The Elematron blog

Network engineering, explained and fixed.

Short, correct explainers on the problems engineers actually hit — each paired with a free tool and a daily drill so you can practise what you just read.

Security4 min read

Writing least-privilege firewall rules without breaking the app

Learn how to build restrictive firewall rules that enforce least privilege while keeping applications running. Practical techniques for network engineers.

Subnetting4 min read

Subnetting on the Fortinet NSE4 exam: what to expect

Master NSE4 subnetting questions: VLSM, binary math, route summarization, and practical FortiGate scenarios.

Security4 min read

Auditing an ACL for the permit any that should not be there

Learn how to identify overly permissive ACL rules, audit permit any statements, and tighten access control lists for better network security.

Security4 min read

FortiGate policy order: why your rule never matches

Learn why FortiGate firewall policies fail to match and how policy order determines which rule applies first. Essential for NSE and network engineers.

Security4 min read

Turning messy IP ranges into clean firewall object groups

Convert irregular IP ranges to CIDR notation for firewall ACLs, object groups, and security policies. Simplify network config.

Routing4 min read

When routes will not summarize: discontiguous networks explained

Learn why discontiguous networks prevent route summarization, how they break CIDR aggregation, and how to identify them in your topology.

Addressing4 min read

Supernetting vs subnetting: two directions, one mask

Learn how subnetting divides networks and supernetting combines them. Understand CIDR, route summarization, and when to use each technique.

Addressing4 min read

Why the first and last address in a subnet are off limits

Learn why network and broadcast addresses are unusable in subnetting, how they work, and why this matters for your design.

Addressing4 min read

100.64.0.0/10: the carrier NAT range explained

What is 100.64.0.0/10 CGNAT? Learn why this address range is neither private nor public, and how it affects your network.

Addressing4 min read

Designing an IP addressing plan for multi-site branch networks

Learn how to design scalable IP addressing plans for branch offices, including subnetting strategies, address allocation, and routing considerations.

Addressing4 min read

Choosing an RFC 1918 range that will not collide with your VPN peers

Plan private IP ranges across VPN peers without collision. Learn RFC 1918 subnetting strategy for site-to-site and remote access networks.

Addressing4 min read

/30 or /31 for point-to-point links: which to use

Compare /30 and /31 subnets for point-to-point links. Learn when to use each, RFC 3021 rules, and practical deployment guidance.

Subnetting4 min read

Answering a CCNA subnetting question in under 60 seconds

Learn the fastest method to solve CCNA subnetting practice questions. Master the binary method and shortcut techniques used by exam passers.

Security4 min read

Generating strong credentials for routers, switches and firewalls

Learn why default and weak passwords fail network devices, and how to generate strong, compliant credentials for Cisco, Juniper, Arista and Palo Alto.

Troubleshooting4 min read

Jumbo frames: when a 9000-byte MTU helps and when it hurts

Learn when jumbo frames (9000-byte MTU) improve throughput and when they cause fragmentation, latency, and packet loss in enterprise networks.

Subnetting4 min read

CIDR subnetting for CCNA: /26, /27, /28 explained

Master /26, /27, /28 CIDR subnets for CCNA. Learn host counts, usable IPs, and practical subnetting with real examples.

Subnetting4 min read

The subnet cheat sheet: prefix, mask and host counts

Quick reference for subnet masks, CIDR notation, and usable host counts. Essential lookup for network engineers and CCNA candidates.

Addressing4 min read

Reading IP addresses in binary, hex and decimal

Learn to convert IP addresses between decimal, binary, and hexadecimal. Essential for subnetting, ACLs, and network troubleshooting.

Subnetting4 min read

Is this IP in that subnet? The fast check every engineer needs

Learn how to quickly verify if an IP address belongs to a subnet using binary math, CIDR notation, and practical CLI methods.

Addressing4 min read

Convert IP range to CIDR: why it takes multiple blocks

Learn why converting an arbitrary IP range to CIDR notation usually requires multiple prefixes, not one. Essential for subnetting and route aggregation.

