I've noticed that I used to be assigned an external IPv4 from my ISP and a 24 bit mask (, then it changed to, today I was studying IPv4 subnetting and I understand that now each ISP subscriber is on his own subnet (right?), then I read about the Snowden leak of the partnership between NSA and my country. Is there any connections? Should we be worried? What are the implications of the subnet change?

  • They're probably running out of IPv4 spaces so they've moved you to one of their last allotted spaces. I think the connections are in your head :P – Eric Lagergren Jul 27 '14 at 4:28
  • Well that might be the case, I've been studying InfoSec for about 45 days and I'm seeing thing, lol! Still, answer to the questions listed would prove very informative if one may would like to contribute. – Mars Jul 27 '14 at 4:44

The "subnet" makes sense only for routing. When machine A decides to send a packet to machine B, it considers B's IP address:

  • if that IP address is on the same subnet as A, then A thinks that it can send the packet "directly" (A and B are on the same link) and does just that;
  • otherwise, A sends the packet to its gateway, i.e. a machine G (that A can talk to directly). The gateway is responsible for forwarding the packet to B, or at least to the next gateway in the path from A to B.

As an ISP customer, you expect that all your external traffic goes to the ISP. Having a subnet makes sense only in the following situations:

  • The ISP does not give you one IP address, but a whooping 255 (since it keeps one for the gateway). This may happen when the ISP provides only private IP addresses, and applies NAT; however, if you got an external IP address, then this is implausible, given the current shortage on IPv4 address,

  • Customers are really grouped in subnets and their machines can talk to each other directly, without going through the ISP routers. I have seen that in older days (about 15 years ago): a cable provider who had arranged things so that all customers in a single building were really on some LAN-equivalent. It turned out not to be a good idea: some customers were engaging in hostile attacks against other customers, and since they had direct access, the ISP routers could not filter or even detect such behaviour.

  • A misconfiguration from the ISP. Customers from the "same" subnet are not actually on the same subnet (they cannot talk to each other directly). Consequence is an impossibility of customer-to-customer communications through their public IP addresses in some cases; this is a problem for some applications (namely, some network-aware games).

The third case probably applies here; meaning that what you observe really is an ISP who previously goofed on network configuration, then noticed it and proceeded to fix it. You should rejoice; not all ISP demonstrate that level of competency.

  • Interesting, and I think it makes sense, especially given that incompetency is the norm here in probably everything. – Mars Jul 30 '14 at 21:26
  • In case 2, even with the subnets set to /32, couldn't a malicious customer still send a packet directly to another customer by reconfiguring their own machine? (say, setting the subnet back to /24). – user253751 Jan 15 '16 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.