Explain the concepts and applications of network segmentation

Dividing a network into smaller, isolated subnetworks (segments) to improve performance and security. Traffic is confined within segments — it cannot cross into other segments without explicit permission.

Why Segment?

• Security — only permitted traffic can access resources within a segment; a guest Wi-Fi device can’t reach customer account servers
• Performance — heavy traffic (e.g. teenagers streaming) is isolated, so it doesn’t congest other segments
• Congestion reduction — traffic is distributed more evenly; administrators can upgrade a single overloaded segment without touching the whole network
• Scalability — new segments can be added without disrupting existing configurations
• Manageability — finer-grained monitoring makes identifying and resolving issues faster

Think of segmentation as isolating parts of the same network — a powerful tool for both performance and security.

---

Methods of Network Segmentation

Subnetting

Divides a larger IP network into smaller subnets by manipulating the subnet mask, which controls how the IP address space is split.

• Host address — the actual IP assigned to a device; must fall within the range between the network address and broadcast address (excluding both)
• The subnet mask separates the network portion from the host (device) portion of an IP address
• Reduces routing table size — routers only store routes to subnets, not individual IPs
• Controls access between subnets via access control lists (ACLs)

Access Control List (ACL) — a set of rules defining which users or processes can access which objects, and what operations they can perform.

• Objects — resources like files, directories, or devices
• Subjects — users, groups, or system processes requesting access
• Operations — actions such as read, write, execute, or delete

VLANs (Virtual Local Area Networks)

Segments a physical network into multiple logical networks. Devices can be grouped together even if they aren’t on the same physical switch, independent of location.

• Groups devices by function, department, or application rather than physical location
• Sensitive data can be kept isolated from general traffic, reducing breach risk
• Inter-VLAN routing rules control which VLANs can talk to each other
• Limits broadcast domains → less unnecessary broadcast traffic → better performance
• Subnetting and VLANs are often used together: VLANs handle logical separation, subnetting maps those segments to specific IP ranges

CIDR Notation (Classless Inter-Domain Routing)

A compact way to express IP addresses and their subnet masks. Replaces the older Class A/B/C system.

• Format — IP address followed by a /n suffix, e.g. 192.168.1.0/24
  • /24 means the first 24 bits are the network portion → subnet mask 255.255.255.0
• Subnet mask — the number after / counts the bits set to 1 in the mask
• Flexibility — supports variable-length subnet masking (VLSM), enabling more efficient, granular IP allocation

---

Bitwise AND — Finding the Network Address

To determine which network an IP belongs to, apply a bitwise AND between the IP address and subnet mask:

• If both bits are 1 → result is 1
• If either bit is 0 → result is 0

Example — IP 192.168.1.10, mask 255.255.255.0:

IP:     11000000.10101000.00000001.00001010
Mask:   11111111.11111111.11111111.00000000
Result: 11000000.10101000.00000001.00000000  →  192.168.1.0

Network address = 192.168.1.0

Devices sharing the same network portion can communicate directly. Devices on different network portions require a router.

---

Worked Example — Subnet Communication

Device A: 192.168.72.5, mask 255.255.255.0

Device	IP	Network portion	Host	Same subnet as A?
B	192.168.70.5	192.168.70	5	✗
C	192.168.72.100	192.168.72	100	✓

• Device C can communicate directly with A (same subnet)
• Device B needs a router (different network portion)

---