Rewiring a Two-Block School Network on a Fixed Budget
A higher secondary school in Kozhikode runs its computer lab in the main block: 60 desktop machines spread over three floors. The annexe block, 140 m away along a covered walkway, houses the principal's office and the library with 8 computers. At present every machine in the lab is plugged into one 8-port hub that has been daisy-chained with two more small hubs, and the annexe is reached by a single length of CAT-5 UTP that the electrician joined twice with insulation tape. Teachers report two symptoms. First, when all 60 lab machines attempt an online test, the principal cannot open even the school's own website in the office. Second, copying a 200 MB video from the lab server to a library machine takes nearly an hour. The school has a 40 Mbps broadband connection, a sanctioned rewiring budget of ₹40,000, and the network address 192.168.5.0 allotted by the local ISP for internal use.
1. Diagnose both symptoms in terms of the devices and cabling in use, and propose a replacement plan that fits the ₹40,000 budget.
Read the worked answer
Symptom 1 - the office cannot reach the website. A hub is a repeating device: every port is in the same collision domain and shares one bandwidth pool, half duplex. With 60 machines contending, collisions and retransmissions consume most of the capacity, and the 40 Mbps WAN link is shared among all of them with no priority. The office traffic is simply crowded out. There is also a physical problem: the CAT-5 run is 140 m, well beyond the 100 m limit for twisted pair, and the taped joints add attenuation and crosstalk, so that link retransmits or drops.
Symptom 2 - the slow 200 MB copy. 200 MB ≈ 1,600 Mbit. An hour means roughly 0.45 Mbps effective throughput. Over a hub-based, collision-heavy, half-duplex segment with a damaged uplink, that figure is entirely plausible; the link, not the server, is the bottleneck.
Plan within budget. (1) Replace the hub stack with two 24-port switches (48 ports) plus one 24-port switch for the annexe - switches give each port a dedicated full-duplex segment and separate collision domains. (2) Carry the 140 m span on fibre optic cable with a media converter or a switch having a fibre uplink, since fibre has far lower attenuation and is immune to electrical interference; alternatively place an intermediate switch so that no copper segment exceeds 100 m. (3) Terminate and test all joints professionally, and crimp new patch cords. (4) On the router, apply simple bandwidth priority to the office/administrative subnet during exam hours. Two switches, one small annexe switch, ~150 m of fibre with converters and labour fall inside ₹40,000 if unbranded managed switches are chosen.
2. Analyse the address 192.168.5.0: which class does it belong to, what is the default mask, how many usable host addresses does it provide, and is it adequate for the school's 68 machines? What would you do if the school later grows to 300 machines?
Read the worked answer
Class. The first octet is 192. Class C covers first octets 192–223, so this is a Class C address. (The syllabus rule: 1–126 Class A, 128–191 Class B, 192–223 Class C, 224–239 Class D multicast, 240–255 Class E reserved.)
Mask and capacity. Default Class C mask is 255.255.255.0, i.e. the first three octets are the network part (192.168.5) and the last octet is the host part, giving 2^8 = 256 addresses. Two are unusable - the all-zeros network address 192.168.5.0 and the all-ones broadcast 192.168.5.255 - so 254 usable host addresses.
Adequacy. 68 devices fit comfortably within 254. Note also that 192.168.0.0–192.168.255.255 is a private range under RFC 1918, so these addresses are never routed on the internet and need no registration; the school reaches the internet through NAT on the router using the ISP's single public address. That is precisely why the ISP 'allotted' it for internal use.
Growth to 300. One Class C cannot hold 300 hosts. Options: move to a private Class B range such as 172.16.0.0 with mask 255.255.0.0 (65,534 hosts) and renumber once; or keep the Class C and subnet it into smaller blocks (for example /26, giving four networks of 62 hosts) with a router between them; or use VLANs and a router-on-a-stick. Renumbering early, while the installation is new, is cheaper than renumbering later.
3. The principal wants library staff to browse the internet but must not be able to open the lab's student marks folder. The lab machines must reach the internet but not the marks folder either. Suggest a design and justify each control.
Read the worked answer
Do not rely on the physical layout. With one flat switch and one subnet, any machine can attempt a connection to any other; security must come from logical separation plus authentication.
Layer 1 - logical separation. Create VLANs on the switches: VLAN 10 for the lab, VLAN 20 for office/library, VLAN 30 for the server holding marks. Traffic between VLANs must pass through the router or a Layer-3 switch, where an access control list can permit lab→internet and library→internet but deny both to VLAN 30, allowing only the exam-cell PC.
Layer 2 - file-level permissions. Even inside VLAN 30, the marks folder should be shared with access-based enumeration and granted only to a security group containing the exam cell. Share permissions and NTFS permissions both apply, and the stricter wins; students must not be members of that group. The default 'Everyone – Read' share must be removed.
Layer 3 - identity. Teachers and staff need individual accounts, not a shared 'admin' login, so that the log records who opened the folder. A shared password makes the audit trail worthless and, as the next incident usually shows, gets passed around on WhatsApp.
Layer 4 - isolation and hygiene. Put any student/guest Wi-Fi on its own VLAN with client isolation. Take nightly backups of the marks folder to a separate device, because permissions do not protect against deletion, ransomware or a stolen disk. Record in the lab diary that these controls were tested by attempting the blocked connection, not merely configured.