Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When we talk about a subnet - do we mean all the systems connected to the same switch?

If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39?

When we talk about Wireshark and others capturing packets from the same subnet, will I be able to capture all the data of 10.0.0.0/8 or only 10.0.2.0/24?

Does the machine with IP 10.0.1.39, when GETting www.google.com , send a packet for 10.0.0.1 (the gateway) and any system on the whole 10.0.0.0/8 network will see the packet, probably because the switch 10.0.2.1 will forward the packet to its network 10.0.2.0/24?

share|improve this question

migrated from stackoverflow.com May 13 '12 at 19:00

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers 2

But, when we talk about a subnet - do we mean all the systems connected to the same switch?

A switch (or interconnected set of switches operating at together at layer 2) defines a broadcast domain (give or take some VLAN configurations). You can run one, many or no IP subnets on the same broadcast domain. You can run a subnet that spans several broadcast domains if you add tunneling at a higher layer. The switch operates on a much lower level than IP networks though.

If I have an assigned ip address of 10.0.2.1, am I in the same subnet as of 10.0.1.39?

It depends entirely what your subnet mask is. If you're on a /24 (i.e. 255.255.255.0) then the answer is no. If you're on a /8 or /16 (i.e. 255.0.0.0 or 255.255.0.0) then the answer is yes.

When we talk about wireshark and others capturing packets from the same subnet, will I be able to capture all the data of 10.0.0.0/8 or only 10.0.2.0/24?

It depends on the interface and the networks it is connected to. If you're on 10.0.0.0/8 then you'll see packets for 10.0.0.0/8. If you're on 10.0.2.0/24 then you'll see packets for 10.0.2.0/24. You might also see extra packets flying around if there are other subnets on the same physical network, but this isn't guaranteed. A switch will try and selectively forward only packets that are either addressed to you specifically, or addressed to everybody on the network, but those addresses are at a lower level than the IP layer.

Does the machine with ip 10.0.1.39, when GETting www.google.com, send a packet for 10.0.0.1 (the gateway) and any system on the whole 10.0.0.0/8 network will see the packet, probably because the switch 10.0.2.1 will forward the packet to its network 10.0.2.0/24?

Under normal circumstances a request from a client on a switched network will only be seen by the switches in between it and the default gateway.

share|improve this answer
    
Very detailed and informative, but the part about broadcast domains is I think misleading. If only one switch existed you would be correct, but I believe the true definition of a broadcast domain is any number of interconnected devices operating at layer 2 (data-link) that are not separated by a layer 3 device (such as a router). Please correct me if I am wrong. –  john May 13 '12 at 19:17
    
@john - I agree that broadcast domains are devices operating together at layer 2, but Ethernet switches are layer 2 (mostly, there's some high end ones which do layer 3 stuff as well), so I don't think your statement is actually contradictory. I'll make a small edit to clarify, see what you think. –  Flexo May 13 '12 at 20:27
    
Ah yes, I meant switches as well. I was trying to refrain from limiting my statement to switches only. –  john May 13 '12 at 20:39
add comment

Assuming we are talking about IP version 4, the IP address contains 32 bits. In the standard X.X.X.X notation, each octet X is 8 bits. (Note that there is nothing "special" about grouping them into 4 octets other than to make it easier for humans to write - machines have no issue dividing anywhere within the 32 bits.)

A subnet mask splits that address into two parts, the network (left) and host (right) portion.

Realize also that IP addresses are assigned to INTERFACES (NICs, etc.) and not individual MACHINES.

Basically everything on the same subnet can talk to each other without going through a router. Anything on different subnets, a router needs to be in the middle forwarding for traffic to move back and forth.

If a machine wants to talk to another machine through a given interface, and the network part on that interface is the same as that of the other machine, it should just be able to shove what it wants to say out on the wire, tagged with its own address (source) and who it wants to talk to (destination), and the other machine will pick it up. In the old days of 10BaseT, etc. all were physically connected to the same physical wire and this would literally happen. Now hubs and switches have replaced that.

If a machine wants to talk to another machine through a given interface, and the network part on that interface is NOT the same as that of the other machine, the traffic needs to go through a router. The machine will need to have a record of what the router's IP address (in this case the router is usually called the gateway) for that subnet is and will then send the traffic there. The router/gateway is then expected to forward the traffic to the destination or another router closer to it.

On most home networking equipment, all machines connected to a switch will usually be configured to be on the same subnet, since the point of connecting all of them to the same switch is to allow all of them to talk to each other. Should one be misconfigured, it won't be able to participate in any communications. However, if the device was a hub and not a switch, the hub would forward all traffic to it (since hubs do not remember MAC addresses and just forward or flood everything out of all ports), and the connected system could "snoop" on all traffic if the NIC was put into promiscuous mode. If that system would send traffic back, if it was not on the same subnet, no other NIC would pick it up (unless it was in promiscuous mode as well.)

Advanced networking equipment can be "partitioned" into VLANs, the machines connected which don't see each others traffic. For machines on different VLANs to communicate, forwarding/a router needs to be involved.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.