Slashdot Mirror
Local Network IPs - 10.0.0.0/8 or 192.168.0.0/16?
mike9010 asks: "After reading a few articles on the net about networking, I have come up with a question. It seems that most of them say to use 192.168.0.0/16 for a local network. Why not use 10.0.0.0/8 though? It is my understanding that it can hold a lot more IP addresses, and it is also prettier." What local network range are you using for your networks?
This is an intermediate one that isnt widely used.
I dont think it matters too much; few businesses have as many as 64,000 computers, so the 192.168 is big enough. But the 10 makes it easy to do interesting things with the other numbers, like making the first number the department number, etc.
Sunlit World Scheme. Weird and different.
There's no reason why not. I have no idea why every manufacturer wants the masses to use the pretty confusing IP range when 10.0.0.0./8 is easier to remember/type.
I use it myself. Nothing wrong with it.
-- iCEBaLM
Use of 10/8 can be a fine choice.
chongo (was here)
It doesn't seem to conflict with anything important.
There are no karma whores, only moderation johns
I use 10.0.0.x, but Windows keeps assigning IP's from 192.168 range by default.
There is no real reason to use one or the other except that many devices come with built in static IP addresses. I've seen some with 10.x addresses, others with 192.168.x addresses. I guess not looking at that, it just comes down to choice. I like 192.168 and use it on my home network... but my work network uses 10. JUST GO FOR IT MAN!
The 10.x.x.x IPs are used for larger networks. Suppose you switch ISPs and get connected with an ISP with a NAT, or you VPN with some other network. Chances are they will be 10.x.x.x. In general use 10.x.x.x if you're running a large network and 192.168.x.x for a smaller network.
Make even shorter URLs - 8LN.org
Geezuz....
And no, it's not from the "matters-of-personal-opinion" dept., it's from the rtfm-and-plan-your-network-appropriately dept.
Unless you have a very large number of networks or hosts. Then the 10.0.0.0/8 private address range gives you more room to subnet for different locations. There is also the 172.16.0.0/12 network.
Personally, I do 172.16.10.x since everyone else uses either 10.0.0.0 or 192.168.0.0 Now granted this limits me to 256 IP's, but since I only have 3 computers on the network, it's not a problem. Of course it would be trivial to change that so its like a class B address, instead of a class C.
Though honestly, you could use whatever you wanted with the proper network setup. After all, if the stuff isn't visible to the rest of the world, then it doesn't matter what you use. Worst case scenerio is that you might stumble upon a computer in the real world with the same IP address as you, but that'd be rare. It might not even be a problem if you accessed it by a DNS entry through a DNS server that was external to your network, but I can't say that for sure.
-Through the server, over the router, off the firewall... Nothing but 'Net!
Oh sure, it's prettier if you are into the modern reductionist view of IP address beauty. I, for one, continue to prefer form and substance. How can someone compare 192.168 with 10.0? Praising 10.0 is like calling a blank canvas a masterpiece. Some people would not know real IP art if it hit them in the face.
Listen to this guy. This is the reason why you should use 192.168 at home. Mod this post up.
I use 192.168.0.0-xxx for my home network because a lot of businesses use 10.0.0.xxx and I have faced network access issues when connecting through VPN to business networks...
I actually asked this question once. Nobody could really give me a good answer. I personally prefer 10.0.0.0 over 192.168.0.0. It does look pretier, it's easier to type, and you do have more IPs to play with. Who has need for all those IPs is beyond me, but I say you can never have too many IPs.
It does look prettier. here is how I broke down my NAT network
10.0.0.0-255 = Routers/Server - Kinda, sorta DMZ
10.0.1.0-255 = Wired Workstations
10.0.2.0-255 = Wireless Workstations
10.0.3.0-255 = Test stuffage
192.168.0.0 is the defacto standard for just about any router you buy off the shelf. Perhaps there is a valid reason?
If you use same-size subnets in both cases, there's no difference between the 10-net and the 192-net.
If you're using 10/8 vs. 192/24, and have enough computers to justify that, you'll want to break it up into subnets to limit the size of your broadcast domains.
So my advice is whack off 1/4 of the 10/8 space - and reserve it for true "private addressing" and use all of the rest of the private addressing ranges as you see fit
I have mod points and I am not afraid to use them
furthermore, DO NOT use 192.168.0.XX. Because you might get a job with a vpn-ing company that uses that to. Get a random number under 256, and use that instead of 1.
...
e.g. I use 192.168.88.XX. I used to use 192.168.1.XX, but guess what, I got a job
most minirouter/firewall/cable modem sharers use 192.168.0.0/24, that i've seen. works fine if you've under 254 hosts.
but most large internal networks do use 10/8, 10/16, or 10/24- it is a lot cleaner to setup, and does allow some neat organizational capabilities. i used 10/16 back in 97 when i set up my school district's WAN, and is still being used too.
in times past, an argument might have been made for 172.whatever/16-23, because the larger subnets are "slower" on a network- but we've got switches, so who cares! 10/16 it is! printers on one "class C"! english teachers on another! ip#s for all!
sorry, 10dot networks get me all fired up. we're still trying to get all of our state's districts behind a firewall, and i evangelize...
stored on computers from birth to the grave
The one most often used by home networking products is 192.168.1.x in my experience, not the full
RFC 1918 recommends that you choose a network randomly in order to reduce the chances of colliding with any other internal network you may ever want to connect to.
