Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
The Internet Technology

Local Network IPs - 10.0.0.0/8 or 192.168.0.0/16? 215

mike9010 asks: "After reading a few articles on the net about networking, I have come up with a question. It seems that most of them say to use 192.168.0.0/16 for a local network. Why not use 10.0.0.0/8 though? It is my understanding that it can hold a lot more IP addresses, and it is also prettier." What local network range are you using for your networks?
This discussion has been archived. No new comments can be posted.

Local Network IPs - 10.0.0.0/8 or 192.168.0.0/16?

Comments Filter:
  • by Sunlighter ( 177996 ) on Wednesday September 03, 2003 @06:47PM (#6863839)

    This is an intermediate one that isnt widely used.

    I dont think it matters too much; few businesses have as many as 64,000 computers, so the 192.168 is big enough. But the 10 makes it easy to do interesting things with the other numbers, like making the first number the department number, etc.

  • Why not? (Score:4, Interesting)

    by iCEBaLM ( 34905 ) on Wednesday September 03, 2003 @06:48PM (#6863840)
    There's no reason why not. I have no idea why every manufacturer wants the masses to use the pretty confusing IP range when 10.0.0.0./8 is easier to remember/type.

    I use it myself. Nothing wrong with it.

    -- iCEBaLM
  • we use 10/8 (Score:3, Informative)

    by chongo ( 113839 ) * on Wednesday September 03, 2003 @06:48PM (#6863843) Homepage Journal
    We use the 10/8 within our internal network. We have subnets such as 10.10/16 and 10.20/16 on which several LANs operate, usually at the /24 level.

    Use of 10/8 can be a fine choice.

    • Picking the right subnet size is important, just for keeping track of things, and the big questions have tended to be "Do I use Class A/B/C subnet sizes or a 10.*.*/20?" Sure, the hardware almost always supports Variable Length Subnet Masking, but humans aren't always that good at it.

      If you're not going to have more than ~250 hosts per segment or more than ~250 segments, I've generally taken the approach of "pick a random number R in 21..250 for the second octet, and create a bunch of 10.R.*/24 subnets" -

  • I use (Score:5, Funny)

    by The Clockwork Troll ( 655321 ) on Wednesday September 03, 2003 @06:48PM (#6863844) Journal
    I use the 66.35.192.0/18 block.

    It doesn't seem to conflict with anything important.

  • by MattCohn.com ( 555899 ) on Wednesday September 03, 2003 @06:49PM (#6863853)
    There is no real reason to use one or the other except that many devices come with built in static IP addresses. I've seen some with 10.x addresses, others with 192.168.x addresses. I guess not looking at that, it just comes down to choice. I like 192.168 and use it on my home network... but my work network uses 10. JUST GO FOR IT MAN!
  • by epsalon ( 518482 ) * <slash@alon.wox.org> on Wednesday September 03, 2003 @06:49PM (#6863854) Homepage Journal
    The 10.x.x.x IPs are used for larger networks. Suppose you switch ISPs and get connected with an ISP with a NAT, or you VPN with some other network. Chances are they will be 10.x.x.x. In general use 10.x.x.x if you're running a large network and 192.168.x.x for a smaller network.
  • Pretty? (Score:4, Funny)

    by Henry V .009 ( 518000 ) on Wednesday September 03, 2003 @06:53PM (#6863882) Journal
    Oh sure, it's prettier if you are into the modern reductionist view of IP address beauty. I, for one, continue to prefer form and substance. How can someone compare 192.168 with 10.0? Praising 10.0 is like calling a blank canvas a masterpiece. Some people would not know real IP art if it hit them in the face.
    • Some people would not know real IP art if it hit them in the face.

      I may not know art, but I know what I like!
    • How can someone compare 192.168 with 10.0? Praising 10.0 is like calling a blank canvas a masterpiece. Some people would not know real IP art if it hit them in the face.

      Take it to the next level. 10.0.0.0/8 simply cannot match the sweat, blood and tears of 192.168.37.0/19 using NT4 DHCP+WINS+MSDNS.


