Network Segmentation Calculator
Derive the number of network segments a design needs from trust levels, environments, tiers and host-count limits.
Inputs
For example untrusted, DMZ, corporate, restricted, OT.
Segments Required
90
Segments Driven by Policy
90
Segments Driven by Host Count
16
Average Hosts per Segment
44.4
Blast Radius per Segment
1.11%
Inter-Segment Policy Pairs
8,010
Step by step
Values used
Hosts to accommodate = 4,000 hosts; Trust levels = 5 levels; Environments = 3 environments; Functional tiers per environment = 6 tiers; Maximum hosts per segment = 250 hosts
Network Segmentation
segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)).
Segments Required
= 90
Segments Driven by Policy
= 90
Segments Driven by Host Count
= 16
Average Hosts per Segment
= 44.4
Blast Radius per Segment
= 1.11
Inter-Segment Policy Pairs
= 8,010
How it works
Two independent forces set the segment count. Policy requires a separate segment for every combination of trust level, environment and functional tier; capacity requires enough segments to keep each broadcast domain under your host ceiling. Take the larger, then note that inter-segment policy pairs grow as segments × (segments − 1). Blast radius per segment is the number that matters in an incident — it is the fraction of the estate an attacker reaches for free after landing on one host.
Formula
Network Segmentation
segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)).
- trust levels
- Distinct trust tiers your policy recognises
- max hosts per segment
- Broadcast-domain or failure-domain ceiling you accept
Frequently Asked Questions
How is Network Segmentation calculated?
segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)). Two independent forces set the segment count. Policy requires a separate segment for every combination of trust level, environment and functional tier; capacity requires enough segments to keep each broadcast domain under your host ceiling. Take the larger, then note that inter-segment policy pairs grow as segments × (segments − 1).
Why does Network Segmentation matter?
Blast radius per segment is the number that matters in an incident — it is the fraction of the estate an attacker reaches for free after landing on one host.
What values do I need to enter?
This calculator takes 5 inputs: Hosts to accommodate, Trust levels, Environments, Functional tiers per environment, Maximum hosts per segment. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why cap segments at around 250 hosts?
It is the /24 convention, and it holds up: broadcast and ARP traffic scale with host count, a MAC-flood or ARP-poisoning attack reaches everything in the domain, and troubleshooting a 4000-host flat VLAN is intractable. The cap is about failure-domain size, not addressing.
You might also need
- Micro-Segmentation CalculatorCommonly used together
- DMZ Capacity CalculatorCommonly used together
- ARP Spoofing Risk CalculatorCommonly used together
- Firewall Rule Count CalculatorCommonly used together
- MAC Spoofing Risk CalculatorCommonly used together
- Security Group Coverage CalculatorCommonly used together