Networking Lab: IPv4 and IPv6 Subnetting and Topology Design

Learning Objectives

By the end of this lab, you will be able to:

  • Convert between dotted-decimal, binary and CIDR notation, and find the network address, broadcast address and usable hosts of any IPv4 subnet.
  • Build a VLSM (variable length subnet mask) plan for a small business with departments and a branch.
  • Explain private addressing (RFC 1918) and NAT, and why a business still needs both today.
  • Read, shorten and expand IPv6 addresses using the RFC 5952 rules, and plan IPv6 subnets with /48, /56 and /64 prefixes.
  • Compare SLAAC and DHCPv6, and explain dual stack.
  • Design a hierarchical office topology with VLANs, Wi-Fi, a firewall and a branch link.
  • Verify every answer with Python’s built-in ipaddress module.

Before You Start

This lab builds on 4.6 Network Topologies and 4.7 Introduction to IP Addressing, which explain what IPv4, IPv6, public and private addresses are. Here you will design an address plan and check it with code. Static vs dynamic addressing is covered in 4.9 and firewalls and VPNs in 4.10.

Software (free): Python 3 with its standard-library ipaddress module; nothing to install. Outputs in this note were produced with Python 3.11.

The business, departments and host counts below are hypothetical teaching data. IPv6 examples use 2001:db8::/32, the prefix reserved for documentation (RFC 3849), so they never clash with real networks.

Part A: IPv4 Subnetting Foundations

A.1 Binary and CIDR

An IPv4 address is 32 bits, written as four 8-bit octets in decimal. A subnet mask marks which bits belong to the network (1s) and which to the host (0s). CIDR notation writes the mask as the number of network bits: /26 means 26 ones followed by 6 zeros.

192.168.10.77   = 11000000.10101000.00001010.01001101
255.255.255.192 = 11111111.11111111.11111111.11000000   (/26)

Each octet’s value comes from the place values 128, 64, 32, 16, 8, 4, 2, 1. For example 77 = 64 + 8 + 4 + 1 = 01001101.

CIDR Subnet mask Host bits Total addresses Usable hosts
/24 255.255.255.0 8 256 254
/25 255.255.255.128 7 128 126
/26 255.255.255.192 6 64 62
/27 255.255.255.224 5 32 30
/28 255.255.255.240 4 16 14
/29 255.255.255.248 3 8 6
/30 255.255.255.252 2 4 2

A.2 Network, Broadcast and Usable Hosts

For a prefix length p:

total addresses = 2^(32 − p)
usable hosts    = 2^(32 − p) − 2      (network and broadcast addresses are reserved)
network address = address AND mask    (all host bits 0)
broadcast       = network with all host bits set to 1
usable range    = network + 1  …  broadcast − 1

Worked example: 192.168.10.77/26. Only the last octet is split: 77 = 01|001101. The first two bits (01) are network bits, worth 64.

  • Network: keep 01, set host bits to 0 → 01000000 = 192.168.10.64
  • Broadcast: set host bits to 1 → 01111111 = 192.168.10.127
  • Usable: 192.168.10.65 – 192.168.10.126, which is 2⁶ − 2 = 62 hosts

Shortcut: the block size is 256 − last mask octet = 256 − 192 = 64, so /26 subnets start at .0, .64, .128 and .192. The address .77 falls in the block starting at .64.

Two special cases: a /31 can be used on point-to-point links with both addresses usable (RFC 3021), and a /32 identifies a single host.

A.3 Private Addresses and NAT

RFC 1918 reserves three ranges for private networks. They are never routed on the public internet, so every office can reuse them.

Range CIDR Typical use
10.0.0.0 – 10.255.255.255 10.0.0.0/8 Large organisations, banks
172.16.0.0 – 172.31.255.255 172.16.0.0/12 Medium networks, cloud VPCs
192.168.0.0 – 192.168.255.255 192.168.0.0/16 Homes and small offices

Two other ranges you will meet: 100.64.0.0/10 is shared address space for carrier-grade NAT inside an ISP’s network (RFC 6598), and 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are reserved for documentation (RFC 5737).