  • I use 192.168.0.0-xxx for my home network because a lot of businesses use 10.0.0.xxx and I have faced network access issues when connecting through VPN to business networks...
  • 10.0.0.0/8 (Score:4, Informative)

    by MazTaim ( 1376 ) <taimNO@SPAMnauticom.net> on Wednesday September 03, 2003 @06:55PM (#6863901) Homepage Journal
    I actually asked this question once. Nobody could really give me a good answer. I personally prefer 10.0.0.0 over 192.168.0.0. It does look pretier, it's easier to type, and you do have more IPs to play with. Who has need for all those IPs is beyond me, but I say you can never have too many IPs.

    It does look prettier. here is how I broke down my NAT network

    10.0.0.0-255 = Routers/Server - Kinda, sorta DMZ
    10.0.1.0-255 = Wired Workstations
    10.0.2.0-255 = Wireless Workstations
    10.0.3.0-255 = Test stuffage

    192.168.0.0 is the defacto standard for just about any router you buy off the shelf. Perhaps there is a valid reason?
  • Broadcast domains. (Score:3, Insightful)

    by cbiffle ( 211614 ) on Wednesday September 03, 2003 @07:00PM (#6863940)
    If you use same-size subnets in both cases, there's no difference between the 10-net and the 192-net.

    If you're using 10/8 vs. 192/24, and have enough computers to justify that, you'll want to break it up into subnets to limit the size of your broadcast domains.
  • by MerlynEmrys67 ( 583469 ) on Wednesday September 03, 2003 @07:01PM (#6863956)
    Worked for a company doing networking software, so I kept a LARGE number of test devices/networks hanging off of my workstation on a test subnet... Problem was various company sites would drop off of my workstation when the IT dept. would randomly assign private addresses inside the company... I couldn't even get them to whack off a /16 for "test networks" because they thought that they would need all of the private address space scattered across all three ranges...

    So my advice is whack off 1/4 of the 10/8 space - and reserve it for true "private addressing" and use all of the rest of the private addressing ranges as you see fit

  • most minirouter/firewall/cable modem sharers use 192.168.0.0/24, that i've seen. works fine if you've under 254 hosts.

    but most large internal networks do use 10/8, 10/16, or 10/24- it is a lot cleaner to setup, and does allow some neat organizational capabilities. i used 10/16 back in 97 when i set up my school district's WAN, and is still being used too.

    in times past, an argument might have been made for 172.whatever/16-23, because the larger subnets are "slower" on a network- but we've got switches, so
  • IP Subnetworking (Score:5, Informative)

    by hawkstone ( 233083 ) on Wednesday September 03, 2003 @07:06PM (#6864013)
    From the IP subnetworking HOWTO [linuxdocs.org]:
    There are also special addresses that are reserved for 'unconnected' networks - that is networks that use IP but are not connected to the Internet, These addresses are:-

    * One A Class Network
    10.0.0.0
    * 16 B Class Networks
    172.16.0.0 - 172.31.0.0
    * 256 C Class Networks 192.168.0.0 - 192.168.255.0


    The one most often used by home networking products is 192.168.1.x in my experience, not the full /16. They are designed to hold 254 addresses, no more. Why are these designed for only a small number of IP addresses? Well, the home routers often have 4 ports, with maybe wireless. Are you really going to have a few hundred clients? Anyway, it's probably best to stick with the 192.168.1.x for a small network if you're planning on connecting to one of these. If, not, do whatever floats your boat!
    • Just as a data point, I bought a CompUSA cable router last week (because it was $40 and all the other brands they carried were $50) and it insists on using 192.168.8/24 as the local subnet. No idea why they chose 8...

  • Choose randomly (Score:5, Informative)

    by Fluffy the Cat ( 29157 ) on Wednesday September 03, 2003 @07:06PM (#6864015) Homepage
    RFC 1918 recommends that you choose a network randomly in order to reduce the chances of colliding with any other internal network you may ever want to connect to.
    • We go one better; we've got a daemon that tunnels a single address from the 192.168/16 range, and via that we route our 10.x/16 and/or 10.x.y/24 LAN's into one big city-wide WAN. The 10.x/16 addresses are allocated so that they don't conflict within the WAN.

      And most of us use DHCP too so if we bring machines to LUG meetings or whatever, they reconfigure themselves altomatically.

      And to talk to my ADSL modem I'm using a 172.16.254.252/30 subnet.

