0

I am supposed to add validations to my software UI (IP Subnet UI) which allows the user to enter a pair of IP addresses and subnet masks. I am supposed to make sure that two network interfaces are not configured in the same subnet.

My understanding is if I perform a a Bitwise AND between IP Address and subnet Mask, I will get a network ID and if N/W IDs are not same, would that be sufficient to claim that two network interfaces are not in the same subnet?

This question is limited to IPV4.

2 Answers 2

1

You need to mask the two addresses with the same network mask in order to determine if the network is the same. You need to use the shortest network mask for the comparison. This is how you determine whether or not both addresses are in the same network.

The procedure is exactly the same for both IPv4 and IPv6, except for the address and mask sizes.

For example, 10.0.0.0/25 and 10.0.0.64/26 will retrun the same network with the shortest mask (255.255.255.128), but will return different networks with the longest mask (255.255.255.192) even though the second network is a subnet of the first network, so any addresses in the second network fall into the first network.

With the shortest mask:

       10.0.0.0 -> 00001010000000000000000000000000
255.255.255.128 -> 11111111111111111111111110000000
            AND -> ================================
                   00001010000000000000000000000000 = 10.0.0.0

      10.0.0.64 -> 00001010000000000000000001000000
255.255.255.128 -> 11111111111111111111111110000000
            AND -> ================================
                   00001010000000000000000000000000 = 10.0.0.0

With the longest mask:

       10.0.0.0 -> 00001010000000000000000000000000
255.255.255.192 -> 11111111111111111111111111000000
            AND -> ================================
                   00001010000000000000000000000000 = 10.0.0.0

      10.0.0.64 -> 00001010000000000000000001000000
255.255.255.192 -> 11111111111111111111111111000000
            AND -> ================================
                   00001010000000000000000001000000 = 10.0.0.64

With the assigned masks:

       10.0.0.0 -> 00001010000000000000000000000000
255.255.255.128 -> 11111111111111111111111110000000
            AND -> ================================
                   00001010000000000000000000000000 = 10.0.0.0

      10.0.0.64 -> 00001010000000000000000001000000
255.255.255.192 -> 11111111111111111111111111000000
            AND -> ================================
                   00001010000000000000000001000000 = 10.0.0.64

As you can see, only the example using the shortest mask actually returns the correct answer that the second address is in the network of the first address.

9
  • Could you please add an example, to help me understand the meaning of shortest network mask for the comparison please. Jul 14, 2017 at 20:12
  • Thanks, another silly question is there any valid range of Subnet mask. I mean to ask, should I even allow a user to enter any value(32 bit) in a Subnet mask field. Please refer the attached image in my question to visualize my UI. For example in my use case user can enter IP as 10.151.28.39 and subnet mask as 17.63.59.89(I made up one and have no clue whether this is even a genuine subnet mask) Jul 14, 2017 at 20:26
  • Really, a network mask should not be shorter than /8, except under extraordinary circumstances (one exception is the default network mask of /0, which will turn any address into the default route of 0.0.0.0/0), but even the longest possible mask /32. has its uses for things like loopbacks.
    – Ron Maupin
    Jul 14, 2017 at 20:30
  • I was reading somewhere else just now and found out that a valid subnetmask, when written in binary, has to consist of only consecutive 1's and then 0's, but no intermittent mixing. So my example of subnet mask is basically invalid, wouldn't you agree? Which means I should probably not even go to the bitwise AND if such subnet mask is entered by the user, what say? Jul 14, 2017 at 20:40
  • In practical terms, to work correctly, a network mask must start with consecutive one bits from the left, and consecutive zero bits from the right. The original specification allowed for non-consecutive bits, but that no longer works today with CIDR. The number after the slash in CIDR notation is the number of consecutive one bits, with the following bits set to zero. You could consider to also allow a CIDR address in the address field, and automatically fill out the mask field from that. This can be useful since many things now only list CIDR notation, and not the explicit mask.
    – Ron Maupin
    Jul 14, 2017 at 20:45
0

First off, you really only need one subnet mask entry, since they shouldn't be put on the same subnet if they have two different masks. But beyond that, yes, you AND the addresses with the mask, and if you get the same result, they're on the same subnet.

1
  • Thanks for the response @theglossy1. Even though I determine subnets are different there is a chance of them being in the same network, how do I make sure they are not. Please guide. Jul 14, 2017 at 20:15

Not the answer you're looking for? Browse other questions tagged .