I usually select a random /24 in the 10.0 range. I've found that things sometimes get weird when using vpn tunnels between networks with identical net numbers (i.e. 192.168.1.x), and I often use pptp tunnels to get access to various networks. By using the 10.0 range, and setting a different subnet number for each network I use, I avoid this problem. There's no reason you couldn't do the same on 172.16.
"He who would learn astronomy, and other recondite arts, let him go elsewhere. " -- John Calvin, commenting on Genesis 1
The 192.168 and 10 networks are functionally equivalent except that the 10 network is class A and the 192.168 is class B (i.e. 10 is bigger).
You will find that many off-the-shelf devices, like NAT/Routers from Linksys, Netgear, etc. use 192.168.x.x by default; some of them don't let you use anything else (I think Linksys locks you in to 192.168, but you can change the lower two octets).
I personally use a 10.x.x.x network in my test lab at work, because it allows me to choose network addresses that make sense and are somewhat human-readable. If you're setting up a network for a business, it might make sense to use a 10 network just for expandibility. Then again, if you need more than 64k addresses, you probably have bigger problems to deal with.
One thing I like about the 10 networks is that when you see their addresses scream across a packet dump, you can immediately recognize them as "fake" addresses.
One security/network citizenship point (assuming that your 10 or 192.168 network is behind a NAT connected to the outside world): your firewall/router should NEVER pass packets destined to or accept packets sourced from a fake address range (10/24, 192.168/16, etc.). This can lead to evil attacks, garbage traffic on or out of your network, and a whole host of problems.
I inadvertently flooded my company's T1 line while running a test because our sysadmins hadn't configured our firewall to block outbound packets destined to a 10 address. A bug in a server I was testing caused it to send data back to the wrong address and our router happily sent the data out over the T1. No major harm was done, but a few people couldn't read their Slashdot until we discovered what the problem was.
Bottom line: choose what works for you (which may be either address range).
Its lightning fast! I always have 0 msec pings!
I highly recommend you try it.
Was your comment directed at the parent? If not can you point me to the discussion you were mentioning?
I chose to use 10/8 because it gave me the opportunity to pick nifty subnets (kudos to anyone who can guess how I chose these):
10.30.1/24: DMZ (web, file servers)
10.50.1/24: Internal (computers owned by either me or my roommate)
10.60.1/24: Visitors (LAN party!)
Unless, of course, scissors can't cut rock...
I don't know if it's been consistently followed,
but e-Smith server (now Mitel Networks' SME-server)
seemed to use the Subj pattern, eg:
SME Server ver 5.5 used 192.168.55.xxx
It made putting a new version of the server
(eg, in test mode) feel safer, as one wouldn't
have two boxes trying to use one IP -default-
IP address on the same network.
Of course, one could easily set the new server's
IP adr - after completing tests - to enable the
box to join an existing network.
I was set to comment on your three journal entries, and more, but they all have been archived. Anyway, I added you to my freinds list, what ever that does...
One detail to bear in mind: sometimes you need to NAT within NAT. You can end up with nested NAT zones. 10.x.x.x does *NOT* NAT well within 10.x.x.x I've had to debug routing table illness for this situation several times.
My company makes a security product with its own Linux host, and the host operates cameras with a private NAT of its own. In one version, we had the Linux host and cameras behind an 802 network gateway, and the gateway performed NAT. We had the gateway configured to create a 10.x.x.x network address space within the private NAT zone. Then one day I brought the system home and plugged it into my own 10.x.x.x private network.
Do you think the Linux host inside the 10.x.x.x address space behind the 802 gateway NAT could access my local DNS server at 10.0.0.1 upstream from the 802 gateway? Not a chance.
For this reason, I tend to use all three zones for different purposes, depending on the size of the zone, and whether I think the zones might someday become nested.
Rather incredibly, HP-UX 11 actually won't let you use a 10.0.0.X address by default because it blindly (and wrongly) follows these ancient RFC specs ! If you don't believe me, check out this discussion , which thankfully does indeed have the fixes in the thread (patch PHNE_20633 and a hack to nddconf).
Yep, we use 10.X.X.X addresses and got bitten by this with our HP-UX boxes :-(
I get all the mask/subdomain stuff, but what's the / at the end of the IP address mean?
Fooz Meister
Disabling Auto IP-address generation
Try here
(posting anonymously to avoid karma penalty)
192.168.0.0/16 doesn't exist.