Network Address Translation (NAT) lets many private addresses share one public address. The office router rewrites each outgoing packet’s private source address and port to its public address and a unique port, and remembers the mapping so replies return to the right device (often called PAT or NAPT). Business consequences:

  • One public IPv4 address from the ISP can serve the whole office, which matters because IPv4 addresses are scarce.
  • Outsiders cannot start connections to inside devices unless you configure port forwarding; this is a side effect, not a security control, so you still need a firewall.
  • If the ISP itself uses carrier-grade NAT (your router’s “public” address is in 100.64.0.0/10), port forwarding will not work. Hosting a server or remote CCTV access then needs a static public IP from the ISP, a VPN or a cloud service.

Part B: VLSM Plan for a Kathmandu Office

B.1 The Scenario

Sagarmatha Trading (hypothetical) has a head office in Kathmandu and a small branch in Pokhara. The IT consultant reserved 192.168.10.0/24 for the company and must fit every segment inside it.

Segment Hosts needed (with growth)
VLAN 10 Staff (wired + Wi-Fi) 60
VLAN 40 Guest Wi-Fi 50
VLAN 20 Accounts 25
Branch LAN (Pokhara) 20
VLAN 30 Admin/HR 12
VLAN 50 Servers/printers/CCTV 10
WAN link HQ–branch (VPN tunnel) 2

Giving every segment a /26 would need 7 × 64 = 448 addresses, more than the /24’s 256. VLSM gives each segment a subnet sized to its need.

B.2 The Method

  1. Sort the segments from largest to smallest.
  2. For each, choose the smallest prefix with enough usable hosts: 2^h − 2 ≥ hosts.
  3. Allocate from the start of the block, one after another. Because the sizes shrink, each subnet automatically starts on a valid boundary.
  4. Record the network, mask, gateway (by convention the first usable address) and range, and keep the leftovers for growth.

B.3 The Result

Segment Need Subnet Mask Usable range Max hosts
VLAN 10 Staff (wired + Wi-Fi) 60 192.168.10.0/26 255.255.255.192 192.168.10.1 – 192.168.10.62 62
VLAN 40 Guest Wi-Fi 50 192.168.10.64/26 255.255.255.192 192.168.10.65 – 192.168.10.126 62
VLAN 20 Accounts 25 192.168.10.128/27 255.255.255.224 192.168.10.129 – 192.168.10.158 30
Branch LAN (Pokhara) 20 192.168.10.160/27 255.255.255.224 192.168.10.161 – 192.168.10.190 30
VLAN 30 Admin/HR 12 192.168.10.192/28 255.255.255.240 192.168.10.193 – 192.168.10.206 14
VLAN 50 Servers/printers/CCTV 10 192.168.10.208/28 255.255.255.240 192.168.10.209 – 192.168.10.222 14
WAN link HQ–branch 2 192.168.10.224/30 255.255.255.252 192.168.10.225 – 192.168.10.226 2

228 of 256 addresses are allocated, with 192.168.10.228/30, 192.168.10.232/29 and 192.168.10.240/28 free for future segments (for example IP phones or IoT sensors). No subnets overlap; Part E proves it with code.

Design note: a real company would usually give the branch its own larger range (for example 192.168.20.0/24) so it can grow independently. Fitting everything in one /24 is a classic exam and interview exercise because it forces careful VLSM.

Part C: IPv6 Addressing and Subnetting

C.1 Format and Abbreviation (RFC 5952)

An IPv6 address is 128 bits, written as eight groups (hextets) of four hexadecimal digits separated by colons. RFC 5952 defines one canonical short form:

  1. Leading zeros in each group must be removed (0db8 → db8; 0000 → 0).
  2. :: replaces the longest run of consecutive all-zero groups, and may appear only once.
  3. :: must not be used for a single zero group (2001:db8:0:1:1:1:1:1 stays as it is).
  4. If two zero runs are equally long, shorten the first one.
  5. Hex letters are written in lowercase.
Full form RFC 5952 short form Rule shown
2001:0db8:0000:0000:0001:0000:0000:0001 2001:db8::1:0:0:1 Equal runs: the first is shortened
2001:0DB8:0000:0001:0000:0000:0000:0001 2001:db8:0:1::1 Longest run; lowercase
2001:0db8:0000:0000:0001:0000:0000:0000 2001:db8:0:0:1:: The longer (trailing) run wins
2001:0db8:0000:0001:0001:0001:0001:0001 2001:db8:0:1:1:1:1:1 No :: for a single zero group

To expand an address, count the groups you can see and fill :: with enough 0000 groups to make eight.

