So "Ulrich" was having trouble bringing networking up, and he showed me his network parameters:
ip address: 10.53.10.121
default gateway: 10.53.0.1
netmask: 255.255.255.0
Yow! That will never work, because the netmask won't let him get to the default gateway!
What does all this stuff mean, how could anyone tell, and more importantly what is the correct netmask to use?
Here's a little theory, then I'll give you the lazy man's way. The IP address is a sequence of 32 bits, represented usually as four 8-bit bytes rendered in decimal and separated by dots. When I want to send something to another "node", I compare its IP address with mine in conjunction with the netmask. If it matches, I just send it on my local LAN. If it doesn't match, I use the default gateway. (You can have other gateways, but for now we're just talking about the default gateway.)
Let's say that 10.53.10.121 wants to talk to 10.53.10.64, with the netmask 255.255.255.0 shown above. The comparison looks like this:
| address | bits
|
| 10.53.10.121 | 00001010 | 00110101 | 00001010 | 01111001
|
| 10.53.10.64 | 00001010 | 00110101 | 00001010 | 01000000
|
| difference? | -------- | -------- | -------- | --XXX--X
|
netmask
255.255.255.0 | 11111111 | 11111111 | 11111111 | 00000000
|
| after mask? | -------- | -------- | -------- | --------
|
So for 10.53.10.121↔10.53.10.64, the addresses, masked, result in no difference. So we will just send on the local LAN.
But if 10.53.10.121 wants to talk to 10.56.21.92, it looks like this:
| address | bits
|
| 10.53.10.121 | 00001010 | 00110101 | 00001010 | 01111001
|
| 10.56.21.92 | 00001010 | 00111000 | 00010101 | 01011100
|
| difference? | -------- | ----XX-X | ---XXXXX | --X--X-X
|
netmask
255.255.255.0 | 11111111 | 11111111 | 11111111 | 00000000
|
| after mask? | -------- | ----XX-X | ---XXXXX | --------
|
Even after masking, these don't match. So communicate with 10.56.21.92 we have to use the default gateway. But wait, is that possible? The default gateway is 10.53.0.1, so repeating the conversion and comparison yields:
| address | bits
|
| 10.53.10.121 | 00001010 | 00110101 | 00001010 | 01111001
|
| 10.53.0.1 | 00001010 | 00110101 | 00000000 | 00000001
|
| difference? | -------- | -------- | ----X-X- | -XXXX---
|
netmask
255.255.255.0 | 11111111 | 11111111 | 11111111 | 00000000
|
| after mask? | -------- | -------- | ----X-X- | --------
|
Even after masking, these still don't match. So we can't send to the default gateway just by sending to it on the local LAN. Instead we have to use a gateway--but waitaminute, this is the only gateway we've got!
What we must do is loosen up the netmask. If we change it to, say, 255.255.240.0, the result will instead look like this:
| address | bits
|
| 10.53.10.121 | 00001010 | 00110101 | 00001010 | 01111001
|
| 10.53.0.1 | 00001010 | 00110101 | 00000000 | 00000001
|
| difference? | -------- | -------- | ----X-X- | -XXXX---
|
netmask
255.255.240.0 | 11111111 | 11111111 | 11110000 | 00000000
|
| after mask? | -------- | -------- | -------- | --------
|
Behold! After masking, the addresses match, so the IP routing software knows it can send to this gateway.
In other words, the way to figure out a netmask that will work is to do a bit-compare between the IP addresses of the interface and of the default gateway, and see how long a netmask you need in order to mask off the differences. The optimal netmask may be shorter (255.255.224.0 or 255.255.192.0 for example), but this procedure ought to give you one that at least lets you get to the default gateway.
The lazy man's answer
Just run this little script, lines composed while riding the train, umm, like this:
% ./netmask.py 10.53.10.121 10.53.0.1
best case netmask is fffff000 or 255.255.240.0
% cat netmask.py#!/usr/bin/python -tt
# vim:et:sw=4
'''Given a list of IPv4 addresses, prints the longest netmask
that accommodates them all. Addresses can be in dotted quad
format (e.g. 192.168.0.1, all numbers <=255) or hex (7-8 digits,
optionally preceded by '0x' -- case is ignored).
USE AT YOUR OWN RISK. NO WARRANTY, EXPRESS OR IMPLIED.'''
import re
import string
import sys
def main(argv):
# addresses can be supplied in hex format or dotted-quad
hexpat = re.compile('(?:0x)?([0-9a-f]{7,8})$', re.I)
dqpat = re.compile('(\d+)\.(\d+)\.(\d+)\.(\d+)$')
FULL_MASK = 0xffffffffL # 32 bits
is_first = True
got_error = False # hope for the best
for an_addr in argv:
an_addr = an_addr.strip()
hexmatch = hexpat.match(an_addr) # Hex format?
if hexmatch:
# Yes! That was easy.
the_addr = string.atol(hexmatch.groups()[0], 16)
else:
dqmatch = dqpat.match(an_addr)
if dqmatch: # Better be dotted-quad
the_addr = 0
for a_comp in dqmatch.groups():
if int(a_comp) > 255:
# That's an illegal number
print '*** In "' + an_addr + '":', a_comp, '> 255'
got_error = True
the_addr = (the_addr << 8) + int(a_comp)
else:
print "*** couldn't" ' decode "' + an_addr + '"'
got_error = True
if got_error:
continue
if is_first:
# Initialize...
to_match = the_addr
the_mask = FULL_MASK
is_first = False
else:
# It's the (2nd or more) time through. to_match has the
# bits in common so far (possibly just the 1st address).
# the_mask holds the longest netmask that "works" so far.
# On entry: to_match & the_mask == to_match
# When loop is done: to_match & the_mask = the_addr & the_mask
while ((to_match & the_mask) != (the_addr & the_mask)):
the_mask = (the_mask << 1) & FULL_MASK
# Now re-establish entry condition
to_match = to_match & the_mask
# OK, now we've read all the addresses
if got_error:
# Don't process anything, just leave
print 'Not doing anything due to errors above'
sys.exit(1)
if is_first:
# Nothing to do
print '??? No IP addresses supplied.'
sys.exit(0)
# All good!
print 'best case netmask is', ('%08lx' % the_mask),
dqmask = `the_mask >> 24` + '.' + `(the_mask >> 16) & 0xff` + '.' + \
`(the_mask >> 8) & 0xff` + '.' + `the_mask & 0xff`
print 'or', dqmask.replace('L','')
sys.exit(0)
if __name__ == '__main__':
main(sys.argv[1:])
%
That's it! You can snarf'n'barf the shaded part above and save it to a file on your Linux/UNIX™/Mac™ computer. You might need to adjust the first line (it works on Mac OS X 10.4 Tiger). Don't forget to set execute permissions on the script.
Enjoy!