It's really a set of 256 (254, really because you aren't supposed to use 0 or 255)
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
192.168.254.0/24
Now, if you set up your internal routing and gateways correctly, the difference doesn't matter, but TECHNICALLY, since 192 starts with the binary digits '110', it's a class C (/24) network.
FYI.
Which (10.0.0.0/8 or 192.168.0.0/24) you use doesn't matter unless you need to connect your network to somebody else's, but a bad decision (or evaluation of capacity) early on can come back to create problems if your network grows beyond the address space you planned for it. GOOD DESIGN IS ESSENTIAL to preventing problems down the road. Usually the # of hosts you need on your network segments drives the decision. Some larger networks will use the
I'd recommend searching Cisco's site for white papers on network design, or maybe googling for TCP/IP tutorials.
"Lawyers are for sucks."
- Doug McKenzie
I think that it's actually a suggestion of the RFCs that you avoid using networks 0 and 1, and use random numbers instead -- precisely to minimize the probability of address space collisions if you end up merging nets with another entity.
The one nice thing about 192.168/16 is that it's a class-C block in the old class-full address system and so many programs which pay attention to that will give you a /24 netmask and broadcast numbers by default. It's not that much of a bonus, but it sometimes helps for quick & dirty network setups.
I'd say that if you have a big enough network, then use 10/8 or 172.16/12 otherwise, if you're like my home network (6 machines on 2 subnets(!)), 192.168/16 is far more than enough.
In terms of collision avoidance, though, I'd have to agree that I've almost never seen someone using 172.16/12 in a production environment. I sometimes wonder just how many people even know that it exists.
Free Software: Like love, it grows best when given away.
Use IPv6 for your internal network.
It's called a bitmask. That's how many bits are static. 8 bits per byte...
LOAD "SIG",8,1
It is a method of indicating how many bits in the address are part of the 'network' number, as opposed to the 'host' number. For example..
/24 means the user has 254 hosts at their disposal, while a /8 means over 16 million.
In 10.0.0.0/8 that means there are 8 bits that identify the network (10.x.x.x) and 24 bits (IP addresses are 32 bits, 8 bits are already used for network; 32-8=24) for the machine number (the x.15.53.45)
So now, for '192.168.0.0/16'. The 192.168 part is the network part, and the '/16' means the last 16 bits are used for hosts. When the slash-number is larger, that means the person with that IP range has less IPs.
I really hope this helps, sorry I'm not the greatest at explaining things.
:wq
It's to seperate the bitmask. An IPv4 address is 32 bits long, in big endian order (biggest value goes first, like our decimal system). The /XX is simply an abbreviated way of writing a subnet that starts with n 1's and ends with 32-n 0's. For instance, 10.0.0.0/8 means the 10.x.x.x network with a subnet mask of 255.0.0.0. 192.168.0.0/16 means the 192.168.x.x network with a subnet mask of 255.255.0.0. 192.168.123.128/26 means the 192.168.123.[128 to 192] network, with a subnet mask of 255.255.255.64.
Almost always, if written in binary, subnets will look like a bunch of ones, then a bunch of zeros. Sometimes, it's convenient to have a subnet that does *NOT* designate a contiguous network segment. For instance, you might have 192.168.2.[64 to 127] and 192.168.3.[64 to 95]. In this case, this is a network 192.168.[2-3].[64-95] with a subnet mask of 255.255.253.32 (which can't be represented in the / form). Don't try this though, as certain buggy OS's might get confused.
He who laughs last is stuck in a time dilation bubble.
Uhh, the whole point of NAT is that the numbering scheme you use inside your private network is completely shielded from other networks. If you use 10.0.0.0/8 for your own small LAN that's behind a NAT gateway it won't matter one squat what numbering scheme is used anywhere else, since the gateway -translates- between them, hence "network address translation."
192.168.0.0/16 certainly does exist. The first three bits has not dictated the netmask for years. See RFC1817 for more information on this. Here's a relevant excerpt (emphasis added):
172.22.0.0/24 where I work;
172.22.0.0/16 and 172.16.0.0/16 in one of the clients;
192.168.200.0/24 at home;
192.168.0.0/24 on another client;
10.1.0.0/16 where I study and work;
10.1.1.0/24 on lan games;
\m/
Your home network is 192.168.0.0/24. Your work network uses the same address space. From your home computer, you VPN into your work network. Now, try to copy a file from your fileserver at home to your fileserver at work.
Yeah, NAT sure does work great, doesn't it!
It's always a long day... 86400 doesn't fit into a short.
If you are talking about a 'large-ish' local network then splitting 10/8 into smaller blocks looks pretty good on paper. You can split it into /16s and delegate those to departmental level net admins who will then divide them into /24s for individual VLANS. It helps if you do a big plan upfront. This way if let say you know that HR, accounting, and marketing are restricted to one site you can assign them a glob of /16s that you can summarize on the routers to keep the routing tables nice and small. You can also assign ranges to classes of machines. For example if you knew that all your 'all company' web servers lived in the 10.10.10/24 range and the Citrix farm that fronts for your HR system lived in the 10.10.11/24 range and you had a subnet with users that just needed access to the HR system and the 'all company' web servers you could write a quick acl to permit http and https to 10.10.10/24 and ica to 10.10.11/24. This is a lot easier that consulting your IP database and looking up the IPs of all the web servers and all the HR Citrix boxen and crafting a nasty long ACL. :P
Now, if you're just talking about your home LAN it prolly doesn't matter what you use. If you're planning on VPNing into your work network life will be easier if you pick a range that doesn't overlap with any of the RFC1918 addys they use.