C.2 Address Types You Should Recognise

Prefix Type Note
2000::/3 Global unicast Public, routable addresses from your ISP
fe80::/10 Link-local Every IPv6 interface has one; never routed
fc00::/7 Unique local (ULA, RFC 4193) Private-style addresses; fd00::/8 in practice
2001:db8::/32 Documentation (RFC 3849) Use in examples only
::1/128 Loopback Same role as 127.0.0.1

C.3 Prefix Sizes: /48, /56 and /64

  • /64 per subnet (LAN or VLAN). RFC 4291 specifies 64-bit interface identifiers for unicast addresses (except those starting with binary 000), so a normal LAN uses a /64. SLAAC (C.4) depends on this. A /64 holds 2⁶⁴ = 18,446,744,073,709,551,616 addresses, so you never size an IPv6 subnet by host count.
  • /48 or /56 per site. RFC 3177 once recommended a /48 for every end site; RFC 6177 (2011) replaced that, saying a single default of /48 is “no longer recommended” and leaving the size to operators, while still advising more than a single /64. RIPE-690, a widely used operator best practice, recommends a /48 for business customers and strongly discourages anything longer than /56. A /48 contains 2¹⁶ = 65,536 /64 subnets; a /56 contains 256.
  • In Nepal, ISPs receive address space from APNIC, and the prefix your office gets depends on the ISP’s product. Ask for a static (persistent) prefix, ideally a /48 or at least a /56, so you do not have to renumber.

IPv6 plan for Sagarmatha Trading (assuming the ISP delegates 2001:db8:abcd::/48):

Segment IPv6 subnet How it was chosen
VLAN 10 Staff 2001:db8:abcd:10::/64 Fourth group written to match the VLAN number (hex 10)
VLAN 20 Accounts 2001:db8:abcd:20::/64 Same pattern
VLAN 30 Admin/HR 2001:db8:abcd:30::/64 Same pattern
VLAN 40 Guest 2001:db8:abcd:40::/64 Same pattern
VLAN 50 Servers 2001:db8:abcd:50::/64 Same pattern
Pokhara branch 2001:db8:abcd:100::/56 256 /64s reserved for the branch’s own VLANs

There is no VLSM squeeze in IPv6: every VLAN gets a /64 regardless of size, and the plan is chosen for readability, so a technician can tell the VLAN from the address.

C.4 SLAAC vs DHCPv6

Feature SLAAC (RFC 4862) DHCPv6 (RFC 8415)
How it works Router advertises the /64 prefix; each device builds its own address A DHCPv6 server leases addresses and options, as DHCP does in IPv4
Server needed No (router only) Yes
DNS servers Sent in router advertisements (RDNSS option, RFC 8106) or stateless DHCPv6 Sent as DHCPv6 options
Central record No lease list of who has which address Lease records help audits and troubleshooting
Prefix length Requires a /64 Works with other lengths, but /64 is still the norm

Router advertisements carry flags that tell hosts which method to use (the M “managed” and O “other configuration” flags, RFC 4861). Many networks use SLAAC for addresses plus DNS from RDNSS or stateless DHCPv6; some client operating systems do not support stateful DHCPv6 address assignment, so check your devices before relying on it.

C.5 Dual Stack

Dual stack means every interface runs IPv4 and IPv6 at the same time. Applications prefer IPv6 where both ends support it and fall back to IPv4 otherwise. It is the simplest transition approach for an office: keep the IPv4 plan from Part B (with NAT) and add the IPv6 plan from C.3 (no NAT; every device has a global address). Because IPv6 devices are directly addressable, the firewall must block unsolicited inbound IPv6 traffic just as NAT effectively did for IPv4.

