Why the Guest Wi-Fi Dies Before the Keynote: Sizing Wi-Fi and Guest Subnets for Devices You Don't Control
The keynote starts at nine, and at twenty past nine the Wi-Fi stops working for everyone who walks in late. The people already seated are fine. The people in the registration line see the network name, tap it, watch the little spinner, and get a screen that says the connection has no internet. The event staff reboot an access point, which changes nothing, and by ten the story on the floor is that the venue's wireless has failed, while every radio is up and every access point is accepting connections as fast as devices ask. The network ran out of addresses to give, at almost exactly the moment the thousandth device arrived, and the reason was a decision made months earlier by someone who thought a thousand addresses for a six-hundred-person event was generous.
Wired networks come with a built-in ceiling. A floor has a certain number of jacks, each jack leads to one switch port, and the count of devices that can join is bounded by cabling that someone paid for and can point at. Wi-Fi removes that ceiling. The number of devices on a wireless network is decided by whoever walks through the door carrying them, and every one of those devices asks for an IP (Internet Protocol) address, the number that lets it send and receive traffic. On nearly every network the addresses come from DHCP (Dynamic Host Configuration Protocol), a service that keeps a pool of free addresses and lends one to each device for a set period called a lease. Our guide to DHCP, static addresses, and reservations covers how that loan works. This post is about a narrower question the loan raises on wireless networks: how many addresses does the pool need, and how long should each loan last, when you have no control over who shows up.
Three words carry the rest of the discussion. An SSID (Service Set Identifier) is the network name that appears in a phone's Wi-Fi list, and one building usually broadcasts a few of them: one for staff, one for guests, often one for printers and gadgets. A VLAN (virtual local area network) is a way of making one physical set of switches and access points behave as several separate networks, so that guests and staff share the same radios without sharing anything else, and our guide to VLANs and VRFs explains the machinery. A subnet is the block of addresses attached to a VLAN, written in the slash notation our visual guide to CIDR (Classless Inter-Domain Routing) walks through: a /24 holds 256 addresses, of which 254 are usable, and every step down in the number doubles the block, so a /23 holds 510 usable, a /22 holds 1,022, a /21 holds 2,046, and a /20 holds 4,094. The healthy arrangement maps each SSID to its own VLAN and its own subnet, and sizing comes down to which slash number each one gets.
Start by counting devices, because people are the wrong unit. A person on a corporate network in 2026 carries a laptop and a phone as a baseline and often a tablet, a watch, or a second phone, so planners who measure real networks land between two and three devices per head, and the peak of the day, when everyone is in and everything is awake, sits near the top of that range. Guests carry fewer, about two, but they arrive in bursts. A share of the devices on any wireless network belong to nobody in the room: the phones of people in the lobby whose handset remembered the guest network from a previous visit and joined it from the sidewalk, the visitor who connected in the parking lot to check a map, the contractor's laptop that stays connected all day from a van outside. Each of those takes an address, and each keeps it for the full length of its lease, whether or not its owner ever comes inside.
Lease length is the part that turns a comfortable pool into an empty one, because a lease outlives the device that took it. Think of the pool as a hotel with a fixed number of rooms and a checkout time set by the lease. With a lease of eight hours, a phone that connected at eight in the morning and left at nine still holds its room until four in the afternoon, and no arrival can have it. The pool therefore needs to hold every distinct device that shows up within one lease period, which for a day-long lease means every device that appears all day, and for a thirty-minute lease means roughly the number present at the busiest moment plus half an hour of recent departures. Our guide to subnet utilization and capacity planning works through the pool exhaustion math, and it makes the point that shortening the lease on a high-churn network behaves like an expansion of the pool without a single address changing. Modern phones add one more twist. Most phones and many laptops now invent a random MAC address (Media Access Control, the hardware identity a network uses to tell devices apart) for each Wi-Fi network they join, a privacy feature our post on tracing an address back to a physical device describes, and some can be set to invent a fresh one each time they come back after being away. To the DHCP server a fresh identity is a brand-new device, and it gets a brand-new lease while the old one sits in the pool until it expires.
With those pieces in place, the opening scene stops being mysterious. A /22 for guests holds 1,022 usable addresses, and after setting aside a dozen for the gateway and the captive portal (the sign-in page a guest network shows before letting a device out to the internet), the pool holds about 1,010. Six hundred registered attendees at 2.2 devices each is 1,320 devices, before counting forty staff, twenty-five exhibitor booths with a demo laptop, a lead-capture tablet, and a card reader apiece, and a rack of loaner tablets at registration. Roughly 1,500 distinct devices will ask for an address over the course of the day, and with an eight-hour lease the pool has to hold all of them at once, which it cannot. Here is the morning, hour by hour.
