How to tell which subnets are full
To tell which subnets are full, count the addresses actually in use in each subnet and divide by the usable addresses its mask allows; a subnet calculator only gives the second number. Where the addresses in use come from decides what the answer is worth. NacTrack counts the addresses configured on the interfaces of your collected devices, which is the real occupancy of infrastructure subnets: interconnects, loopbacks, management ranges. For user subnets full of PCs and phones, the count has to come from ARP or DHCP, as shown below.
What you need
- Module required: ip_management.
- Permission required: view_ip.
- Every collected platform whose interfaces carry IPv4 addresses.
In NacTrack
- 1
Open IPAM, then IPv4 Networks Usage
The IPv4 Explorer groups the address space into blocks, the private ranges plus any block you define, and each block into the subnets found on device interfaces, per VRF. Each subnet row shows Used, Unique, Duplicates and Util %.
Screen: app.nactrack.com/ip/usage
- 2
Read Util % for the infrastructure subnets
Util % is the number of distinct addresses found in the subnet divided by its usable addresses. On a management range where every switch has its address, that is the real fill rate. Open a subnet to see each address with its device, interface, VRF and status; an address seen on two interfaces is flagged as a possible conflict.
Screen: app.nactrack.com/ip/usage
- 3
Find the free space
Select a VRF, then tick Free: the gaps between the used subnets of the block appear as free subnets. That is where the next subnet goes when one is full.
Screen: app.nactrack.com/ip/usage
User subnets, by hand
For a user VLAN, count the entries in the ARP table of its gateway, for example "show ip arp Vlan10" on a Cisco layer 3 switch, and compare with the usable addresses of the mask. ARP entries age out, so a host switched off for the night is not counted: read it during working hours.
If addresses are handed out by DHCP, the scope statistics of the DHCP server are the better measure: "show ip dhcp pool" when a Cisco IOS device is the server, the scope statistics of the server otherwise. A scope full of leases is full even if half the hosts are off.
What this view does not tell you
- For IPv4, used means configured on an interface of a collected device. ARP tables, MAC tables and DHCP leases are not counted, so a user subnet with two hundred PCs and one gateway reads as almost empty. Read Util % on infrastructure subnets only.
- A subnet exists here only if a collected device has an address in it, and the figures come from the last collection, with no history. There is no colour threshold for a full subnet, and the exports carry the subnet, VRF and name, not the utilisation.
- IPv6 is shown per /64 and includes neighbour discovery entries, but has no utilisation percentage.
Further reading
IPAM: real subnet utilisation from interface addresses
Blocks, subnets and utilisation, counted on the addresses your interfaces carry. A single address is checked against ARP tables.
How-to guideHow to find where an IP address lives on the network
Give IP Finder an address and it searches every collected source, ARP tables, inventory and neighbours, then says which device holds it.
How-to guideHow to tell whether an IP belongs to a user device or to network equipment
IP Finder heads each block of results with the source that matched, and that heading tells you whether the address is an endpoint or a device.