On this page
01 Why models slip on subnet arithmetic
Language models predict text, and subnet plans are text that looks the same whether the numbers are right or wrong. The common failures are consistent: a subnet that starts on a boundary its prefix length does not allow, two subnets that overlap by one block, a broadcast address given as usable, and wildcard masks that are the netmask rather than its inverse. Each is easy to miss in review because the output is well formatted. This procedure, in the routing section, checks the numbers with tools. It complements the broader method for verifying AI-written configurations.
02 The check, step by step
List every prefix
Extract each network and prefix length from the plan into one list, including the parent block it was carved from.
Recompute with a library
Parse each prefix with a CIDR library, such as the standard ipaddress module in Python, in strict mode. A strict parser rejects a network address that is not aligned, which catches the most common error immediately.
Check containment and overlap
Confirm each subnet is inside the parent block and that no two overlap. Sort by network address and compare each end with the next start.
Recompute sizes and usable ranges
For each subnet, compute the number of addresses, the first and last usable host and the broadcast address, and compare with the plan. Plans often claim one extra usable host.
Convert wildcard masks back
For each ACL entry, turn the address and wildcard back into a range and compare it with what the entry was meant to match. A netmask pasted where a wildcard belongs matches far more than intended.
Test with addresses
Feed the ACL or firewall rule the first and last address of each intended range and one address just outside, in a lab device or a policy analysis tool, and confirm each result.
$ python3 -c "import ipaddress; ipaddress.ip_network('10.20.7.0/23')"
ValueError: 10.20.7.0/23 has host bits set
$ python3 -c "import ipaddress; print(ipaddress.ip_network('10.20.7.0/23', strict=False))"
10.20.6.0/23The first command fails because a /23 must start on an even third octet; the second shows the network the plan actually describes. In a VLAN plan, that single error puts two VLAN subnets and their gateways in the same address space.
03 The errors worth looking for
| Error | Example | How the check catches it |
|---|---|---|
| Misaligned network | 10.20.7.0/23 | Strict parse fails: host bits set |
| Overlap | 10.20.4.0/23 and 10.20.5.0/24 | Sorted comparison: second starts inside first |
| Wrong usable count | A /27 listed with 32 hosts | Recomputed: 30 usable plus network and broadcast |
| Netmask as wildcard | 0.0.0.255 intended, 255.255.255.0 written | Converted range covers the wrong bits entirely |
| Reserved space used | Documentation range 192.0.2.0/24 in production | Check against the special-purpose registry |
04 Keeping the check in the change process
Make the recomputation part of review, not an optional extra: attach the tool output to the change ticket so the reviewer sees the numbers checked, not just the plan. The same principle runs through peer review for AI-assisted network changes: generated work is welcome, unverified generated work is not.
If a number decides where a packet goes, a tool must have computed it or checked it. A model may have suggested it.
05 Questions
Can I trust AI chatbots with subnetting?
Use them for a first draft, never as the final answer. Recompute every prefix with a CIDR library or calculator and check alignment, containment and overlap.
How do I check a subnet is aligned?
Parse it strictly with a CIDR library. The network address must be a multiple of the block size; a strict parser raises an error when host bits are set.
What is a wildcard mask?
The bitwise inverse of a netmask, used in many ACL syntaxes. 0.0.0.255 matches a /24; writing the netmask 255.255.255.0 there matches something entirely different.
Which address ranges should never appear in production plans?
Documentation ranges such as 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737), and other special-purpose blocks listed in the IANA registry described by RFC 6890.
How do I test an ACL before deployment?
Run the first and last address of each intended range and one just outside through a lab device or a configuration analysis tool, and compare the results with the intent.