this behavior is due to a netmask 10.0.0.0/24, which produces the range 10.0.0.0 to 10.0.0.255 would produce the same result if you supplied 10.0.0.0/24, 10.0.0.73/24 or 10.0.99.17/24
See an online converter at https://ipaddressguide.com/cidr
With aws you are given 10.0.0.0/16 as your VPC which means the "10.0" part will stay fixed. so that means if you want a subnet within that you want something smaller such as 10.0.0.0/24 or 10.0.1.0/24 of which you will be able to have many.
The next thing that may be a bit unexpected is that within a VPC subnets must not overlap. However you can have multiple VPCs using that range. The second piece takes some explanation:
There are three IP ranges set aside as PRIVATE so they are never used 'publicly'. These lets each network use those as 'internal' addresses. They are the, probably familiar
10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255
So when you get a VPC that uses a 10.0.0.0/16 range you are getting ONE private network within "a' network. As if you were 'one' user at home using your single network. You can create another VPC because that uses another network (like having a second router in your house) and on that network 10.0.0.0./16 is available.
You currently have a default limit of 5 VPCs per region. As each VPC is using private subnet ranges, they can actually be the same for different ones as well as different, however if you ever want the VPCs to be able to communicate with each other (using VPC peering) this will be a problem because the subnets can't overlap when you do that (otherwise the router wouldn't know which subnet to pick for a given address that exists in both).
Any other corrections I am happy to incorporate wiki-style. I am not defending my knowledge, just trying to share what I think I know and help others understand this confusing concept!
Here's how you do it in aws:
Nope! You have to avoid within 10.0 - the existing public subet !
Result
The issue below is entirely for revision/practice purposes and not homework. I'm just trying to wrap my head around how I would answer this as it could show up in an exam.
I have a problem where I'm given the base address 172.16.10.0 /22
I need to create an IP address scheme where the network contains equal sized subnets of up to 120 hosts each.
I have some experience with subnetting an address into a particular number of subnets, but I've never had to do it where the subnets must support a particular number of hosts (in this case 120).
From the 172.16.10.0 /22 I can tell it's a class B address, then with 10 host bits 2 to the power of 10 minus 2 makes 1,022 possible hosts.
I'm not sure if this is the right way to start but any help would be great.
Thanks
One way is to remember that each /24 has 256 addresses (minus network and broadcast). A /23 has 2 x /24 and one /22 has 2 x /23.
Each /24 if divided in 2 means 2 x /25 . If one /24 has 256 addresses, the /25 has 128, which is closer to what you need.
So 1 /22 = 2 /23 = 4 /24 = 8 /25 .
So you could use 8 x /25, each with a max of 128 addresses or 126 host addresses.
I have problem Where I have given two IPv4 address and I have to calculate best possible network between them . For example I have 10.240.204.160 and 10.240.220.160 and I have to find all minimum available subnets between.
Please note that these two IP addresses are not CIDR notation.
The solution which I thought .i.e
get the number of host between them (it is 4096 here)
find set bit in 4096 which is 12th bit
Now create a subnet mask of 20 i.e 255.255.240.0
This way I will get subnet masks in between those two IP addresses
Now the question is suppose I got 255.255.240.0 then anding it with start IP it will give network 10.240.192.0/20 which will serve
10.240.192.1 to 10.240.207.255 but I started with 10.240.204.160 to 10.240.220.160 hence It would be breaking wrongly
Feels like I will be doing huge mistake If I go with my version of story.
Anyone here please help me.
I was looking for pre-made code and stumbled on this thread. I ended up writing the following in python. You always have the chance that you will span 2 subnets. You were just missing the last step here to check and expand by one bit on the netmask if necessary.
def calc_inclusive_subnet(ip1, ip2): #accepts 2 IP strings
#make IP Address objects
ip1_obj=ipaddress.IPv4Address(ip1)
ip2_obj=ipaddress.IPv4Address(ip2)
if ip1_obj<=ip2_obj:
min_ip=ip1_obj
max_ip=ip2_obj
else:
min_ip=ip2_obj
max_ip=ip1_obj
distance = int(max_ip)-int(min_ip)
ip_range=0 #increment powers of 2 until you have subnet distance
while 2**ip_range < distance:
ip_range += 1
net = ipaddress.IPv4Network(str(min_ip) + '/' +str(32-ip_range), strict=False)
if max_ip not in net:
# i.e. if the distance implies one size network, but IPs span 2
ip_range+=1
net = ipaddress.IPv4Network(str(min_ip) + '/' +str(32-ip_range), strict=False)
return net
You're using the wrong mask. You should use a /19 instead of /20.