As for the people who are suggesting that if you have a large network you need to pick ranges that don't overlap with networks you plan to interface with, I wouldn't worry too much. Most companies that interface with with other networks on regular basis have ranges of 'legit' IPs that they use for extranet connections. Or they're used to playing the firewall NAT game. Doing the "network to firewall/NAT to outside agency firewall/NAT to outside agency network" thing usually isn't that bad. People get good at it after while. Once you've done a few it'll be just another annoyance.
We've traced the troll, and... it's coming from inside Slashdot! Get out of Slashdot now!
Alternately, nat allows a natted ipaddress to be natted again and again. So you could setup a 192.168.1.x network then each 192.168.1 consists of 192.168.0.x networks. That should give you about 255 * 255 or 65025 ip addresses to play with. It would be interesting to know if it worked and you have a 192.168.0.1 address that gets natted to 192.168.1.1 and gets natted again to then to your public ip address.
I think the 10's give more addresses without double natting so it depends on how much you expect your network to grow.
Only 'flamers' flame!
Does slashdot hate my posts?
This probably presents the advantage of:
- Preventing waste of relatively precious IP space.
- Protecting the DHCP server from the internet, since packets outside my ISP network will not be routed to it.
just my[Pruneau
Why?
Yes, click the link in his sig... talking about how IE is not a Web Browser... He significantly misquotes an RFC
I have mod points and I am not afraid to use them
On the 17th day of February, in the year of our Lord 1600, I was born a highlander. I am Colin McLeod of Clan McLeod and I cannot die.
I've had to work with some firmware where a ip address in the 10.x.x.x range was burned into firmware for the out-of-band port. (that is a ehternet port intended only for use with a crossover cable direct to a laptop for techs to debug with) Using that device on a 10.x.x.x network didn't always work. We did burn firmware for large customers who used the 10.x.x.x networks, but we didn't like it.
The only sane way out of this (aside from looking at the Windows VPN Client Source and posting a patch to the group... oh.... yeah, not open source)... is to use the ONLY available /8 address out there for a VPN server... 10.0.0.x/8.
It's only caused one conflict, but it's far safer than the original instance, in which the VPN clients suddenly thought the entire 66.x.y.z address space was on our wire. This caused no end of problems and complaints because the users then couldn't make use of their ISP's 66.?.?.? services. Think about this, it shuts off 1/2% of the internet at random
--Mike--
10.x.x.x/24.
I've inherited a couple of networks like that and when other IT types like consultants, etc... and I start discussing addressing detail I feel compelled to tell them that *I* didn't choose the 10.x.x.x/24 - I inherited it.
I promise!!
Does this mean I'm insecure????
Sigh.
You need people like me so you can point your fucking fingers, and say "that's the bad guy."
I work for a large un-named company with a very large WAN (both private frame relay and software VPN tunnels over the internet), with VPN connections to outside companies.
/16 for our central office LAN, with the third octet used to distinguish between groups. 10.10.1 and 10.10.2 are our primary central servers and computer room equipment, and most of the rest are by department.
/24s.
Cisco-trained people, who have IP conservation drilled into their heads early on, almost drop dead at our lack of conservation. When I designed all this mess, I was trying to keep addresses 'logical'...as stated above, using department numbers and the like to help out the others on our staff that aren't the least bit network -savvy.
Internally, we use 10/8. We use a large
For our WAN, I used layered steppings. 10.220 between routers, 10.120 between routers and a back-office server in each location, and 10.20 for a back-office network handled by that server. The third octet here is our store number. All of these are
We connect with our software vendor, who runs an ASP for some of our customer stores. They use a 172.16/12. I worked out a similar 'layering' method for the remote systems there as well.
The only conflict we've come up with is another company we need to connect to also uses 10/8 for their network. We had to use a pair of Cisco VPN concentrators to do the double-translation to setup a tunnel between us. Fortunately, we only need access to a single system on their side, so it's not a major point.
DHCP isn't used at all in our organization. Once upon a time, someone higher-up was convinced (somehow??) that DHCP was inherently completely insecure, and we were just begging for trouble by using it. We aren't wireless, we're 100% hard-wired. The only issue is that the firewall I run is setup to allow internet access only for specified addresses. DHCP is simply a matter of maintenance, so I'm going to push it on, now that this misunderstanding has been corrected.
Also, we use the 192.168/16 block for people's home networks that connect via a VPN connection. There are only a couple of us, so this isn't much of an issue.