A /22 guest network with an eight-hour lease, on the day of a 600-person conference
07:30 doors open 1,010 free 12 addresses reserved for the gateway and captive portal
08:30 310 attendees in the lobby 490 free phones joined on arrival, laptops still in bags
09:00 keynote, 460 seated 30 free laptops open, a second device per person
09:20 the 1,010th device arrives 0 free every address is leased
09:30 late arrivals see "no internet" 0 free the access points are fine; DHCP has nothing to offer
12:00 half the room leaves for lunch 0 free their leases are held until mid-afternoon at the earliest
13:10 attendees return from lunch 0 free a few phones come back with a fresh random address and join the lineTwo changes rescue that day, and they work best together. A thirty-minute lease means a device that left at noon gives its address back by half past twelve, so the pool only ever has to hold the devices actually present plus a thin margin of recent departures, and on a modern DHCP server the extra renewal traffic from a few thousand devices is trivial. And a /21, 2,046 usable addresses, holds the whole event's peak with room for the exhibitors' surprise printers. For a two-thousand-person conference the same arithmetic points at a /19 or at splitting the crowd across several subnets, a technique covered below. The rule that generalizes is that a guest network should be sized for the biggest day the space can hold, because the ordinary Tuesday never files a ticket.
Wireless subnets end up larger than wired ones for a second reason that has nothing to do with headcount. When a device walks from one access point to the next, it keeps its address only if both access points put it in the same VLAN, and if it lands in a different subnet it has to get a new address, which drops every connection it had open, including the video call. So where the wired network can give every floor its own /24 from its own wiring closet, the Wi-Fi network needs one subnet per SSID across the whole area a person might walk through with a phone in hand, and in a headquarters that area is the entire building. Our guide to right-sizing subnets warns against large broadcast domains, since every device in a subnet hears every broadcast the others send, and the warning holds, with a wireless footnote. Enterprise access points quiet most of that noise by answering ARP (Address Resolution Protocol, the who-has-this-address question devices shout to find each other) on the client's behalf and by converting broadcast traffic into targeted packets, which is what makes a /20 of wireless clients workable where a /20 of wired desktops would be loud. On consumer or small-business gear without those features, stay at a /22 or smaller per SSID and let a short lease do the work. Past a /20, enterprise wireless systems offer VLAN pooling, which spreads one SSID's clients across several subnets, and that is the clean answer for a stadium or a campus.
One subnet per SSID, and few SSIDs. Each SSID an access point broadcasts costs airtime to advertise, so wireless engineers keep the count to three or four: corporate, guest, one for the printers and gadgets that cannot do proper authentication, and at some sites one for events. Every one of them deserves its own VLAN and subnet, because they differ in every way that matters: how much you trust the devices, what they may reach, how long their leases should run, and how big they need to be. Corporate Wi-Fi is treated like the wired user network, with a lease of a day, since the same devices return every morning. Guest Wi-Fi gets a lease of an hour or less, client isolation switched on (an access point setting that stops guest devices from seeing one another, so a visitor's laptop cannot poke at the next visitor's phone), and a firewall rule that allows the internet and nothing inside, written in the same plain-English style as our guide to segmenting cameras, badge readers, and other IoT (Internet of Things) devices. That guide gave its guest network a /23 because phones outnumber people, and the conference math above argues for going larger still wherever the lobby can fill with strangers. Decide where staff members' personal phones land, because a company that steers them to the guest SSID has just doubled its guest count on a normal day.
The sizing rule that falls out of all this fits in a sentence: multiply the people by the devices each one carries, add the strangers, and choose the subnet where that peak sits near half, so that growth and the event you have not planned for both fit under the 70 percent warning line. Written out for a few common shapes, it looks like this.