      The rfc's advice is all very good in theory, but I wonder how
  • I usually select a random /24 in the 10.0 range. I've found that things sometimes get weird when using vpn tunnels between networks with identical net numbers (i.e. 192.168.1.x), and I often use pptp tunnels to get access to various networks. By using the 10.0 range, and setting a different subnet number for each network I use, I avoid this problem. There's no reason you couldn't do the same on 172.16.
  • No real difference (Score:5, Interesting)

    by blate ( 532322 ) on Wednesday September 03, 2003 @07:07PM (#6864033)
    The 192.168 and 10 networks are functionally equivalent except that the 10 network is class A and the 192.168 is class B (i.e. 10 is bigger).

    You will find that many off-the-shelf devices, like NAT/Routers from Linksys, Netgear, etc. use 192.168.x.x by default; some of them don't let you use anything else (I think Linksys locks you in to 192.168, but you can change the lower two octets).

    I personally use a 10.x.x.x network in my test lab at work, because it allows me to choose network addresses that make sense and are somewhat human-readable. If you're setting up a network for a business, it might make sense to use a 10 network just for expandibility. Then again, if you need more than 64k addresses, you probably have bigger problems to deal with.

    One thing I like about the 10 networks is that when you see their addresses scream across a packet dump, you can immediately recognize them as "fake" addresses.

    One security/network citizenship point (assuming that your 10 or 192.168 network is behind a NAT connected to the outside world): your firewall/router should NEVER pass packets destined to or accept packets sourced from a fake address range (10/24, 192.168/16, etc.). This can lead to evil attacks, garbage traffic on or out of your network, and a whole host of problems.

    I inadvertently flooded my company's T1 line while running a test because our sysadmins hadn't configured our firewall to block outbound packets destined to a 10 address. A bug in a server I was testing caused it to send data back to the wrong address and our router happily sent the data out over the T1. No major harm was done, but a few people couldn't read their Slashdot until we discovered what the problem was.

    Bottom line: choose what works for you (which may be either address range).
    • NAT within NAT (Score:3, Interesting)

      by epine ( 68316 )

      One detail to bear in mind: sometimes you need to NAT within NAT. You can end up with nested NAT zones. 10.x.x.x does *NOT* NAT well within 10.x.x.x I've had to debug routing table illness for this situation several times.

      My company makes a security product with its own Linux host, and the host operates cameras with a private NAT of its own. In one version, we had the Linux host and cameras behind an 802 network gateway, and the gateway performed NAT. We had the gateway configured to create a 10.x.x.
    • One security/network citizenship point (assuming that your 10 or 192.168 network is behind a NAT connected to the outside world): your firewall/router should NEVER pass packets destined to or accept packets sourced from a fake address range (10/24, 192.168/16, etc.). This can lead to evil attacks, garbage traffic on or out of your network, and a whole host of problems.

      Speaking of internal address ranges and Linksys, anyone else notice you can see the HTTP (& Sometimes TFTP) ports on your external IP
      • You can disable the HTTP port by turning off "Remote Management" on many Linksys devices (I use a BEFSR41). I'm not aware of TFTP ever being open on the outside on Linksys, but other boxes may vary.

        And you're right, your firewall isn't going to let in a packet sourced from its inside interface. Well, most of the time. Some of the cheaper boxes, e.g., the older Netgear and D-Link boxes, do allow this routing path. You're correct: This path should not be allowed, as it may allow a mischevious outsider access
        • You can disable the HTTP port by turning off "Remote Management" on many Linksys devices (I use a BEFSR41)

          This is with "Remote Mangement" set to disabled. That was one of the first things that I've checked.

          your firewall isn't going to let in a packet sourced from its inside interface

          I just doublechecked, and from my computer (with the IP of 192.168.1.100), I can connect to port 80 on the Linksys's external IP address (IP is like 63.169.113.0), as well as port 80 on the internal IP address (192.168.1.1
          • Hmm... well, that's odd. I'll have to try that on my box when I get home.

            FYI, there's a new firmware out (for BEFSR41), circa June 20-something 2003. Nothing much changed, so far as I can tell.