I use the 10.0.0.0 network on all my machines from home. I tend to keep the numlock turned on, and I can type, for example, the IP address 10.0.0.42 on my keypad much faster than, say, 192.168.0.42.
The Davis Joint Unified School District uses it on thier WAN (12 schools, and 15 T1s) (or is it a MAN?)
:-)
They use 172.26.0.0/16
I have a big map of all thier windows hosts and drive shares from 2002 sitting on my laptop.
I think that what he's talking about is that IE seems to always try to guess the type of a file by it's extension, but it is only allowed to to that if there's no explicit content type. This makes IE broken (shock, shock), but I wouldn't say that makes it into 'not a browser'.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
On second thought, the most appropriate place to respond t his web browser comment would have been on his journal page -- not an unrelated article..
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
This will 'black hole' all of the crap that you get from @home and roadrunner zombie worms. Unless of course you're on one of these networks...
A good scheme for the 10 network is to split it into class B's for large locations and class C's for smaller locations as such:
10.X.
where X is the location number 1 for new york, 2 for LA, 3 for hamburg, etc.
10.1.Y
where Y is 0 for routers/network devices, 1 for servers, 2 for remote access, 3 for static addresses, and 4-10 for DHCP addresses. 11-254 (255) are reserved for future use.
Then use 192.168 addresses for individually firewalled segments within the 10.x structure, and 172 addresses for data center stuff like mainframes, backup boxes, secret gigabit backbone links, etc.
Of course this all gets kind of complicated especially for a small home network with less than a dozen active devices, so you can pop over to arin and find a netblock that isn't assigned or in use and then have a 'designer' internal network number. Works great until some major provider gets the netblock... What the heck -- you're behind a NAT box right? 1.2.3.X here we come!
"But actually trying to use m4 as a general-purpose langage would be deeply perverse" --ESR
It's too late at night for me to actually look it up. For some odd reason, I thought 10.x.x.x got reassigned to cable providers but seems to be exclusivly used on their routers.
Personaly, I use 10.x.x.x simply because it's less keystrokes when I want to ping something.
However, your actual choice should be based on the your needs, for example, many items such as network modems have assigned to them an ip address, and it's nice to be in their range so you can check up on them.
As long as you choose something, document it, it's cool.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
The correct answer to this question is RTFM. If you have to ask this question, you're not competent to plan out a large network.
On another note. Routers seem to default to Class C, and might not be changeable. Windows defaults to Class B, but is very changeable. Class C, however, is by far the most common. So, for compatibility in a small company, i'd use Class C, and switch to class A (and make a good plan) you you start to have decents networks in more than one location.
Have you read my journal today?
Don't be a poofter. Use IPV6.
It doesn't matter what address you use on your internal network, so long as you use NAT. You can pick ANY valid IP address; anyone you connect to will only see the external address, not the internal network address range.
Every company in the world could use the same internal address range, and return all their privately held addresses. They only need:
(number of externally visible servers / 65535)
Internet visible addresses. For most every company in the world, that's just one address.
Many companies (especially the larger, older ones) use "real" adddresses internally, for historical reasons. Many have also switched to DHCP, which would make giving up those addresses easier. Why does the printer in the corner that is only accessible to the local net need a unique Internet address?
Unfortunately, IP addresses are like spectrum; once a company has them, it's a corporate resource. The idea of giving them up (without compensation) is insane.
Can You Say Linux? I Knew That You Could.
Management of your IP space is extremely important, if you are working in an environment that has more than a few sites/divisions/business units, etc. There is a lot of good information available about IP network design. Overall, the guiding principle is this:
/24s (or larger) for campus or business units, and 192.168.x.x /25-31 blocks for WAN links, point to point, etc.
Reasonably estimate how many hosts will ever exist on a subnet, and use the RFC1918 netblock size that will best handle the hosts, and predicted expansion.
For example, don't use 10.0.0.0/8 for your local LAN if you only have 20 machines. Decisions like this will come back to haunt you, especially if your organization starts developing a need to have routed links to vendors/remote sites/etc.
With CIDR you can easily slice and dice your IP subnets allocations into correctly sized networks for the intended purpose. In very large enterprises, I've used 172.16/12 blocks broken down into
10/8 is something we stay away from, due to so many bad vendor documents that suggest that 10/8 is the preferred way to configure everything. A good example is MS Windows server clustering. Following the MS config documentation "to the letter" will result in the cluster blackholing 10/8. The documentation that accompanys this product instructs the user to configure the "cluster hearbeat" network connection (generally 2 hosts) using 10.0.0.0 with a Class A subnet mask. This means that the clustered servers will *never* be able to talk to any other host using a 10-net address. Digging a little further into the maze of MS documentation one will find articles on proper IP address allocation for hearbeat connections, but the MCSE Rocket Scientists that I deal with apparently didn't read past page 1. They decided that because the heartbeat was a "private" network they could just go ahead and allocate any IP range, and it would not affect the server's ability to communicate. DOH!
