Derive the number of network segments a design needs from trust levels, environments, tiers and host-count limits.
Two independent forces set the segment count. Policy requires a separate segment for every combination of trust level, environment and functional tier; capacity requires enough segments to keep each broadcast domain under your host ceiling. Take the larger, then note that inter-segment policy pairs grow as segments × (segments − 1). Blast radius per segment is the number that matters in an incident — it is the fraction of the estate an attacker reaches for free after landing on one host.
Network Segmentation
segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)).
segments = max(trust levels × environments × functional tiers, ceil(hosts ÷ max hosts per segment)). Two independent forces set the segment count. Policy requires a separate segment for every combination of trust level, environment and functional tier; capacity requires enough segments to keep each broadcast domain under your host ceiling. Take the larger, then note that inter-segment policy pairs grow as segments × (segments − 1).
Blast radius per segment is the number that matters in an incident — it is the fraction of the estate an attacker reaches for free after landing on one host.
This calculator takes 5 inputs: Hosts to accommodate, Trust levels, Environments, Functional tiers per environment, Maximum hosts per segment. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It is the /24 convention, and it holds up: broadcast and ARP traffic scale with host count, a MAC-flood or ARP-poisoning attack reaches everything in the domain, and troubleshooting a 4000-host flat VLAN is intractable. The cap is about failure-domain size, not addressing.