Part D: Topology Design for the Office

D.1 Design Choices

Need Design decision
Easy to manage and expand Hierarchical star (tree): firewall → core switch → access switches → devices
Separate departments and guests VLANs (IEEE 802.1Q) per segment from Part B; trunk links carry several VLANs between switches
Control traffic between departments Inter-VLAN routing on the firewall or a Layer 3 core switch, with rules (e.g. only Accounts reaches the accounting server)
Wi-Fi for staff and visitors Access points with two SSIDs: staff SSID → VLAN 10 (WPA3 or WPA2-Enterprise), guest SSID → VLAN 40 with internet-only access and client isolation
Reliable internet Two ISPs (fibre plus a backup link) on the firewall, with failover
Connect the Pokhara branch Site-to-site IPsec VPN over the internet (WAN link 192.168.10.224/30 inside the tunnel)
Power cuts UPS for firewall, core switch and PoE switches; PoE powers access points and IP cameras

D.2 Logical Diagram

flowchart TB
    ISP1[ISP 1 fibre] --> FW
    ISP2[ISP 2 backup] --> FW
    FW["Firewall / router\nNAT for IPv4, stateful rules for IPv4 + IPv6\nVPN gateway"] --> CORE["Core switch (Layer 3)\nVLANs 10, 20, 30, 40, 50"]
    FW <-.->|"IPsec site-to-site VPN\n192.168.10.224/30"| BR["Pokhara branch router\n192.168.10.160/27\n2001:db8:abcd:100::/56"]
    CORE --> AS1["Access switch, floor 1 (PoE)\nVLAN 10 Staff, VLAN 20 Accounts"]
    CORE --> AS2["Access switch, floor 2 (PoE)\nVLAN 30 Admin/HR"]
    CORE --> SRV["Server rack\nVLAN 50: NAS, printers, CCTV recorder"]
    AS1 --> AP1["Wi-Fi AP\nSSID Staff → VLAN 10\nSSID Guest → VLAN 40"]
    AS2 --> AP2["Wi-Fi AP\nSSID Staff → VLAN 10\nSSID Guest → VLAN 40"]

Figure: Sagarmatha Trading’s hierarchical star topology with VLANs and a VPN to the branch

Why this design:

  • Star at each layer means one failed cable affects only one device, and adding a floor means adding an access switch (see the star and tree topologies in note 4.6).
  • VLANs separate broadcast traffic and let the firewall enforce who can reach what. Guest phones never see the accounts server.
  • The firewall is the single policy point for internet access, inter-VLAN rules and the VPN, which suits a small team.
  • Gateways: each VLAN’s first usable address is its default gateway (e.g. 192.168.10.1 for VLAN 10, 192.168.10.129 for VLAN 20), configured on the core switch or firewall.
  • Static vs dynamic: DHCP for staff and guest devices; static or DHCP-reserved addresses for servers, printers and the CCTV recorder in VLAN 50.

Part E: Verify Everything with Python

Save this as subnetting.py and run python subnetting.py. It uses only the standard library.

import ipaddress as ip

# --- Part 1: binary view of an address and mask -------------------------------
addr = ip.ip_interface("192.168.10.77/26")
print("Address :", addr.ip, "->", ".".join(f"{o:08b}" for o in addr.ip.packed))
print("Mask    :", addr.netmask, "->", ".".join(f"{o:08b}" for o in addr.netmask.packed))
print("Network :", addr.network.network_address, "| Broadcast:", addr.network.broadcast_address)
print()

# --- Part 2: VLSM plan for a hypothetical Kathmandu office --------------------
BLOCK = ip.ip_network("192.168.10.0/24")
NEEDS = [  # (segment, hosts needed)
    ("VLAN 10 Staff (wired + Wi-Fi)", 60),
    ("VLAN 40 Guest Wi-Fi", 50),
    ("VLAN 20 Accounts", 25),
    ("Branch LAN (Pokhara)", 20),
    ("VLAN 30 Admin/HR", 12),
    ("VLAN 50 Servers/printers/CCTV", 10),
    ("WAN link HQ-branch", 2),
]


def prefix_for(hosts):
    """Smallest IPv4 prefix whose usable hosts (2^h - 2) cover the need."""
    h = 2
    while 2 ** h - 2 < hosts:
        h += 1
    return 32 - h