Anyway, in general, if you concentrate on efficiently allocating your private IP space you will have far fewer headaches in the future. I've heard plenty of stories about people having to re-engineer idiotically designed 10/8 networks, but I can't ever recall hearing someone complain about how hard it is to fix a routed 192.168/24 network.
If you want something that's REALLY fast to type, there's also 1/8 (1.x.x.x)
/8 adresses if you search the IANA whois database (http://ws.arin.net/cgi-bin/whois.pl)
It's reserved by the IANA and currently not in use. Plus, it gives you the pleasure of not using official IP addresses.
In fact, there are many unused
The same can be said for pretty much any of the internal network addresses. You might change jobs and they'll use 192.168.88.* for their internal network.
A few months ago I changed my network to 192.168.2.* for this reason -- because work used 1.*. My coworkers also changed their networks for the same reason, each of us picking various numbers randomly (one moved to 10.0.0.*). My cubemate changed to 100. Apparantly TechOps got tired of people having problems when VPN'd in though, so they decided to change all the network IPs as well. To 192.168.100.*. My coworker was annoyed.
A lot of stuff comes preconfigured to use 192.168.1.* though, so no matter what you change your network to, be sure you know enough to change it back when needed. If you ever need to flash the firmware on the device or reset it to factory defaults you'd better be able to talk to it to change it back to whatever address range you actually want.
This is the default for NeXTstep---any explanation / history behind it?
I've deja-googled, but not found much which explains this....
William
Sphinx of black quartz, judge my vow.
Call me lazy or efficient, but I like being able to use the shorter address.
Most routers can be configured for what DHCP block they will give out, even if the router is a 192.168.x.x address.
A simple, straightforward basic answer to the question, without delving into the technopaedic minutiae that would no doubt needlessly confuse the questioner. Thank you.
Now, what the hell are you doing on slashdot?
-- "Never underestimate the power of human stupidity." - R.A.H.
Genesis 7:11 - And on the 17th day of the second month of the 300th year of Noah's life, the rains began to fall.
It's cool to have your birthday mentioned in the bible, you know, like that other guy.
I'm a fan of 192.168, but my school something like has thus:
Main server 90.0.0.0
Room 1 main: 90.0.1.0
Room 1 boxes: 90.0.1.*
Room 2 main: 90.0.2.0
Room 2 boxes: 90.0.2.*
Room 3 main: 90.0.3.0
Room 3 boxes: 90.0.3.*
Is this scheme phuX0red, or some netware specific thing? It's been buging me for a while, so any explanations appreciated...
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
You can use any one of the 255 192.168.x.0/16 networks or group them up into a 192.168.0.0/24 network. Or you could grab a /16 some where in 10.0 and subnet it to a smaller network.
Subnetting has been completely divorced from classes for about 10 years now.
I have discovered a truly marvelous sig, unfortunately the sig limit is too small to contain i
My router defaults to 192.168.0.*. .1 for the router, .100+ for clients. My DSL modem (built in router, but a hub won't work with it - it's locked down to one DHCP client) uses 192.168.1.1 for itself, and 192.168.1.2 for the client.
I use 10.0.0.0/8 at home just because it's really easy to type. The subnet I keep most of my machines in is 10.0.0.0/24, and my DMZ is 10.1.1.0/24. I give out IP's within them like this: 10.x.x.1-9 is routers 10.x.x.10-19 is computers with static IP's 10.x.x.20-99 is the DHCP range 10.x.x.100-109 is network stuff that will do DHCP 10.x.x.110-199 is servers 10.x.x.200-254 is other stuff like VMware virtual machines This is just perfect because I can type any commonly-used IP on my home LAN using just the 0, 1, and period keys. My router is 10.0.0.1, main rig is 10.0.0.10, computer on the other end of the house is 10.0.0.11, wireless AP is 10.0.0.101, file server is 10.0.0.110, web server is 10.1.1.110, and backup server will be 10.0.0.111. I'm even lazy when I type. Or efficient, depending on your viewpoint. ;-)
Work network is 192.168.2.0/24, because that's what the guy who set it up used.
If I set up a network for someone else, I just use the default IP range on their router, which usually ends up being 192.168.0.0/24, and all other reasonable defaults, to make it easy to work on and makes a "reset to defaults" much less painful. Of course, I change stupid defaults: I turn off remote configuration if it's on, change the admin password, etc. If it's wireless, then I turn WEP on to its highest setting, change the SSID, turn off SSID broadcast, filter by MAC address, and whatever else I can do.
It's an operating system, not a religion.
