Subnet overlap means two intended networks claim some of the same address space
Overlap is not just “two addresses look similar.” Two prefixes overlap when at least one address belongs to both network ranges. That creates ambiguity: a host, router, firewall, or VPN endpoint may classify a destination as local or choose a route differently from what the designer intended.
AP Networking mental model
Prove overlap with network boundaries, then explain the mechanism: which device classifies the destination incorrectly, which route wins, and why the expected path is bypassed.
Prove overlap with start and end addresses
One network can be completely contained inside another
172.16.8.0–172.16.9.255
172.16.9.0–172.16.9.255
/24 is contained inside /23
Depends on where routes/interfaces exist
Containment is still overlap. The fact that the prefixes have different lengths does not make them independent.
A nearby network can look similar and still be safely separate
A wrong subnet mask can imitate enterprise subnet overlap
The enterprise address plan may be perfectly non-overlapping. The host's overly broad prefix causes it to classify a remote destination as local.
Home LAN and corporate LAN using the same prefix can hijack the path before the VPN sees it
This is one of the clearest real-world overlap signatures: the VPN tunnel can be healthy while specific corporate destinations are unreachable because local route classification wins before the expected VPN path.
Longest-prefix match can make overlapping routes behave differently than students expect
Overlap does not always mean “routing is impossible.” Routers can select the most specific route. The problem is often that the selected route does not match the intended design, or that hosts/interfaces treat the same address space as directly connected in conflicting places.
A connected route is especially important because the device believes the destination is on-link
A device cannot simultaneously treat the same destination as both the local attached LAN and a remote network in the ordinary design sense. VPN products may use translation or policy-specific workarounds, but those add complexity.
Do not confuse overlapping subnets with duplicate host addresses
Subnet overlap
Two prefixes claim intersecting address ranges. The issue is route/locality classification and network design.
Duplicate IP
Two devices use the same host IP in the same reachable context. The symptom often involves ARP/neighbor instability or intermittent reachability.
They can coexist, but they are different failure mechanisms and require different evidence.
Two private networks are not overlapping merely because both use 10.0.0.0/8 space somewhere
Private address reuse becomes a problem when the actual routed/VPN contexts must interconnect and the specific ranges intersect.
Recognize patterns that make overlap worth testing
| Observed pattern | Why overlap is plausible | Best next artifact | Competing explanation |
|---|---|---|---|
| VPN connects, but one corporate subnet fails | Local network may claim same prefix | Client route table + local IP/prefix + VPN prefixes | VPN ACL or server outage |
| Remote destination causes ARP/local neighbor attempts | Host thinks destination is on-link | Host prefix + route table | Wrong static route |
| One host fails; peer works | Host mask may be broader | Compare host configs | Local firewall/client issue |
| New site/VPN integration breaks selected networks | New address plan may intersect existing ranges | Address inventories + route/VPN selectors | Missing routes/policy |
| Renumbering one side restores reachability | Removing shared address space removes ambiguity | Before/after routes and traces | Other concurrent config change |
Swipe horizontally to inspect the overlap signatures.
Home VPN collision: 192.168.1.0/24 on both sides
Strong diagnosis: DNS is working and the VPN tunnel can be established, but the corporate destination falls inside the laptop's directly connected home subnet. Inspect route selection and local neighbor behavior.
Contained subnet: /24 inside an existing /23
A new interface using 172.16.9.0/24 does not create independent address space; it reuses addresses already claimed by the /23.
Wrong client mask looks like overlap but only one workstation fails
Failure scope matters: one-host-only behavior is a powerful control against a universal enterprise-overlap hypothesis.
Overlapping VPN selectors can create policy conflicts
The right answer is not merely “two VPNs exist.” Inspect the installed routes, policy selectors, preference/specificity, and actual chosen tunnel.
Try to disprove overlap before renumbering a network
Hypothesis: home/corporate overlap
Falsifier: client route table shows the corporate prefix uniquely routed through the VPN and no local connected overlap exists.
Hypothesis: enterprise prefixes overlap
Falsifier: arithmetic shows the network ranges do not intersect.
Hypothesis: wrong host mask
Falsifier: failing and working peers have identical intended prefixes and route classification.
Hypothesis: VPN overlap causes the failure
Falsifier: the failed destination is outside every locally connected or competing VPN prefix.
One changed fact can completely change the overlap diagnosis
| Initial evidence | Changed fact | How reasoning changes |
|---|---|---|
| VPN destination overlaps home /24 | Home LAN changed to 192.168.50.0/24 | The direct local-prefix collision disappears; retest VPN routing |
| One host treats remote server as local | Prefix corrected from /16 to /24 | Host should now classify that destination as remote |
| Two routes overlap | A more specific route intentionally points to correct VPN | Longest-prefix match can resolve forwarding deterministically |
| Proposed /24 appears suspicious | Range arithmetic shows it begins after parent range ends | Overlap hypothesis is falsified |
| VPN connects but server fails | Non-overlapping corporate servers also fail | Broaden beyond overlap to tunnel/policy/path health |
Swipe horizontally to practice changed-fact reasoning.
Use the route table to show what the host will actually do
No single command is universal across operating systems, but the artifact you need is the same: the host's effective route classification for the failed destination.
Overlap often changes the path before a router or VPN gateway can help
This is why changing a remote firewall can be useless when the endpoint never sends the traffic toward the tunnel.
Do not confuse intentional VPN filtering with overlap
If the route table clearly sends the destination into the VPN but firewall logs show an explicit deny, the mechanism is policy enforcement rather than address overlap. Conversely, if the traffic never enters the tunnel because a local connected route wins, remote firewall logs may show nothing.
A clean fix changes every dependency tied to the old prefix
| Dependency | What may need updating |
|---|---|
| DHCP | Scopes, options, exclusions, reservations |
| Static hosts | IP, prefix, gateway, management endpoints |
| Layer 3 interfaces | SVIs/router interface addresses |
| Routing | Static routes, dynamic advertisements, summaries |
| DNS | A/AAAA/PTR and application records where addresses change |
| Firewalls | Network objects, rules, NAT, security groups |
| VPNs | Selectors, encryption domains, pushed routes |
| Monitoring/docs | Inventory, alerts, diagrams, runbooks |
Swipe horizontally to use the renumbering checklist.
Prove the ranges no longer intersect and the intended path now wins
Correct these overlap mistakes before the exam
- “Two private networks automatically overlap.” Their actual address ranges must intersect.
- “Different prefix lengths mean no overlap.” A smaller prefix can be contained inside a larger one.
- “A VPN connection icon proves corporate routing works.” Specific destinations may still follow local connected routes.
- “Any broad route is wrong if a specific route exists.” Longest-prefix match can intentionally select the specific route.
- “One host problem proves enterprise address overlap.” A wrong local prefix can imitate overlap behavior.
- “Renumbering only means changing host IPs.” Routes, DNS, DHCP, firewall objects, VPN selectors, monitoring, and documentation may all depend on the prefix.
- “If the remote firewall sees no traffic, it must be broken.” Overlap can prevent the traffic from entering the expected path at all.
Find the first contradictory route
Best interpretation: The 10.50.0.0/16 corporate route is non-overlapping and uses the VPN. The printer address falls inside the laptop's directly connected home 192.168.10.0/24 network, so the endpoint may treat it as local instead of sending it through the VPN.
Use RANGE → LOCALITY → ROUTE → CONTROL → CORRECT → VERIFY
24 subnet-overlap reasoning flashcards
These cards test range arithmetic, route selection, VPN overlap, wrong-mask lookalikes, and verification logic.