    • 192.168 is a class C network. The first three bits of the network address are set. For comparison, the first octet is thus:

      Class A - networks 1 thru 126.
      Class B - networks 128 - 191.
      Class C - networks 192 - 224 ( I think - then there's the class D multicast space).

      It's a minor quibble, I know, but you should know the difference between classes and how to tell which is which, otherwise you may look clueless to someone important. :)
      • You are (technically) correct.

        Being a somewhat younger lad, I've gotten used to calling /8 networks class A, /16 networks class B, and so on.

        Kind of ironic, since almost all routing now is classless.

        Anyway, thanks for keeping me on my toes :)
    • Microsoft pushed 10.x.x.x in its Small business server and its proxy server configurations.

      It was terribly ironic when microsoft made the default "shared internet" settings 192.168.x.x

      A user starts sharing his dialup in an office on XP, and that little DHCP server starts spreading 192s around.

      Another MS flaw, consistancy with their flaws..
    • One security/network citizenship point (assuming that your 10 or 192.168 network is behind a NAT connected to the outside world): your firewall/router should NEVER pass packets destined to or accept packets sourced from a fake address range (10/24, 192.168/16, etc.).
      But I'd make an exception for ICMP and UDP echo replies, so you can ping/traceroute your upstream's internal routers.
    • You can use any one of the 255 192.168.x.0/16 networks or group them up into a 192.168.0.0/24 network. Or you could grab a /16 some where in 10.0 and subnet it to a smaller network.

      Subnetting has been completely divorced from classes for about 10 years now.
    • You will find that many off-the-shelf devices, like NAT/Routers from Linksys, Netgear, etc. use 192.168.x.x by default; some of them don't let you use anything else (I think Linksys locks you in to 192.168, but you can change the lower two octets).

      Just FYI, but on my LinkSys BEFSR41 (firmware rev 1.44.2), all four octets are configurable.

      Mind you, with only five hosts at the moment, I haven't bothered to change it out of the 192.168.x.x address space.

      Yaz.

    • (I think Linksys locks you in to 192.168, but you can change the lower two octets).

      Nope, Linksys routers can be changed all you want. My home network uses 10.10.10.x addressing and it works like a charm.
  • by s88 ( 255181 ) on Wednesday September 03, 2003 @07:14PM (#6864100) Homepage
    Its lightning fast! I always have 0 msec pings!
    I highly recommend you try it.

    • Re:I use 127.0.0.1 (Score:2, Interesting)

      by DrSkwid ( 118965 )
      0ms, which OS/NIC is that ?

      64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.043 ms
      64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.053 ms
      64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.044 ms
      64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.061 ms
      64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.052 ms

      I had a situation where someone external to my network got lower pings to the game server sat on the LAN only 100Mbs away. It was NT adding the latency, dropping to 98 sorted it out.
  • Apparently, there are some now-obsoleted RFCs (RFC1878 and/or RFC1122) which don't allow a subnet portion of all ones or all zeros (binary).

    Rather incredibly, HP-UX 11 actually won't let you use a 10.0.0.X address by default because it blindly (and wrongly) follows these ancient RFC specs ! If you don't believe me, check out this discussion [hp.com] , which thankfully does indeed have the fixes in the thread (patch PHNE_20633 and a hack to nddconf).

    Yep, we use 10.X.X.X addresses and got bitten by this with our H

  • I get all the mask/subdomain stuff, but what's the / at the end of the IP address mean?

    • by Medieval_Gnome ( 250212 ) <medgno@@@medievalgnome...org> on Wednesday September 03, 2003 @08:04PM (#6864524) Homepage
      It is a method of indicating how many bits in the address are part of the 'network' number, as opposed to the 'host' number. For example..

      In 10.0.0.0/8 that means there are 8 bits that identify the network (10.x.x.x) and 24 bits (IP addresses are 32 bits, 8 bits are already used for network; 32-8=24) for the machine number (the x.15.53.45)

      So now, for '192.168.0.0/16'. The 192.168 part is the network part, and the '/16' means the last 16 bits are used for hosts. When the slash-number is larger, that means the person with that IP range has less IPs. /24 means the user has 254 hosts at their disposal, while a /8 means over 16 million.