Oops, I forgot to change "HTML Formatted" to "Plain Old Text" again. And I forgot to preview, too. Sorry. Here's what it should've looked like:
;-)
I use 10.0.0.0/8 at home just because it's really easy to type. The subnet I keep most of my machines in is 10.0.0.0/24, and my DMZ is 10.1.1.0/24. I give out IP's within them like this:
10.x.x.1-9 is routers
10.x.x.10-19 is computers with static IP's
10.x.x.20-99 is the DHCP range
10.x.x.100-109 is network stuff that will do DHCP
10.x.x.110-199 is servers
10.x.x.200-254 is other stuff like VMware virtual machines
This is just perfect because I can type any commonly-used IP on my home LAN using just 0, 1, and period. My router is 10.0.0.1, main rig is 10.0.0.10, computer on the other end of the house is 10.0.0.11, wireless AP is 10.0.0.101, file server is 10.0.0.110, web server is 10.1.1.110, and backup server will be 10.0.0.111. I'm even lazy when I type. Or efficient, depending on your viewpoint.
Work network is 192.168.2.0/24, because that's what the guy who set it up used.
If I set up a network for someone else, I just use the default IP range on their router, which usually ends up being 192.168.0.0/24, and all other reasonable defaults, to make it easy to work on and makes a "reset to defaults" much less painful. Of course, I change stupid defaults. I turn off remote configuration if it's on, change the admin password, etc. If it's wireless, then I turn WEP on to its highest setting, change the SSID, turn off SSID broadcast, filter by MAC address, and whatever else I can do.
It's an operating system, not a religion.
The broadcast address is defined as the bitwise inverse of your netmask logically ORed with your IP address.
More accurately, the broadcast address is that network address with the host field assigned a value of all 1s. Since the host field in an IP address is in the low-order bits, and since netmasks are a contiguous string of 1s followed by a contiguous string of 0s, this is equivalent to the statement I made above.
Lots more detail in RFC 917.
--JoeProgram Intellivision!
OK, you're right. But that's the second time today I've had the gameshow thing thrown at me, and I do believe I'm tired of it! :(
I guess this is your lucky day! ;-)
Would you like to see what's behind door #2?
(Ok, so I'm feeling like a bit of a smart-ass right now. Blame it on the scotch.)
--JoeProgram Intellivision!
What does that say about the upkeep of HP-UX over the years!
If you need Scotch to be a smartass, you're the only one on Slashdot!
I know of a school which use 172.16 for their dorms and that's also the network range we used for the PDC LAN Party 3 (200-300 ppl).
No GNU has been Hurd during the making of this comment.
Network of champions. I used to have a 10.x network, which was far easier to type, but I was having all kinds of problems connecting to the VPN at work. After about 5 minutes, I said fuck it, and changed it over to 192.168.
More than a hundred PCs on the same network segment and you are looking for big trouble and slowness from broadcast storms.
Go for Variable Length Subnet Mask and deploy VLANs containing not more than 40/60 clients each.
Use DHCP-assigned 10.0.0.0/24 subnets.
This way you can even aggregate subnets for wan or site-to-site routing.
Example:
Site-1 / VLAN-1 > 10.1.1.0/24
Site-1 / VLAN-2 > 10.1.2.0/24
Site-1 / VLAN-3 > 10.1.3.0/24
Site-2 / VLAN-1 > 10.2.1.0/24
Site-2 / VLAN-2 > 10.2.2.0/24
Site-2 / VLAN-3 > 10.2.3.0/24
Site-3 / VLAN-1 > 10.3.1.0/24
Site-3 / VLAN-2 > 10.3.2.0/24
Site-3 / VLAN-3 > 10.3.3.0/24
Site-1 as a whole is seen as 10.1.0.0/16
Site-2 as a whole is seen as 10.2.0.0/16
Site-3 as a whole is seen as 10.3.0.0/16
On topic (to at least contribute something):
I'm of the mind you should use the proper IP range for the network you have. I've got a home network with 6 machines on it at present that sees an extra host or two when friends bring their laptops over and maybe an additional 4-5 when I'm playing with VMware extensively. Work uses 10/8, and even if my network grows tenfold I won't exhaust the space available in 192.168.0/24, so I use that.
Of course, in the event my situation changes, I could re-IP this dinky network in under five minutes. This is a little bit more of a danger for me using 0 than for people who choose a random number as the third octet, but I don't lose sleep over it. Shit happens.
Ultimately the right IP range to use is the one that gets your network working before you get fired (that sounds remarkably similar to something out of the Camel Book). There's always going to be a chance you're going to need to re-IP because of network growth or need to communicate with someone using the same space as you. Make an educated guess at the growth and changing of your network over the next few years and pick the range that fits it, or a larger one if that suits you. Or just use 10/8 and be pretty damn sure you won't run out of space. Of course, if you know you're going to need to hook up with someone else's network, it might not be a bad idea to ask them what they use while you're designing your own network.
Off topic:
The excerpt quoted in his journal does, in fact, point out IE's RFC ignorance w.r.t. HTTP/1.1. The RFC states that the server SHOULD send a Content-type header. This means, if you're a lazy implementer, that your server doesn't HAVE to send this header. In the event that a user agent encounters such a server, and only in that situation, it may attempt to use other methods to determine the content type of the document.
Since IE does this even when the server DOES include a Content-type header, IE's HTTP/1.1 implementation is broken.
