Reference
Tools and calculators
Small utilities that answer the questions that come up in design reviews and change records, with the reasoning shown, not just the number.
Subnetting
Subnet & CIDR calculator
Enter any IPv4 address and prefix length to get the network, broadcast, mask, usable range and host count.
- Network
- 10.42.16.0
- Broadcast
- 10.42.19.255
- Subnet mask
- 255.255.252.0
- Wildcard mask
- 0.0.3.255
- First usable
- 10.42.16.1
- Last usable
- 10.42.19.254
- Total addresses
- 1,024
- Usable hosts
- 1,022
Recovery objectives
RPO / RTO planner
Recovery objectives are commitments about backup frequency and restore capacity. This shows what the numbers actually require.
- Required backup interval
- at least every 60 minutes
- Restore throughput needed
- 500 GB/hour
- Sustained link speed
- 1.11 Gbps
This is the minimum sustained rate with no allowance for verification, dependency ordering, DNS propagation or application startup. Real recovery plans add those, and the only way to know the true figure is a tested restore.
Availability targets
Availability and downtime budget
A service level percentage is a downtime allowance. Dependencies in series multiply, so a chain of individually reliable components is less available than any one of them.
- Allowed downtime per day
- 1.4 min
- Per 30 days
- 43.2 min
- Per year
- 8.8 h
- Chain availability if every component hits the target
- 99.7003 %
- Availability each component needs to reach the target
- 99.9667 %
Each dependency in the request path reduces the achievable total.
This is the number to design and contract against, not the headline figure.
Transfer and restore windows
Data transfer and restore window
Link speed is not throughput. Protocol overhead, latency, disk and encryption reduce what a migration or restore actually achieves, which is why a restore window is a capacity calculation, not an aspiration.
- Transfer time
- 1.6 h
- Effective rate
- 87.5 MB/s
- Within an 8 hour window?
- Yes
Compare against measured throughput, not the interface speed.
If not, the answer is seeding, parallel streams or a shorter recovery scope.
Backup retention capacity
Backup retention capacity planner
A grandfather father son retention scheme sizes the repository. Estimates assume synthetic fulls with incremental forever, and reduction figures should be replaced with the ratio your own platform reports rather than a vendor claim.
- Restore points retained
- 51
- Before reduction
- 190.0 TB
- Repository size to provision
- 95.0 TB
Add headroom for growth, and size the immutable copy separately.
DNS records
| Record | Purpose | Common misconfiguration |
|---|---|---|
| A / AAAA | Maps a name to an IPv4 / IPv6 address | Stale records after a migration; forgotten AAAA record still pointing at a decommissioned host |
| CNAME | Aliases one name to another name | A CNAME at the zone apex, or a CNAME coexisting with other records at the same label, both invalid |
| MX | Names the mail servers for a domain, with priority | Multiple equal priority records pointing at retired servers; MX pointing at a CNAME |
| TXT | Arbitrary text, used for SPF, DKIM keys and verification | Multiple SPF records in one zone, which is invalid and causes SPF to fail |
| SPF (via TXT) | Lists which servers may send mail for the domain | Exceeding ten DNS lookups, or omitting a service that legitimately sends mail |
| DKIM (via TXT) | Publishes the public key used to verify mail signatures | Rotating the private key without publishing the new selector |
| DMARC (via TXT) | Declares policy for mail that fails SPF and DKIM | Leaving policy at p=none indefinitely, which provides reporting but no protection |
| NS | Delegates a zone to authoritative name servers | Delegation left pointing at a former provider after a migration |
| SOA | Zone metadata: serial, refresh and expiry values | Serial not incremented, so secondaries never pick up changes |
| SRV | Advertises the host and port for a service | Wrong port or priority, breaking client autodiscovery |
| PTR | Reverse lookup from an address to a name | Missing PTR for a mail server, causing receiving systems to reject the mail |
| CAA | Restricts which certificate authorities may issue for the domain | Set restrictively, then forgotten, blocking a later certificate renewal |
Network troubleshooting checklist
- Layer 1, link light, cable, correct port, correct SFP, no error counters climbing.
- Layer 2, correct VLAN, correct native VLAN on trunks, MAC address learned, no port security violation.
- Layer 3, address and mask correct, gateway reachable, no duplicate address, route present on both directions of the path.
- Name resolution, resolving with the correct servers, and answers matching the authoritative zone.
- Layer 4, the destination port is actually listening, and no firewall in the path is dropping the session.
- Policy, NAC posture, web filtering category, Conditional Access, or proxy authentication.
- MTU, small requests succeed and large transfers stall, on any tunnelled path.
Incident response first hour
- Declare it. Name an incident commander and a single communication channel before anything else.
- Preserve evidence before remediating: memory and disk images, log exports, and identity sign in data that ages out quickly.
- Scope before containing where you safely can, containing one host while missing the rest teaches the intruder you are watching.
- Contain identity as well as endpoints: revoke sessions and refresh tokens, reset credentials, and remove attacker created access such as app registrations, inbox rules and MFA methods.
- Verify backups are intact and offline before touching production systems.
- Record a timeline as you go, with timestamps and time zones. Reconstructing it afterwards is far harder.
- Involve legal, insurance and any regulatory notification obligations early, not after remediation.