      I really hope this helps, sorry I'm not the greatest at explaining things.
    • It's to seperate the bitmask. An IPv4 address is 32 bits long, in big endian order (biggest value goes first, like our decimal system). The /XX is simply an abbreviated way of writing a subnet that starts with n 1's and ends with 32-n 0's. For instance, 10.0.0.0/8 means the 10.x.x.x network with a subnet mask of 255.0.0.0. 192.168.0.0/16 means the 192.168.x.x network with a subnet mask of 255.255.0.0. 192.168.123.128/26 means the 192.168.123.[128 to 192] network, with a subnet mask of 255.255.255.64.

      Almost
  • Pedantic correction: (Score:5, Informative)

    by Asprin ( 545477 ) <gsarnoldNO@SPAMyahoo.com> on Wednesday September 03, 2003 @07:50PM (#6864423) Homepage Journal

    192.168.0.0/16 doesn't exist.

    It's really a set of 256 (254, really because you aren't supposed to use 0 or 255) /24 networks:
    192.168.1.0/24
    192.168.2.0/24
    192.168.3.0/24
    ...
    192.168.254.0/24

    Now, if you set up your internal routing and gateways correctly, the difference doesn't matter, but TECHNICALLY, since 192 starts with the binary digits '110', it's a class C (/24) network.

    FYI.

    Which (10.0.0.0/8 or 192.168.0.0/24) you use doesn't matter unless you need to connect your network to somebody else's, but a bad decision (or evaluation of capacity) early on can come back to create problems if your network grows beyond the address space you planned for it. GOOD DESIGN IS ESSENTIAL to preventing problems down the road. Usually the # of hosts you need on your network segments drives the decision. Some larger networks will use the /24 blocks for local departmental LANs, and hook them together with /8 block addresses on the internetwork routers, but there are gobs of ways to do it.

    I'd recommend searching Cisco's site for white papers on network design, or maybe googling for TCP/IP tutorials.
    • CIDR! (Score:5, Informative)

      by tachyonflow ( 539926 ) on Wednesday September 03, 2003 @08:10PM (#6864562) Homepage
      Welcome to the world of classless routing!

      192.168.0.0/16 certainly does exist. The first three bits has not dictated the netmask for years. See RFC1817 [faqs.org] for more information on this. Here's a relevant excerpt (emphasis added):

      Classless Inter-Domain Routing (CIDR) ([RFC1518], [RFC1519]) is deployed in the Internet as the primary mechanism to improve scaling property of the Internet routing system. Essential to CIDR is the generalization of the concept of variable length subnet masks (VLSM) and the elimination of classes of network numbers (A, B, and C). The interior (intra-domain) routing protocols that support CIDR are OSPF, RIP II, Integrated IS-IS, and E-IGRP. The exterior (inter-domain) routing protocol that supports CIDR is BGP-4. Protocols like RIP, BGP-3, EGP, and IGRP do not support CIDR.
  • Neither (Score:4, Insightful)

    by anthony_dipierro ( 543308 ) on Wednesday September 03, 2003 @07:56PM (#6864462) Journal
    Use IPv6 for your internal network.
  • If you are talking about a 'large-ish' local network then splitting 10/8 into smaller blocks looks pretty good on paper. You can split it into /16s and delegate those to departmental level net admins who will then divide them into /24s for individual VLANS. It helps if you do a big plan upfront. This way if let say you know that HR, accounting, and marketing are restricted to one site you can assign them a glob of /16s that you can summarize on the routers to keep the routing tables nice and small. You
  • paper or plastic? (Score:3, Interesting)

    by josepha48 ( 13953 ) on Wednesday September 03, 2003 @08:57PM (#6864893) Journal
    It seems to me that this is kinda the same thing. 192.168/16 is actually a lot of address space, unless you are a really big company. One thing you could do is implement an ipv6 network and than do a ipv6 to 4 nat to access the internet.

    Alternately, nat allows a natted ipaddress to be natted again and again. So you could setup a 192.168.1.x network then each 192.168.1 consists of 192.168.0.x networks. That should give you about 255 * 255 or 65025 ip addresses to play with. It would be interesting to know if it worked and you have a 192.168.0.1 address that gets natted to 192.168.1.1 and gets natted again to then to your public ip address.

    I think the 10's give more addresses without double natting so it depends on how much you expect your network to grow.

