Loading today’s stories
Build1 distinct publisher2 min readUpdated
A dev.to walkthrough treats the plan as infrastructure code: source of truth, diff, sign-off. Checked against its own arithmetic, its VPN example needs a /11, not a /15.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
The one example in the walkthrough that does not survive its own arithmetic is the VPN case: Site A on 10.10.0.0/16, Site B on 10.20.0.0/16, and a corporate hub carrying a summary of 10.10.0.0/15 that is said to cover B by accident [13]. Anchored at 10.10.0.0, a /15 stops at 10.11.255.255, so it never reaches Site B [1]. The mechanism is sound, in that a hub advertising a range it does not own will attract traffic for the parts it does not own. The numbers point at the wrong route. The smallest single aggregate that actually contains both sites is 10.0.0.0/11, covering 10.0.0.0 through 10.31.255.255, thirty-two /16s in one advertisement [2]. If a tunnel is black-holing after cutover, that is the size of object to look for in the hub's table. It is also why the advice to keep site allocations inside distinct /16s [13] is necessary but not sufficient: two distinct /16s remain summarisable into one /11 by anybody with a keyboard and a tidy instinct.
This is what the two middle tests on the audit checklist are for. Overlap asks whether any two rows share an address; containment asks which declared parent block each row sits inside [14]. They catch different bugs. The acquisition case, two /20s that look unrelated on paper but share a /19 [10], is arithmetic rather than detective work: a /19 holds exactly two /20s [3], so the pair is either the two adjacent halves of one parent, which is legal and needs documenting, or genuinely overlapping, which has to be fixed before anything moves. Walking the tree is what decides which sentence goes into the sign-off.
Of the hygiene the author borrows from Terraform, a source of truth, a diff against reality, and a sign-off [3], the middle term carries the weight. The spreadsheet is intent. Interface descriptions, DHCP scopes and firewall logs are reality [4][12], and on plenty of links the description string is the only place the purpose was ever written down [5]. When the sheet says 10.20.5.0/24 is Finance printers and the router says Guest Wi-Fi pilot, temporary, one of them is wrong, and the author's rule is that the logs decide [12]. That is a diff, and it is the only part of this work a reviewer can check without trusting somebody's memory. Treating the plan as code does not mean putting the sheet in git. It means every row carries an assertion that a second person can falsify while there is still time to change the range.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Overlapping allocations from acquisitions are a recurring pattern: two /20s that look unrelated on paper can share a /19 if someone carved them across the wrong boundary, and the fix is to identify the parent block each subnet belongs to and walk the tree.
A /24 has 254 usable addresses; teams that request one because they need only 30 hosts grow into it and then ask for another /24 instead of re-binning, whereas a /27 gives 30 hosts and leaves room within the same /24.
The pre-migration task is to prove on paper that every existing subnet still fits its purpose, that nothing overlaps, and that new VPC ranges will not collide with anything that survives the cutover.
A subnet plan is a piece of infrastructure code and deserves the same hygiene as a Terraform module: a source of truth, a diff against reality, and a sign-off.
Inputs to gather: an export of every router, switch and firewall interface description; DHCP scopes including helpers, reservations and superscopes; the DNS zone file or the forward and reverse delegations the team owns; every cloud account's VPC, VNet or project; and the site-to-site VPN and peering configuration, where encapsulated ranges count.
The description string on an interface such as GigabitEthernet0/0/0 is often the only thing that records what the link is for, for example that it links to a warehouse printer VLAN.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Method plausible, one worked example fails its own arithmetic
A single self-published practitioner walkthrough is the entire evidence base. The checkable parts check out (a /19 holds exactly two /20s; 30 hosts on a 254-address /24 is 11.8 percent, and eight /27s fit), which lifts the floor. Against that, the flagship asymmetric-VPN example is wrong as printed — a /15 at 10.10.0.0 ends at 10.11.255.255 and cannot cover 10.20.0.0/16 — and the prevalence assertions carry no sample, no named estate, and no outcome data from any audit actually run.
No adoption signal in the supplied material
The cluster contains no release, deployment, benchmark, pricing, licence or usage disclosure. The checklist is not attributed to any named organisation and no figures describe how widely it or anything like it is practised, so adoption cannot be measured without inventing facts.
Rigour claimed exceeds rigour demonstrated, modestly
The post's authority claim is precision — subnet plan as infrastructure code, arithmetic re-derived from first principles, an ordered checklist ending in sign-off — yet the example most readers would copy misstates the covering prefix by four bits, and the recurrence claims rest on unsampled personal experience. The overstatement is real but bounded: the method itself is modest, unglamorous and largely correct, and no extraordinary outcome is promised.
Community post with internal cross-promotion, no disclosed vendor stake
This is a personal post on a developer community platform. The visible incentive is attention and cross-referral: it links its arithmetic step to a companion 'step-by-step guide to calculating subnet bits from an IP and mask', and the body ends truncated mid-sentence on manual arithmetic being 'the rig...', so whether it closes on a tool or product pitch cannot be established from the supplied text and is not assumed. No sponsor, employer, vendor or paid relationship is disclosed anywhere in the material, and no product is named other than Terraform as an analogy.
Method confidently described, evidence thin and unreplicated
Confidence is limited by structure more than content: one publisher, one author, zero corroboration, and no adoption data, so nothing can be triangulated. What can be independently verified is the arithmetic, and that verification both supports several claims and disqualifies one central example. The procedural claims are clear and unambiguous enough to assess, which keeps confidence near the middle rather than low.
build
The three AWS defaults on your bill that nobody actually chose1 distinct publisher
build
Send kills, not scores: the leaderboard fix that turns anti-cheat into a schema decision1 distinct publisher
build
A year without sprints: nine engineers, 36 services, and a WIP cap of eight graded B1 distinct publisher
build
ALB validates the JWT, Keycloak decides what is in it: the Terraform for the matching realm1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 23, 2026