# Allocate largest first; each block then starts on a correct boundary.
cursor = BLOCK.network_address
plan = []
for name, hosts in sorted(NEEDS, key=lambda n: -n[1]):
    subnet = ip.ip_network(f"{cursor}/{prefix_for(hosts)}")
    plan.append((name, hosts, subnet))
    cursor = subnet.broadcast_address + 1

print(f"{'Segment':31} {'Need':>4} {'Subnet':18} {'Mask':15} {'Usable range':29} {'Max':>3}")
for name, hosts, s in plan:
    first, last = s.network_address + 1, s.broadcast_address - 1
    print(f"{name:31} {hosts:>4} {str(s):18} {str(s.netmask):15} "
          f"{f'{first} - {last}':29} {s.num_addresses - 2:>3}")
subnets = [s for _, _, s in plan]
remaining = list(ip.summarize_address_range(cursor, BLOCK.broadcast_address))
print(f"Addresses used: {sum(s.num_addresses for s in subnets)} of {BLOCK.num_addresses}; "
      f"still free: {', '.join(map(str, remaining))}")
print("Any overlaps?", any(a.overlaps(b) for i, a in enumerate(subnets) for b in subnets[i + 1:]))
print()

# --- Part 3: private, shared and documentation ranges -------------------------
RFC1918 = [ip.ip_network(n) for n in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
for a in ["10.1.2.3", "172.31.255.1", "172.32.0.1", "192.168.10.77", "100.64.5.9", "203.0.113.10"]:
    x = ip.ip_address(a)
    tag = ("RFC 1918 private" if any(x in n for n in RFC1918)
           else "RFC 6598 shared (CGNAT)" if x in ip.ip_network("100.64.0.0/10")
           else "RFC 5737 documentation" if x in ip.ip_network("203.0.113.0/24")
           else "public")
    print(f"{a:15} is_private={str(x.is_private):5} is_global={str(x.is_global):5} -> {tag}")
print()

# --- Part 4: IPv6 text representation (RFC 5952) -----------------------------
for raw in ["2001:0db8:0000:0000:0001:0000:0000:0001",
            "2001:0DB8:0000:0001:0000:0000:0000:0001",
            "2001:db8:0:0:1:0:0:0",
            "2001:db8:0:1:1:1:1:1"]:
    a = ip.IPv6Address(raw)
    print(f"{raw:40} -> {a.compressed:22} (full: {a.exploded})")
print()

# --- Part 5: IPv6 plan for the same office ------------------------------------
site = ip.ip_network("2001:db8:abcd::/48")  # documentation prefix (RFC 3849) as a stand-in
print("/64 subnets in a /48:", 2 ** (64 - site.prefixlen))
print("Addresses in one /64:", ip.ip_network("2001:db8:abcd:10::/64").num_addresses)
for vlan in (10, 20, 30, 40, 50):
    net = ip.ip_network(f"2001:db8:abcd:{vlan}::/64")
    print(f"VLAN {vlan}: {net}  inside site? {net.subnet_of(site)}")
branch = ip.ip_network("2001:db8:abcd:100::/56")
print("Branch gets:", branch, "->", 2 ** (64 - branch.prefixlen), "/64s; inside site?",
      branch.subnet_of(site))
print()

# --- Part 6: answers to the practice exercises -------------------------------
n = ip.ip_interface("172.16.45.130/26").network
print("Ex1:", n, n.netmask, n.broadcast_address, n.network_address + 1, n.broadcast_address - 1,
      n.num_addresses - 2)
print("Ex2: /27s in a /24 =", len(list(ip.ip_network("192.168.1.0/24").subnets(new_prefix=27))))
print("Ex3: prefix for 500 hosts = /%d" % prefix_for(500))
n = ip.ip_network("10.10.0.0/22")
print("Ex4:", n.netmask, "| usable", n.num_addresses - 2, "| last usable", n.broadcast_address - 1)
print("Ex5: same subnet?", ip.ip_interface("192.168.10.62/26").network
      == ip.ip_interface("192.168.10.66/26").network)
print("Ex6:", ip.IPv6Address("2001:0db8:0000:0000:0000:ff00:0042:8329").compressed)
print("Ex7:", ip.IPv6Address("2001:db8::abc:1").exploded)
print("Ex8: 172.32.0.1 in RFC 1918?", any(ip.ip_address("172.32.0.1") in n for n in RFC1918))
print("Ex9: /64s in a /56 =", 2 ** (64 - 56))

Output (Python 3.11):

Address : 192.168.10.77 -> 11000000.10101000.00001010.01001101
Mask    : 255.255.255.192 -> 11111111.11111111.11111111.11000000
Network : 192.168.10.64 | Broadcast: 192.168.10.127