  • For my home network, I use 192.16.42.0/21.

    Why?

    1. I take great amusement out of telling this to people. That network and netmask defines exactly what's permissible on my home network, so only the two /24s defined by the above will work with my NAT box. This confuses a great many people.
    2. It should be obvious why I chose The Number 42.
    • Re:I use... (Score:2, Informative)

      by legend ( 26856 )
      Hopefully you don't try to access Los Alamos hosted Web Sites. http://ws.arin.net/cgi-bin/whois.pl?queryinput=192 .16.42.0
  • I've had to work with some firmware where a ip address in the 10.x.x.x range was burned into firmware for the out-of-band port. (that is a ehternet port intended only for use with a crossover cable direct to a laptop for techs to debug with) Using that device on a 10.x.x.x network didn't always work. We did burn firmware for large customers who used the 10.x.x.x networks, but we didn't like it.

  • I had to install a firewall becase of the continuing problems with the RPC Open Door issues with Windows Servers. I found to my horror that the Microsoft VPN client in Win98, etc. totally ignores the subnet mask you give it, and decideds to to use a /8 subnet mask for the VPN route, and there's no way around it.

    The only sane way out of this (aside from looking at the Windows VPN Client Source and posting a patch to the group... oh.... yeah, not open source)... is to use the ONLY available /8 address out th

  • I work for a large un-named company with a very large WAN (both private frame relay and software VPN tunnels over the internet), with VPN connections to outside companies.

    Cisco-trained people, who have IP conservation drilled into their heads early on, almost drop dead at our lack of conservation. When I designed all this mess, I was trying to keep addresses 'logical'...as stated above, using department numbers and the like to help out the others on our staff that aren't the least bit network -savvy.

    Inte
  • This will 'black hole' all of the crap that you get from @home and roadrunner zombie worms. Unless of course you're on one of these networks...

    A good scheme for the 10 network is to split it into class B's for large locations and class C's for smaller locations as such:

    10.X.
    where X is the location number 1 for new york, 2 for LA, 3 for hamburg, etc.
    10.1.Y
    where Y is 0 for routers/network devices, 1 for servers, 2 for remote access, 3 for static addresses, and 4-10 for DHCP addresses. 11-254 (255) are rese
  • by Outland Traveller ( 12138 ) on Thursday September 04, 2003 @08:32AM (#6867625)


    The correct answer to this question is RTFM. If you have to ask this question, you're not competent to plan out a large network.

  • by Chacham ( 981 ) *
    Perhaps the answer is in the RFC that defines it? RFC 1918 [faqs.org] states (Section 5):

    If a suitable subnetting scheme can be designed and is supported by the equipment concerned, it is advisable to use the 24-bit block (class A network) of private address space and make an addressing plan with a good growth path. If subnetting is a problem, the 16-bit block (class C networks), or the 20-bit block class B networks) of private address space can be used.

    So, the answer is to use Class A when you design it, unless subn

  • It doesn't matter what address you use on your internal network, so long as you use NAT. You can pick ANY valid IP address; anyone you connect to will only see the external address, not the internal network address range.

    Every company in the world could use the same internal address range, and return all their privately held addresses. They only need:

    (number of externally visible servers / 65535)

    Internet visible addresses. For most every company in the world, that's just one address.

    Many compani
  • Management of your IP space is extremely important, if you are working in an environment that has more than a few sites/divisions/business units, etc. There is a lot of good information available about IP network design. Overall, the guiding principle is this:

    Reasonably estimate how many hosts will ever exist on a subnet, and use the RFC1918 netblock size that will best handle the hosts, and predicted expansion.

    For example, don't use 10.0.0.0/8 for your local LAN if you only have 20 machines. Decisi
  • I'm a fan of 192.168, but my school something like has thus:

    Main server 90.0.0.0
    Room 1 main: 90.0.1.0
    Room 1 boxes: 90.0.1.*
    Room 2 main: 90.0.2.0
    Room 2 boxes: 90.0.2.*
    Room 3 main: 90.0.3.0
    Room 3 boxes: 90.0.3.*

    Is this scheme phuX0red, or some netware specific thing? It's been buging me for a while, so any explanations appreciated...

The moon is made of green cheese. -- John Heywood

Working...