DHCP Exhaustion and a Flat Network at a 28-Person Studio
Northline Studio is a 28-person design firm occupying one floor of a leased building. A single consumer-grade router does everything: NAT, DHCP, DNS forwarding, and one combined 2.4/5 GHz SSID shared by staff laptops, phones, wireless printers, and guests - the guest password is written on a whiteboard in reception. The DHCP scope is 192.168.1.100–192.168.1.199 with a 24-hour lease. Three years of growth have produced three recurring complaints. First, staff laptops sometimes show as connected but cannot reach the internet until Wi-Fi is toggled off and on. Second, two printers intermittently go offline because another device has taken their address; both printers were configured with static addresses inside the dynamic range. Third, the office manager reports that the network 'drops' nearly every day around 11:00, when the team runs video calls. The router log shows 240+ leases issued in a 24-hour period, and its CPU graph is pegged during calls. Hardware budget is capped at roughly $600.
1. Match each of the three symptoms to the most likely root cause, then state which one you would investigate first and why.
Read the worked answer
The three symptoms do not share one cause, and treating them as one is the trap.
Connect-then-no-internet: 240 leases issued in 24 hours against a 100-address pool with a 24-hour lease is the signature of address-pool pressure combined with modern client behaviour - phones and laptops randomize their MAC per SSID, so each reconnection can consume a fresh lease. When the pool is full, a client may associate and receive a stale or conflicting answer, which is why toggling Wi-Fi appears to fix it.
Printers offline: static addresses configured inside 192.168.1.100–199 will eventually collide with a DHCP lease. This is a configuration error, not a fault.
11:00 drops: the router CPU pegging during video calls points to an underpowered device handling NAT and wireless for ~28 people plus guests - a capacity problem, not an addressing problem.
Investigate DHCP first: it is free to fix, it explains two of the three symptoms, and it is the only one where a wrong fix (extending the scope) would visibly make things worse. The 11:00 issue needs separate capacity data before spending.
2. You have about $600. Propose the change plan in priority order, and justify what you deliberately defer.
Read the worked answer
Step 1 - free, do this week. Move both printers to static addresses outside the pool (or DHCP reservations), shorten the lease to 4–8 hours, and clear the stale lease table. This ends the printer outages immediately and relieves pool pressure without a purchase.
Step 2 - separate guest traffic. Put guests on a second SSID mapped to its own subnet/VLAN with client isolation and its own small pool. This removes unknown devices from the staff pool entirely, which is the real fix for lease churn, and gives you a place to rotate the password. This is the change that guests on a whiteboard password makes urgent.
Step 3 - spend the $600. A small-business access point or router with VLAN support plus a managed switch is enough for one floor. Do not buy a bigger consumer router; you need segmentation, not more antennae.
Deferred: replacing the ISP circuit and buying a UTM/firewall. You have no evidence yet that bandwidth is the constraint - the CPU graph suggests the device, not the link. Measure call quality after segmentation before quoting a firewall, because that purchase is an order of magnitude above this budget and should be justified with data.
3. A colleague suggests changing the subnet mask to /16 so the office never runs out of addresses again. Evaluate that proposal.
Read the worked answer
It 'works' in the narrow sense that 192.168.0.1–192.168.255.254 gives ~65,000 addresses, and it requires no purchase. It is still the wrong fix.
Reasons to reject it:
- It does not isolate anything. Guests, printers, and staff laptops stay on one broadcast domain. Broadcast and mDNS traffic grows, the router's ARP and NAT tables grow, and the underpowered device that is already pegging at 11:00 gets more work, not less.
- It hides the real problems. The printer collisions come from static addresses inside a dynamic range; a /16 makes collisions rarer and therefore harder to diagnose, not impossible.
- It is a one-way door. Resizing to /16 later requires re-IPing everything anyway; resizing from /16 back down is harder, because by then devices have drifted across the whole range.
- It conflicts with home/VPN ranges. 192.168.0.0/16 overlaps the default networks of most consumer routers, which breaks VPN access for remote staff.
A /16 is a legitimate choice for a genuinely large flat network such as a campus lab VLAN. For 28 people with a guest SSID and printers, segmentation is cheaper, safer, and diagnosable. Address exhaustion is a symptom of no segmentation.