Segment                         Need Subnet             Mask            Usable range                  Max
VLAN 10 Staff (wired + Wi-Fi)     60 192.168.10.0/26    255.255.255.192 192.168.10.1 - 192.168.10.62   62
VLAN 40 Guest Wi-Fi               50 192.168.10.64/26   255.255.255.192 192.168.10.65 - 192.168.10.126  62
VLAN 20 Accounts                  25 192.168.10.128/27  255.255.255.224 192.168.10.129 - 192.168.10.158  30
Branch LAN (Pokhara)              20 192.168.10.160/27  255.255.255.224 192.168.10.161 - 192.168.10.190  30
VLAN 30 Admin/HR                  12 192.168.10.192/28  255.255.255.240 192.168.10.193 - 192.168.10.206  14
VLAN 50 Servers/printers/CCTV     10 192.168.10.208/28  255.255.255.240 192.168.10.209 - 192.168.10.222  14
WAN link HQ-branch                 2 192.168.10.224/30  255.255.255.252 192.168.10.225 - 192.168.10.226   2
Addresses used: 228 of 256; still free: 192.168.10.228/30, 192.168.10.232/29, 192.168.10.240/28
Any overlaps? False

10.1.2.3        is_private=True  is_global=False -> RFC 1918 private
172.31.255.1    is_private=True  is_global=False -> RFC 1918 private
172.32.0.1      is_private=False is_global=True  -> public
192.168.10.77   is_private=True  is_global=False -> RFC 1918 private
100.64.5.9      is_private=False is_global=False -> RFC 6598 shared (CGNAT)
203.0.113.10    is_private=True  is_global=False -> RFC 5737 documentation

2001:0db8:0000:0000:0001:0000:0000:0001  -> 2001:db8::1:0:0:1      (full: 2001:0db8:0000:0000:0001:0000:0000:0001)
2001:0DB8:0000:0001:0000:0000:0000:0001  -> 2001:db8:0:1::1        (full: 2001:0db8:0000:0001:0000:0000:0000:0001)
2001:db8:0:0:1:0:0:0                     -> 2001:db8:0:0:1::       (full: 2001:0db8:0000:0000:0001:0000:0000:0000)
2001:db8:0:1:1:1:1:1                     -> 2001:db8:0:1:1:1:1:1   (full: 2001:0db8:0000:0001:0001:0001:0001:0001)

/64 subnets in a /48: 65536
Addresses in one /64: 18446744073709551616
VLAN 10: 2001:db8:abcd:10::/64  inside site? True
VLAN 20: 2001:db8:abcd:20::/64  inside site? True
VLAN 30: 2001:db8:abcd:30::/64  inside site? True
VLAN 40: 2001:db8:abcd:40::/64  inside site? True
VLAN 50: 2001:db8:abcd:50::/64  inside site? True
Branch gets: 2001:db8:abcd:100::/56 -> 256 /64s; inside site? True

Ex1: 172.16.45.128/26 255.255.255.192 172.16.45.191 172.16.45.129 172.16.45.190 62
Ex2: /27s in a /24 = 8
Ex3: prefix for 500 hosts = /23
Ex4: 255.255.252.0 | usable 1022 | last usable 10.10.3.254
Ex5: same subnet? False
Ex6: 2001:db8::ff00:42:8329
Ex7: 2001:0db8:0000:0000:0000:0000:0abc:0001
Ex8: 172.32.0.1 in RFC 1918? False
Ex9: /64s in a /56 = 256

Notice a trap in Part 3: Python reports 203.0.113.10 as is_private=True. The is_private property follows IANA’s special-purpose address registries, which also mark documentation and other reserved ranges as not globally reachable. It is not the same as “inside RFC 1918”, which is why the script checks the three RFC 1918 blocks explicitly. 100.64.5.9 is neither private nor global: it belongs to an ISP’s carrier-grade NAT space.

Part F: Practice Exercises

Work each one by hand first, then check against the Python output above.