Subnetting4 min read

Splitting a subnet into equal blocks without the guesswork

Learn the systematic method to divide subnets into equal blocks. Master the math and avoid common mistakes in subnet planning.

Switching4 min read

VLAN ID ranges and reserved IDs you cannot use

Learn the full VLAN ID range (0-4094), which IDs are reserved, and how to plan your VLAN numbering scheme correctly.

Reference4 min read

TCP and UDP ports every network engineer should memorize

Master the essential TCP and UDP ports for networking: DNS, HTTP, SMTP, SSH, and more. A practical reference for engineers and certification candidates.

Addressing4 min read

MAC address formats: colons, dashes, Cisco dotted and the OUI

Learn MAC address notation formats: colon-separated, dash-separated, Cisco dotted-decimal, and how to identify the OUI manufacturer prefix.

IPv6 address compression: the :: shortcut done right

Master IPv6 address compression rules. Learn when and how to use :: correctly, avoid common mistakes, and compress addresses like a pro.

Reference4 min read

How long should that transfer take? Bandwidth math for real links

Learn to calculate data transfer time using bandwidth math. Practical formulas, real-world examples, and tools for network engineers.

Reference4 min read

The DNS records every network engineer should know

Master A, AAAA, MX, CNAME, NS, SOA, TXT, and SRV records. Essential DNS record types explained for network engineers and CCNA candidates.

Routing4 min read

Route summarization: shrinking your routing table the right way

Learn route summarization and CIDR aggregation to reduce routing table size, lower memory use, and improve convergence time across enterprise networks.

Subnetting4 min read

VLSM subnetting without the headache: a repeatable method

Learn a systematic VLSM subnetting method that eliminates guesswork. Step-by-step process for variable-length subnet masks with real examples.

DSCP marking explained: EF, AF classes and QoS

Learn how DSCP marking classifies traffic for QoS. Understand EF, AF classes, CS values, and practical marking strategies for enterprise networks.

Routing4 min read

Administrative distance: how a router picks between OSPF, EIGRP and static

Learn how administrative distance works and why routers prefer one routing protocol over another. Complete AD reference table included.

Security4 min read

GRE, ESP, and OSPF: Why they have no port numbers

Learn why GRE, ESP, and OSPF use protocol numbers instead of ports, and how to write ACLs for these Layer 3 protocols.

Troubleshooting4 min read

MTU, MSS, and why your VPN tunnels drop large packets

Learn why VPN tunnels fragment packets, how MTU and MSS interact, and how to diagnose and fix packet loss on encrypted connections.

Addressing4 min read

169.254.x.x address on your interface: what APIPA really means

Learn what APIPA (169.254.x.x) means, when it appears on your network interface, and how to troubleshoot it.

Routing4 min read

OSPF cost reference bandwidth: why 100 Mbps links get cost 1

By default OSPF gives every link above 100 Mbps a cost of 1, so it cannot tell 1G from 100G apart. Why it happens and how to fix it with reference bandwidth.

IPv6 address types (and how to compress them)

Global unicast, link-local, unique local, multicast - IPv6 scopes trip up engineers used to IPv4. A quick map of the ranges, plus the two rules for compressing any address.

Least privilege3 min read

Do these two subnets overlap? A 30-second check

Overlapping subnets quietly break routing, ACLs and firewall rules. The fast way to tell whether two CIDR blocks overlap, are disjoint, or one contains the other.

Least privilege3 min read

Subnet mask vs wildcard mask: stop mixing them up

A subnet mask and a Cisco wildcard mask are bitwise inverses. Confusing them writes ACLs and OSPF network statements that match the wrong hosts. The simple rule, plus the /12 trap.

Troubleshooting4 min read

OSPF stuck in EXSTART/EXCHANGE? It is almost always MTU

When an OSPF adjacency hangs in EXSTART or EXCHANGE and never reaches FULL, the cause is nearly always an interface MTU mismatch. Why it happens, how to confirm it, and how to fix it.