One Flat Subnet for a Three-Building Cooperative
A dairy cooperative in Dhading Besi runs everything on one router and one flat network, 192.168.20.0/24, with a single DHCP pool. The admin office has 58 devices: 12 desktops, 3 network printers, a file server holding member payment records, and staff phones. The training lab has 26 desktops used by visiting farmers' groups. Free Wi-Fi serves 11 member tablets. Complaints have piled up: when a lab group streams training videos, the morning milk-payment upload to the bank stalls; a trainee opened the admin file server share from the lab and browsed the payment folder; and two members were handed the same address by DHCP, causing intermittent disconnections. The cooperative has no budget for new switches, but the router has three free LAN interfaces and one serial/WAN interface to the ISP, which needs 2 usable addresses. They must keep using 192.168.20.0/24 only, and they want room to grow later.
1. Produce a VLSM address plan covering admin, lab, Wi-Fi and the ISP link. For each subnet give the network address, prefix and mask, usable range and broadcast address, and explain why the order of allocation matters.
Read the worked answer
Allocate largest first, rounding each requirement up to a power of two minus two usable addresses.
| Segment | Need | Prefix | Network | Mask | Usable | Broadcast |
|---|---|---|---|---|---|---|
| Admin | 58 | /26 (62) | 192.168.20.0 | 255.255.255.192 | .1 – .62 | .63 |
| Lab | 26 | /27 (30) | 192.168.20.64 | 255.255.255.224 | .65 – .94 | .95 |
| Member Wi-Fi | 11 | /28 (14) | 192.168.20.96 | 255.255.255.240 | .97 – .110 | .111 |
| ISP link | 2 | /30 (2) | 192.168.20.112 | 255.255.255.252 | .113, .114 | .115 |
Left over: 192.168.20.116 – 192.168.20.255, 140 addresses for a second lab or a guest network.
Why the order matters: a /26 block must start on a multiple of 64 and a /27 on a multiple of 32. If the lab were placed first at .0/27, a later /26 would no longer fit on its 64-boundary and the block would fragment, wasting addresses. Sorting by size descending keeps every block naturally aligned. Also note 58 hosts needs 6 host bits because 2^5 − 2 = 30 is not enough; choosing a /27 for admin would leave 32 devices unaddressed.
2. Explain how this plan addresses the streaming slowdown and the trainee browsing the payment share. Be precise about what actually changes on the wire, and state why a router is required between the segments.
Read the worked answer
Broadcast domain. A switch forwards broadcasts out of every port, so today all 95 devices share one broadcast domain: every ARP request, every DHCP Discover and every NetBIOS/mDNS announcement from the lab hits the admin file server, and a broadcast storm takes the whole site down. Putting each subnet on its own router interface (or its own VLAN trunked to the router) creates a separate broadcast domain per segment. The lab's broadcast traffic is terminated at the router and never crosses into admin.
Contention. With one flat segment, the 26 lab desktops and the admin PC compete for the same uplink and the same router queue. Once separated, the router can apply QoS so the bank upload from the file server is prioritised over training video. That, not the subnet mask itself, is what fixes the stall.
Security. The trainee reached the payment share because everyone was in one subnet and Windows treated the lab machine as a neighbour. After segmentation, 192.168.20.96/28 cannot reach 192.168.20.0/26 unless the router forwards the packet. An access list on the router interface permits only DNS and the internet to the Wi-Fi subnet, so the share is unreachable by default. This is why a router (or a Layer 3 switch) is essential: two subnets on one flat switch still share a broadcast domain and still need a routing decision, and a host will simply ARP for an address it wrongly believes is local.
3. A member's laptop is manually configured with address 192.168.20.100, mask 255.255.255.0, gateway 192.168.20.97. It can ping 192.168.20.97 but not the lab printer at 192.168.20.70. Diagnose the fault and give the corrected settings, explaining the mechanism.
Read the worked answer
The address is in the right range for the Wi-Fi subnet (192.168.20.96/28, usable .97–.110), but the mask is wrong: 255.255.255.0 is a /24, not the /28 (255.255.255.240) the segment uses.
Mechanism. The laptop ANDs 192.168.20.70 with 255.255.255.0 and concludes the printer is on the same subnet, so it never sends the packet to the gateway. It broadcasts an ARP request for 192.168.20.70 on the Wi-Fi segment. The printer is on the lab segment and never sees that broadcast; the router does see it but does not proxy-ARP by default, so no reply arrives and the laptop reports the destination host unreachable. Ping to 192.168.20.97 succeeds only because that address is the router's own interface on the same physical wire - the router answers ARP for itself regardless of the laptop's mask, which is exactly why this fault is confusing: the gateway 'works' while everything else fails.
Corrected settings:
- IP: 192.168.20.100
- Mask: 255.255.255.240 (/28)
- Gateway: 192.168.20.97
- DNS: the ISP or router address
Prevention: stop hand-configuring members, and check that the Wi-Fi DHCP scope actually issues option 1 (mask 255.255.255.240) and option 3 (gateway .97). Verify with ipconfig /all on the client rather than trusting the number typed into the dialog box.