# Exercise
1 For 172.16.45.130/26, find the network, mask, broadcast, usable range and number of hosts.
2 How many /27 subnets fit in a /24, and how many usable hosts does each have?
3 What is the smallest IPv4 prefix for a VLAN of 500 devices?
4 For 10.10.0.0/22, give the mask, the number of usable hosts and the last usable address.
5 A printer is 192.168.10.62/26 and a laptop is 192.168.10.66/26. Can they talk without a router?
6 Write 2001:0db8:0000:0000:0000:ff00:0042:8329 in RFC 5952 short form.
7 Expand 2001:db8::abc:1 to its full form.
8 Is 172.32.0.1 a private (RFC 1918) address?
9 Your ISP delegates a /56. How many /64 VLANs can you create?
10 Design: a Thamel guesthouse needs staff, guest Wi-Fi and CCTV networks. Propose VLANs, subnets from 192.168.50.0/24, and one firewall rule.
Answers 1. Network **172.16.45.128/26**, mask 255.255.255.192, broadcast **172.16.45.191**, usable **172.16.45.129 – 172.16.45.190**, **62** hosts. (Block size 64: .128 is the block containing .130.) 2. **8** subnets (2³, because /27 borrows 3 bits from /24), each with 2⁵ − 2 = **30** usable hosts. 3. **/23**: 2⁹ − 2 = 510 ≥ 500, while /24 gives only 254. 4. Mask **255.255.252.0**, **1,022** usable hosts (2¹⁰ − 2), last usable **10.10.3.254** (broadcast 10.10.3.255). 5. **No.** .62 is in 192.168.10.0/26 and .66 is in 192.168.10.64/26: different subnets, so traffic must go through a router or Layer 3 switch. 6. **2001:db8::ff00:42:8329** (leading zeros removed; the run of three zero groups becomes `::`). 7. **2001:0db8:0000:0000:0000:0000:0abc:0001** (four groups are visible, so `::` stands for four `0000` groups; then restore leading zeros). 8. **No.** The RFC 1918 block is 172.16.0.0/12, which ends at 172.31.255.255. 172.32.0.1 is a public address. 9. **256** (2⁶⁴⁻⁵⁶ = 2⁸). 10. One reasonable answer: VLAN 10 Staff 192.168.50.0/26 (62 hosts), VLAN 20 Guest Wi-Fi 192.168.50.64/26, VLAN 30 CCTV 192.168.50.128/27 (30 hosts), leaving 192.168.50.160/27 and 192.168.50.192/26 free. Rule: **deny Guest (VLAN 20) to all internal VLANs; allow Guest to internet only.** A second good rule: only the owner's phone over VPN may reach the CCTV recorder from outside.

Summary

IPv4 subnetting divides a 32-bit address into network and host bits; the prefix length sets the mask, and from it you derive the network address, broadcast address and 2^h − 2 usable hosts. VLSM sizes each subnet to its need, allocating largest first, which let Sagarmatha Trading fit seven segments into one /24 with room to spare. RFC 1918 private ranges plus NAT let an office share one public IPv4 address, but carrier-grade NAT and scarce public addresses limit what a business can host. IPv6 removes the scarcity: every VLAN gets a /64, a site gets a /48 or /56, and addresses are written in the RFC 5952 short form. Devices configure themselves with SLAAC or DHCPv6, and dual stack runs both protocols side by side. A hierarchical star topology with VLANs, separate staff and guest Wi-Fi, one firewall and a site-to-site VPN turns the address plan into a manageable, secure office network.

Key Takeaways

  • Usable IPv4 hosts = 2^(32 − prefix) − 2; block size = 256 − the interesting mask octet.
  • VLSM: sort largest first, choose the smallest prefix that fits, allocate on boundaries, document leftovers.
  • RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. NAT is not a firewall.
  • IPv6: 128 bits; remove leading zeros, use :: once for the longest zero run, lowercase.
  • Use /64 for every IPv6 LAN; ask the ISP for a persistent /48 or /56 per site.
  • SLAAC needs no server; DHCPv6 keeps central lease records. Many networks combine SLAAC with RDNSS or stateless DHCPv6.
  • Dual stack plus a stateful firewall is the practical path for a Nepali office today.

Discussion Questions

  1. Your ISP places your office behind carrier-grade NAT. What business services (remote CCTV viewing, hosting a website, VPN for staff) are affected, and what are your options?
  2. Why is VLSM important in IPv4 but almost irrelevant inside an IPv6 site?
  3. A manager asks, “If IPv6 gives every device a public address, isn’t that less secure than NAT?” How would you answer?
  4. For a bank branch network in Nepal, which parts of the Sagarmatha Trading design would you change, and why?

References