Home > Network Pentesting

Subnetting & Network Architecture

Subnetting and network architecture determine how a network is organized, how hosts communicate, and how traffic flows between different segments. For pentesters, this knowledge is essential because it defines what is reachable during an assessment, which systems are hidden behind segmentation, and how internal movement can be performed. A strong understanding of subnetting and architecture allows accurate recon, efficient scanning, and effective planning of attack paths.

Understanding Subnetting

Subnetting divides a larger network into smaller, manageable segments called subnets. Each subnet has its own network address, range of valid hosts, broadcast address, and subnet mask. Subnetting improves performance, reduces congestion, and strengthens internal security by separating devices into logical groups.

IP Address Structure

An IPv4 address includes a network portion and a host portion. The subnet mask determines where the split occurs. Larger masks create smaller subnets, while smaller masks create larger networks.

Examples:

  • 192.168.1.0/24 contains 256 IPs

  • 192.168.1.0/25 contains 128 IPs

  • 192.168.1.0/26 contains 64 IPs

Pentesters calculate these to identify scan ranges and determine which hosts may be reachable.

CIDR Notation

CIDR notation (/24, /16, /28) expresses how many bits belong to the network portion. It helps reveal how many hosts exist within a subnet and how many networks are created when a larger block is divided.

Common CIDR sizes:

  • /24: 256 total IPs

  • /25: 128 total IPs

  • /26: 64 total IPs

  • /30: 4 IPs, often used for router links

Pentesters must quickly compute subnets to avoid scanning invalid or unreachable ranges.

Discovering Subnets During Pentesting

Pentesters identify subnets using:

  • ARP tables

  • ICMP sweeps

  • Nmap host discovery

  • DHCP lease information

  • Routing table inspection

  • Firewall behavior

Mapping subnets reveals the network’s internal structure and possible pivot points.

Understanding Network Architecture

Network architecture defines how devices, segments, and security zones are arranged. Architecture influences traffic flow, security enforcement, and reachable systems. Pentesters analyze architecture to understand how attackers could move inside the network or bypass segmentation.

Flat Networks

A flat network has minimal segmentation. All devices may share the same broadcast domain or subnet.

Risks of flat networks include:

  • Easy lateral movement

  • Broad visibility of internal devices

  • Rapid spread of malware

  • Weak internal security boundaries

Pentesters can navigate these networks quickly due to the lack of barriers.

Segmented Networks

Segmented networks divide systems into isolated security zones. Segmentation is achieved using VLANs, firewalls, ACLs, or routing restrictions.

Examples include:

  • Separate networks for employees, servers, and management systems

  • Restricted subnets for sensitive data

  • Isolated VLANs for guest Wi-Fi

  • DMZs for external-facing services

Pentesters must analyze segmentation to identify which zones can be accessed and which require advanced pivoting techniques.

DMZ (Demilitarized Zone)

A DMZ hosts external-facing services such as:

  • Web servers

  • DNS servers

  • Email gateways

  • VPN portals

The DMZ isolates these services from internal networks. Pentesters search for misconfigurations that allow movement from the DMZ into protected internal systems.

Network Layers

Enterprise networks often use a three-layer architecture:

  • Core layer for high-speed routing

  • Distribution layer for inter-VLAN routing and ACL enforcement

  • Access layer for connecting endpoints

Understanding these layers helps pentesters identify bottlenecks, filtering points, and potential misconfigurations.

Routers and Switches

Routers manage traffic between networks. Switches control traffic within networks.

Common weaknesses include:

  • Unrestricted management interfaces

  • Weak ACLs

  • Misconfigured VLANs

  • Outdated firmware

  • Poor segmentation rules

Pentesters assess these devices to detect paths for lateral movement.

Firewalls and ACLs

Firewalls and ACLs enforce boundaries between subnets and networks. Proper configurations restrict unauthorized movement.

Pentesters look for:

  • Overly permissive rules

  • Allow-all policies

  • Shadowed or unused rules

  • Misconfigured interfaces

  • Weak egress filtering

These issues can expose sensitive internal networks.

Mapping Architecture in a Pentest

Pentesters reconstruct architecture using:

  • Nmap scans

  • SNMP enumeration

  • Routing tables

  • ARP analysis

  • Traceroute paths

  • Firewall response patterns

This mapping helps visualize how systems connect and how attackers could pivot.

Pivoting Across Network Segments

Pivoting depends on:

  • Subnet boundaries

  • Routing permissions

  • Open internal services

  • Authentication controls

  • Firewalls between zones

Pentesters leverage compromised hosts to enter restricted segments and expand their reach.

Why Subnetting and Architecture Matter

Subnetting and architecture define the network’s structure. Pentesters use this knowledge to:

  • Map reachable and hidden systems

  • Plan internal movement

  • Identify weak segmentation

  • Detect unintended access paths

  • Understand the behavior of firewalls and routing

  • Prioritize high-value targets

Accurate understanding leads to better recon, deeper access, and more effective exploitation.

Intel Dump

  • Subnetting divides networks using CIDR notation

  • Pentesters calculate subnets to determine valid scan ranges

  • Architecture defines how devices connect using routers, switches, VLANs, and firewalls

  • Flat networks allow easy movement; segmented networks require pivoting

  • DMZ hosts public services and often leads to internal attacks if misconfigured

  • Architecture mapping reveals hidden paths, misconfigured rules, and pivot opportunities

HOME LEARN COMMUNITY DASHBOARD