A /20 offers you 16 subnets. Simple math learns us 192+16 = 208 (192 is the result of 0 + 16 = 16, 16 + 16 = 32, 32 + 16 = 48, etc)
A /19 offers you 32 subnets --> 192 + 32 = 224
Keep in mind 224 is the start of the next network. Your /19 network will have subnets starting from 10.240.192.0/24 to 10.240.223.0/24.
10.240.204.160 and 10.240.220.160 belong to the 10.240.192.0/19 network.
This is the range for class B private address range.
172.16.0.0 - 176.31.255.255
prefix notation for this is 172.16.0.0/12
As per prefix notation, 8 bits of left most octet and left most 4 bits in second octet can only be used to derive network ID in the IP address.
So, I can derive network address using x in xxxxxxxx.xxxx0000.00000000.00000000
My question:
Using leftmost 12 bits, How can i derive 172.17.0.0 and 172.18.0.0 network address? In general, How can i derive 172.16-172.31 range using left most 12 bits(mentioned as x)?
I am not clear about what you ask: the notation /12 leads to the net mask
11111111.11110000.00000000.00000000
NNNNNNNN.NNNNHHHH.HHHHHHHH.HHHHHHHH (network part / host part)
which can be combined with 172.16.0.0:
10101100.0001HHHH.HHHHHHHH.HHHHHHHH (H = host part)
This means that every IPv4 address which starts with these 12 bits belongs to this network.
This counts for all IPv4 addresses whose first octet is 172 and second one is between 16 (00010000) and 31 (00011111).
And this range includes 172.17.* and 172.18.* as well.
What we have talked about here is how the network part of the address forms. Inside one network, each host gets assigned an address, making use of the host part.
These addresses can essentially be freely assigned (except that the host part may not be all 0s or all 1s).
How you use/divide up your 172.16/12 is up to you.
You can see 172.16/12 see as one big network where all hosts are in, but you can as wee split it up even further:
maybe into 172.16/13 and 172.24/13
or into 172.16/14, 172.20/14, 172.24/14 and 172.28/14
or into 172.16/15, 172.18/15, 172.20/15, 172.22/15, 172.24/15, 172.26/15, 172.28/15 and 172.30/15
or into 172.16/16, 172.17/16, 172.18/16, ..., 172.29/16, 172.30/16 and 172.31/16
...
You can even mix that: you can as well have e. g. 172.16/13, 172.24/14 and 172.28/14.
Commenting on your comment:
can i say that as per prefix notation /12, the possible networks here are 172.00010000.0.0, 172.00100000.0.0, 172.00110000.0.0, 172.01000000.0.0, 172.01010000.0.0 , 172.01100000.0.0, 172.01110000.0.0 etc...
No. As said, 172.16/12 means 172 is constant and the first bits of 16 are constant.
As mentioned, that means 10101100.0001... is fix and the rest is variable.
This is a very simple question with a very simple answer, I apologize for asking it however as I found the answer isn't readily available and this may help somebody else.
I have a class C address 193.50.0.1 and am using the mask 28 to split it into 16 subnets with 14 hosts.
I understand that my first address would be:
Network 195.50.0.0/28
Netmask 255.255.255.240
Broadcast 195.50.0.15
Host range 195.50.0.1 – 195.50.0.14
But I am confused where the boundaries of the next subnet start, would be simple a matter of incrementing the start and ending positions for the next 15 subnets? for example would the next network be:
Network 195.50.0.16/28
Netmask 255.255.255.240
Broadcast 195.50.0.27
Host range 195.50.0.17 – 195.50.0.26
If not, how do I calculate the next subnet?
Here is the answer:
Network 195.50.0.16/28
Netmask 255.255.255.240
Broadcast 195.50.0.31
Host range 195.50.0.16 – 195.50.0.31
You can get host range by separating IP to NET_ID and HOST_ID
NET ID = (28bits) 11000011.00110010.00000000.0001
HOST ID = (4bits) 0000 ~ 1111
So the host range is :
11000011.00110010.00000000.00010000 195.50.0.16
11000011.00110010.00000000.00011111 195.50.0.31
You can use 'AND' operation to get Broadcast
195.50.0.16 11000011.00110010.00000000.00010000
(HOST_ID are '1') 00000000.00000000.00000000.00001111
-----------------------------------------------------------------------------------
Broadcast 11000011.00110010.00000000.00011111 = 195.50.0.31