Of course, the poster is also wrong, since he states that all web browsers must implement HTTP/1.1. Of course, HTTP/1.1 is not the first iteration of HTTP, and there are many browsers that predate it. They are, however, most assuredly browsers in every sense of the word.
IE is a browser, just a fairly braindead one.
Game... blouses.
llalalalalalalalllalllallla a lalallallalalal
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Cambridge, Ma school department uses 172.25
the city uses 172.24, and the hospital uses 172.26
Stop over-analyzing your analizations
If you're not going to have more than ~250 hosts per segment or more than ~250 segments, I've generally taken the approach of "pick a random number R in 21..250 for the second octet, and create a bunch of 10.R.*/24 subnets" - it makes it easy to merge with other networks later on. (As when my department's lab got merged with several others - didn't have to renumber anything because nobody else was 10.116.*)
We did pick one 10.X.Y.* range to split up into /30 subnets for virtual circuits between labs, but that's the only VLSM we messed with. And little LANs that are sure to get NATted by appliances still get to be 192.168, and the couple of routers that look like the Cisco CCNA certification book lab are 172.16 because it's for training.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
24, 25, and 26. Obviously, they were all put together by the same people....
Free Software: Like love, it grows best when given away.
Has one advantage. The primary server is 172.30.0.30
It's also obscure enough that it's unlikely to clash with anyone elses LAN.
Assuming the netmask is 255.255.255.0.
If the netmask is anything from 255.0.0.0 through 255.255.254.0 inclusive, his 10.0.0.255 would be perfectly valid.
If the LAN was small and lightly loaded he would probably be quite survivable even sitting on the broadcast address.
Typically, 192.168 is used in consumer grade equipment. Let's face it - not many home networks need a lot of IP's, and those few that do don't really need to worry about route summarization. The 172.16 block is usually used in a small to medium business that would have multiple locations and more devices than a typical home network. Route summarization may or may not be used, or needed.
:).
The 10. block is used in large networks both because of the number of available addresses and because it allows you to do some cool things with route summarization on a large WAN infrastructure. Route summarization reduces route table size, processor load, and overall complexity in the network, which are all good things
Say I have a building that has 18 wiring closets in it. I could build the network in such a way that each wiring closet is a VLAN. Each VLAN gets it's own, unique IP Network.
If I needed to, I could have multiple VLANs in the closet based on departments, job functions, or almost any other criteria. Assume I've built two VLANs in each closet, for a total of 36 VLANS, at least. I may have other VLANs dedicated to servers, routers, firewalls, etc.
If I have 192 ports built into each closet, planning for worst case, and make sure I have at least 192 addresses available in each of my 36 VLANs. I'd have to remember to add to the count for a router/gateway address, and any growth I could anticipate in that closet.
If I plan to add additional ports, or think it's a possibility, I might want to add another 192 addresses to the network. It's a &$*%^ to come back and re-address later - invariably there will be some mission critical device no one documented that has a static address, under someone's desk.
Based on these numbers, I'd need at least 386 addresses. Since 2^8 is only 256 addresses, I need to go to 2^9 (512 addresses).
I count bits from right to left, and I see that to have the nine bits of host address, I need to use a 23 bit network mask (32-9=23 bits of network mask).
Now remember I have two VLANs in each closet, and to make things easy, I'll build them both to my worst case scenerio. I'll need a 23 bit network for both.
Given that I've pushed my Layer 3 to the edge, I could advertise both 23 bit networks back to the core. However, if I used contigous 23 bit networks, I could also summarize them into a single 22 bit route to be advertised towards the core.
This means my core would only need to have 18 routes to route traffic to all 36 VLANs.
If you scale this approach across a WAN, you can see summarization allows you to simplify your routing and control over the network.
Sig??? I don't need no stinkin Sig!
My Scots ancestors would be rolling in their graves if the knew I was wasting over sixteen million addresses! I'll stay with the thrifty 192.168.x.x, thanks, and save the rest for a rainy day.
I refuse to believe corporations are people until Texas executes one. -- desert rain on http://www.dailykos.com/user/
At home, I use 10.*, but I chose the subnet that I wanted. So it is easy to remember 10.11.12.*/24 and there is not a string of zeros.
Like pi? Try 10,000 digits.
no need for a subnet on my home LAN, nor a VPN at this point. The home net: 192.168.2.0 (it's .2.x because the guy who gave me a linux router setup 2 years back had his lan as .1 and set the software as .2, never bothered to change to 1 *shrug*)
Router: 192.168.2.254 (top, easy to remember)
Server: 192.168.2.200 (easy to remember)
DHCP address space: 201-253
Static share box (runs all dem nasty file sharing programs, must be addressable drectly from the firewall) .100
i used 10.x for awhile (easier to type) but then the router changed and it was easier to change 2 static boxes than the entire networking config of the router (shorewall, local net, DHCPD, etc).
Logistical Chaos Officer http://www.slagg.org - LAN Gaming in Sarasota FL,USA