Skip to content
ENExplore Calculators

Network Segmentation Calculator

Derive the number of network segments a design needs from trust levels, environments, tiers and host-count limits.

About Network Segmentation Calculator

Two independent forces set the segment count. Policy requires a separate segment for every combination of trust level, environment and functional tier; capacity requires enough segments to keep each broadcast domain under your host ceiling. Take the larger, then note that inter-segment policy pairs grow as segments × (segments − 1). Blast radius per segment is the number that matters in an incident — it is the fraction of the estate an attacker reaches for free after landing on one host.

Formula

Network Segmentation

segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)).

trust levels
Distinct trust tiers your policy recognises
max hosts per segment
Broadcast-domain or failure-domain ceiling you accept

Worked example

With the default values below, Network Segmentation Calculator returns Segments Required of 90. Change any input above and every figure here is recalculated in your browser.

Inputs used

Hosts to accommodateaccepts 1–10,000,000 hosts
4,000 hosts
Trust levelsaccepts 1–20 levels
5 levels
Environmentsaccepts 1–20 environments
3 environments
Functional tiers per environmentaccepts 1–40 tiers
6 tiers
Maximum hosts per segmentaccepts 2–8,000 hosts
250 hosts

Results

Segments Required
90
Segments Driven by Policy
90
Segments Driven by Host Count
16
Average Hosts per Segment
44.4
Blast Radius per Segment
1.11%
Inter-Segment Policy Pairs
8,010

Step by step

  1. 1Values used
  2. 2Network Segmentation
  3. 3Segments Required= 90
  4. 4Segments Driven by Policy= 90
  5. 5Segments Driven by Host Count= 16
  6. 6Average Hosts per Segment= 44.4
  7. 7Blast Radius per Segment= 1.11
  8. 8Inter-Segment Policy Pairs= 8,010

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Network Segmentation calculated?

segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)). Two independent forces set the segment count. Policy requires a separate segment for every combination of trust level, environment and functional tier; capacity requires enough segments to keep each broadcast domain under your host ceiling. Take the larger, then note that inter-segment policy pairs grow as segments × (segments − 1).

Why does Network Segmentation matter?

Blast radius per segment is the number that matters in an incident — it is the fraction of the estate an attacker reaches for free after landing on one host.

What values do I need to enter?

This calculator takes 5 inputs: Hosts to accommodate, Trust levels, Environments, Functional tiers per environment, Maximum hosts per segment. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why cap segments at around 250 hosts?

It is the /24 convention, and it holds up: broadcast and ARP traffic scale with host count, a MAC-flood or ARP-poisoning attack reaches everything in the domain, and troubleshooting a 4000-host flat VLAN is intractable. The cap is about failure-domain size, not addressing.

Related Calculators

Network Segmentation Calculator | Calcrivo