Wi-Fi subnet sizes by who is on the network
corporate Wi-Fi, small office 30 staff x 3 devices ~90 /24 254 lease 1 day
corporate Wi-Fi, branch 150 staff x 3 devices ~450 /22 1,022 lease 1 day
corporate Wi-Fi, headquarters 600 staff x 3 devices ~1,800 /20 4,094 lease 1 day
guest Wi-Fi, small office visitors and staff phones ~60 /24 254 lease 1 hour
guest Wi-Fi, branch visitors and staff phones ~250 /23 510 lease 1 hour
guest Wi-Fi, headquarters visitors, staff phones, events ~1,500 /20 4,094 lease 30 minutes
conference, 600 attendees attendees x 2.2, staff, booths ~1,200 /21 2,046 lease 30 minutes
conference, 2,000 attendees attendees x 2.2, staff, booths ~4,000 /19 8,190 lease 30 minutes, or VLAN poolingApplied to the worked plan for the fictional Meridian Logistics in our post on designing an IP plan from scratch, the rule redraws exactly two rows per site. That plan gave every site a /24 for corporate Wi-Fi and another for guest, the size a wired floor gets, and the Chicago headquarters, with 600 people, would fill its corporate /24 before the second cup of coffee. The plan's /16 per site was chosen precisely so a site could take a bigger block later without touching anything else, so the fix is to carve the Wi-Fi networks from the unused upper half of each site's /16, with VLAN numbers moved to match the third octet, the same trick the plan already used for its /23 server VLAN.
Meridian's Wi-Fi rows, redrawn for the real device count
site people corporate Wi-Fi guest Wi-Fi
Chicago HQ 600 10.0.128.0/20 VLAN 128 4,094 10.0.144.0/20 VLAN 144 4,094 lease 30 min, isolation on
Dallas 150 10.1.128.0/22 VLAN 128 1,022 10.1.144.0/23 VLAN 144 510 lease 1 hour, isolation on
Atlanta 100 10.2.128.0/22 VLAN 128 1,022 10.2.144.0/23 VLAN 144 510 lease 1 hour, isolation onAn address like 10.1.130.77 still reads the way the plan intended: Dallas, then a third octet inside the 128 block, so corporate Wi-Fi. The same layout at every site means the firewall rule that lets guests reach nothing but the internet is written once and copied. Our free subnet splitter shows the boundaries if you would rather see a /16 cut into /20s than work them out by hand, and the subnet calculator confirms the usable count for any block you pick.
On IPv6 (Internet Protocol version 6, the newer addressing system with room for every device on earth many times over), the sizing question evaporates. Every wireless network gets a /64, a block so large that a conference of a million phones would not dent it, and the only decision left is one subnet per SSID, which the VLAN design already made. Our guide to IPv6 address planning explains why conserving space there is the wrong instinct, and Wi-Fi is where that freedom pays off first, since the device counts that make IPv4 planning nervous stop mattering entirely.
Two records keep the plan honest after the access points go up. The first is the DHCP server's own count of leases in use against the size of the pool, which is the number that actually runs out, and the one to alert on at the 70 and 85 percent lines our utilization guide recommends, since a wireless subnet at 40 percent by address records can be at 95 percent by leases. The second is the plan itself. In IPCraft, an IPAM (IP Address Management, the tool that tracks which addresses exist and what they are for), each SSID's subnet becomes a record with its VLAN object attached, a description that names the SSID, the lease time, and the pool boundaries, and custom fields for the wireless controller and whether client isolation is on, so that the person who inherits the network can read the whole design from the subnet list. Record the handful of static addresses inside the block, the gateway and the captive portal, as address records marked reserved, and leave the individual guest leases where they belong, in the DHCP server, because a guest address changes owners every hour by design and a record of it is fiction by lunchtime. Corporate Wi-Fi is the exception, since the same laptops return daily, and a paste of the wireless controller's client list into scan reconcile will show which of them nobody has recorded. Give the VLANs names a stranger can decode, wifi-corp and wifi-guest rather than the wizard names our post on naming conventions warns about, and the design survives the person who drew it.
Run the conference again with the redrawn plan. Registration opens at half past seven onto a /21 with a thirty-minute lease, the keynote crowd takes 900 addresses and leaves about 1,100 free, the lunch exodus returns 400 to the pool by half past twelve, and the phones that come back with a fresh identity find plenty waiting. Nobody reboots an access point, and the only ticket of the day is an exhibitor asking why their printer cannot see the badge scanner, which is client isolation working as designed. The same shape scales down to a home network, where a guest SSID on its own VLAN with a one-hour lease keeps the relatives' phones away from the file server, and up to a campus, where it becomes VLAN pooling across a row of /21s. Wi-Fi is the one network whose population you do not choose, so choose the size and the lease with the biggest crowd in mind, and the address pool becomes the one thing at the event nobody talks about.