Riverside School Network Segmentation
Riverside School has four buildings linked by a 1 Gbps fibre backbone. There are 620 student laptops, 140 staff laptops, 60 IP cameras and 30 wireless access points. All devices currently use one flat IPv4 network, 172.16.0.0/16, with one DHCP scope. During online lessons, 30 classes stream video at 8 Mbps each. Staff report that video stutters in Building C, that the camera feeds freeze when a laptop connects, and that the network slows sharply after a laptop infected with a broadcast worm joins. The school has been allocated 172.16.0.0/16 and wants to keep the address plan simple. A supplier proposes replacing all access points with Wi-Fi 6 models. The business manager asks whether that alone will fix the stuttering and freezing. The school can afford either a subnet/VLAN redesign or new access points this year, not both.
1. Design a VLAN and IPv4 subnet plan for students, staff and cameras using 172.16.0.0/16. Give subnets and masks, and justify the sizes.
Read the worked answer
The flat design fails immediately on size: a /24 gives only 254 usable addresses, but there are 620 student laptops, so the student VLAN needs at least a /23 (510 usable) - still too small - or a /22 (1,022 usable). A simple plan:
- VLAN 10, students: 172.16.4.0/22, usable 172.16.4.1–172.16.7.254. 1,022 addresses cover 620 devices with growth.
- VLAN 20, staff: 172.16.8.0/24, 254 usable, covers 140 with room.
- VLAN 30, cameras: 172.16.12.0/26, 62 usable, covers 60 but is tight; use 172.16.12.0/25 if growth is expected.
- VLAN 40, management/APs: 172.16.12.128/26, 62 usable, covers 30 APs and switches.
Each VLAN needs its own DHCP scope, default gateway and, on the Layer 3 switch or router, an ACL. Broadcasts stay inside a VLAN; inter-VLAN traffic is routed. Keep 172.16.0.0/22 and other blocks reserved. The plan is “simple” because each role has one summarisable block, not because everything shares one subnet.
2. Explain why the broadcast worm slowed the flat network and how VLANs limit the damage. Include the role of the router or Layer 3 switch and one limitation of VLANs.
Read the worked answer
In one flat 172.16.0.0/16 network, all roughly 850 devices are in the same broadcast domain. A broadcast frame is flooded to every switch port in that domain. A worm that sends broadcast or ARP traffic can multiply this load: every device must process the frames, and the backbone carries them even to buildings with no infected machine. The symptom is not one slow link but broad slowdown and high CPU on switches and hosts.
VLANs divide the broadcast domain. A broadcast from VLAN 10 is not forwarded to VLAN 20 or 30 by a router or Layer 3 switch, because routers do not forward Layer 2 broadcasts by default. The Layer 3 device routes only the unicast traffic that policy allows, and ACLs can block student-to-camera and student-to-management traffic. This limits both broadcast load and worm reach.
Limitation: VLANs alone do not stop a worm that uses routable unicast scanning or that spreads through a shared service. ACLs, patching, port security and monitoring are still needed. Also, inter-VLAN routing adds a policy point that must be sized and secured.
3. The supplier claims that replacing all access points with Wi-Fi 6 alone will fix the video stutter and camera freezes. Evaluate this claim using CSMA/CA, contention and the backbone. Recommend what to fund first.
Read the worked answer
The claim is only partly credible. Wi-Fi is shared and uses CSMA/CA: a station listens, waits a random backoff, and transmits; if it does not receive an acknowledgement, it retries. More efficient Wi-Fi 6 features such as OFDMA and BSS colouring reduce contention and co-channel interference, so new APs can help in Building C if the problem is airtime contention or overlapping channels.
But the evidence points to other causes too. Thirty classes at 8 Mbps is 240 Mbps aggregate, which fits the 1 Gbps backbone but not necessarily one AP’s real throughput if many laptops stream through it. Camera freezes that occur “when a laptop connects” suggest broadcast/ARP load, DHCP or switch contention, not just the radio standard. A flat network still floods broadcasts to all APs and cameras. A new AP cannot fix a broadcast storm, a saturated uplink or missing QoS.
Recommend funding the VLAN/subnet redesign first, with QoS marking video and camera traffic, channel planning and a survey of Building C. Wi-Fi 6 can follow if measurements still show airtime contention. Buying APs first risks spending money without removing the cause.