Why a /16 Network with 65,534 Addresses Is Often the Wrong Design — Broadcast Domains, Segmentation, and VLSM

A /16 subnet provides 65,534 usable host addresses — enough for a large enterprise — but deploying one flat /16 network instead of multiple smaller subnets means every broadcast reaches 65,534 devices, every ARP storm affects the entire network, and a single misconfigured DHCP server can bring down the whole address space

The previous articles on this site covered subnet calculation basics, CIDR notation and practical network design, cloud VPC design, IPv6 address types, and subnetting math. This article addresses network segmentation strategy — specifically why large flat networks are an operational and security problem, and the principles that guide real-world subnet design decisions.

The broadcast domain problem: why flat networks don't scale

In an Ethernet network, a broadcast is a frame sent to the MAC address FF:FF:FF:FF:FF:FF — received and processed by every device on the network segment. Every device must examine every broadcast, even if it's irrelevant to that device.

Why broadcasts exist: ARP (Address Resolution Protocol) uses broadcasts — "who has IP 192.168.1.50? Tell me your MAC address" is sent to all devices because the sender doesn't know the MAC address yet. DHCP discovery uses broadcasts. Various network services use broadcasts.

The scale problem: in a /16 subnet (65,534 hosts), a single ARP request is processed by all 65,534 devices. If devices make ARP requests at even modest rates (a few per minute), the aggregate broadcast traffic can consume meaningful network capacity and CPU on every device.

The solution: subnetting reduces broadcast domain size. Dividing the /16 into sixty-four /22 subnets (each with 1,022 usable hosts) means each broadcast reaches only 1,022 devices instead of 65,534. Routers don't forward broadcasts — they define the boundaries of broadcast domains.

Security segmentation: why different trust zones need different subnets

A flat network where all devices are on the same subnet means:

• Any device can communicate directly with any other device (no routing, no firewall policy at the network layer)
• A compromised device can reach any other device directly
• Network traffic from guest WiFi reaches internal servers

Proper segmentation separates trust zones:

• Public DMZ subnet: web servers, publicly-accessible services. Reachable from internet; limited access to internal network.
• Internal application subnet: application servers. Reachable from internal users; limited access from DMZ; access to databases.
• Database subnet: database servers. Reachable only from application servers; not directly from users or internet.
• Management subnet: infrastructure management (monitoring, backup, admin access). Strictly limited access.
• User subnet: workstations and user devices. Access to applications; no access to databases directly; no access to management.

Firewalls and security groups (in cloud) enforce policies at subnet boundaries — "only traffic on port 5432 from the application subnet is allowed to reach the database subnet" is a network-layer policy that can't be bypassed even by a compromised application server without also controlling the firewall.

VLSM (Variable Length Subnet Masking): right-sizing each segment

Fixed-size subnetting (dividing a network into equal /24s or /25s) wastes addresses when segments have different size requirements:

• A point-to-point WAN link between two routers needs only 2 host addresses → waste if allocated a /24 (254 usable addresses)
• A server subnet might need 50 addresses → waste if allocated a /24

VLSM allocates subnet prefixes proportional to the actual need:

• Point-to-point link: /30 (2 usable addresses, plus network and broadcast) or /31 (RFC 3021, uses network and broadcast addresses, no traditional "host" concept)
• Small server subnet: /26 (62 usable addresses)
• Large user subnet: /22 (1,022 usable addresses)

The planning approach: list all segments and their maximum host counts; allocate the smallest prefix that accommodates each; arrange allocations to leave contiguous free space for future growth.

Private address ranges and RFC 1918

RFC 1918 defines three private IP address ranges that can be used freely within private networks (they're never routed on the public internet):

Convention: home routers typically use 192.168.0.0/24 or 192.168.1.0/24. Enterprise networks typically use 10.x.x.x (the largest range, giving flexibility for complex subnetting). AWS VPCs support all three ranges; the 10.0.0.0/8 is typically used for large deployments that need to avoid RFC 1918 conflicts when connecting multiple VPCs.

Subnet calculator outputs: what each value means in practice

For a subnet like 192.168.10.0/24:

Network address (192.168.10.0): the subnet's identifier — not assignable to any host. Used in routing tables to refer to the entire subnet.

Broadcast address (192.168.10.255): reserved for broadcasts to all hosts in the subnet — not assignable to any host.

Usable host range (192.168.10.1 – 192.168.10.254): the 254 addresses that can be assigned to devices.

Subnet mask (255.255.255.0): the binary representation of the prefix length — 24 consecutive 1-bits followed by 8 0-bits. Used in older subnet calculations; CIDR notation (/24) is now preferred.

Number of usable hosts (254): total addresses (256) minus 2 (network + broadcast).

How to use the Subnet Calculator on sadiqbd.com

1. For network planning: enter your allocated address block and intended prefix length to see the host count — then compare against your actual device count per segment, adding a growth buffer (typically 20-50%)
2. For VPC design: AWS and other cloud providers require that VPC subnets don't overlap; use the calculator to plan non-overlapping subnets within your VPC CIDR before creating them — fixing subnet overlaps after creation is disruptive
3. For IPv6: enter the IPv6 network and prefix length — typical IPv6 subnets are /64 (18 quintillion addresses per subnet), with the /48 or /56 allocated by ISPs subdivided into multiple /64s

Frequently Asked Questions

Why does my /24 subnet give 254 usable hosts instead of 256? Two addresses in every subnet are reserved: the network address (the lowest address, all host bits = 0) and the broadcast address (the highest address, all host bits = 1). For a /24, you have 2^8 = 256 addresses total, minus 2 reserved = 254 usable. This applies to every subnet size: a /25 has 2^7 = 128 addresses minus 2 = 126 usable; a /30 has 2^2 = 4 addresses minus 2 = 2 usable (just enough for a point-to-point link). The formula is always: 2^(32 - prefix length) - 2 for IPv4. For /31 subnets (RFC 3021, used on point-to-point links), the convention is relaxed — the 2 addresses are used as host addresses with no traditional network/broadcast distinction.

Is the Subnet Calculator free? Yes — completely free, no sign-up required.

Try the Subnet Calculator free at sadiqbd.com — calculate network address, broadcast, host range, and usable host count for any IPv4 or IPv6 subnet.