Detecting Subnet Mismatches Between Field Devices

The Problem

A telemetry gateway sits at 192.168.17.1. The site router hands out 10.215.113.x. Neither device is broken, the cable is fine, and nothing will ever ping — and the civil engineer standing between them ends up texting screenshots of a command prompt to IT to learn why. The why is one bitwise operation, and it's checkable on a phone with no signal.

The Approach

An IP address is 32 bits, and the subnet mask splits it into a network part and a host part. Two devices can talk directly only if their network numbers match. The math is a single AND per device:

network = IP & mask

So 192.168.17.1 & 255.255.255.0 = 192.168.17.0, while 10.215.113.50 & 255.255.255.0 = 10.215.113.0. Different networks — the tool flashes red and says so in plain words: the devices are invisible to each other; they need a router, or one of them needs an address in the other's network. Matching networks flash green, with the honest caveat that matching addresses on separate switches or VLANs still won't talk — this answers the addressing question only.

Two device IP and mask inputs with computed network addresses and a red Subnet Mismatch verdict panel
Figure 1: The mismatch case — both computed network addresses shown, so the verdict is explainable in a text to IT.

Masks are accepted as dotted decimal or CIDR (/24 and 255.255.255.0 are the same statement), non-contiguous masks get flagged as the typos they almost always are, and both computed network addresses display under the inputs — because “my device is on 192.168.17.0/24, yours is 10.215.113.0/24” is a much better opening line with IT than a screenshot of ipconfig.

A JavaScript footnote on the bitwise part

JS bitwise operators work on signed 32-bit integers, so an address like 192.168.17.1 (high bit set) goes negative the moment you AND it. Every operation in the tool is followed by >>> 0, the unsigned right-shift by zero, which is the idiomatic way to coerce back to an unsigned 32-bit value:

var network = (ip & mask) >>> 0;

The mask sanity check is a bit-trick worth knowing: a valid mask is 1-bits then 0-bits, so its inverse must be of the form 2ⁿ−1, and ((inv + 1) & inv) === 0 tests exactly that.

The usual field fix
  • Fastest: give the laptop a second static IP in the device's subnet — most OSes allow multiple addresses on one adapter, so you keep the site network and reach the device.
  • Right long-term: IT adds a route or puts the device VLAN behind the router. Their call, not a field improvisation [2].
  • 10.x, 172.16–31.x, and 192.168.x are private ranges — normal for industrial gear, never directly reachable from the internet [1].

Single file, vanilla JS, inputs persisted in localStorage, fully offline — which matters, because the moment you need this tool is precisely the moment the network doesn't work.

The tool: Industrial Subnet Clash Detector.

References

  1. [1] RFC 1918 — Address Allocation for Private Internets. https://www.rfc-editor.org/rfc/rfc1918
  2. [2] The site's IT/OT network administrator — the governing authority for anything beyond reading addresses.