22

According to Amazon and my test, a /24 VPC subnet allows for 251 available IP addresses. I have 2 other subnets in that VPC that appear to have no IP's in use by EC2 and the available IPs field indicates that there are only 250 available. I have checked

I am trying to figure out which resources are using those IP's but it seems AWS does not allow for that kind of query.

What I would like to see is a list of resources that are using IP's for a specific VPC subnet.

If anyone can shed some light as to what AWS services can use subnet IP's except for EC2 that would also help.

Thanks.

ilanco
  • 323
  • 1
  • 2
  • 5
  • To avoid PEBKAC errors can you please add a screenshot of your VPC subnets showing this, plus one of your EC instances filtered to the subnet ID in question. Redact anything sensitive. Check RDS and anything that can create instances - Redshift, DMS, Elasticache, maybe data pipeline, EMR, maybe even VPN or direct connect, etc. – Tim Feb 10 '17 at 00:34
  • Agree with the above, also ELBs will use subnet IPs. – c4urself Feb 10 '17 at 02:42

1 Answers1

35

In the EC2 console, in the navigation pane on the left, click Network Interfaces.

Everything with an IP address -- EC2 instances, ELBs, NAT Gateways, RDS instances (to name some of the more common ones) has at least one virtual NIC called an Elastic Network Interface (ENI).

Each ENI typically has a primary private IPv4 address and may have one or more secondary IPv4 address.

There should not be anything with an IP address in your VPC that doesn't appear here.

The exception is the unavailable and reserved addresses, which aren't shown. The all-zeroes "network" address and all-ones "broadcast" address are unavailable by the rules of subnetting, and the network address +1, +2, and +3 (.1, .2, .3 in a /24), are reserved by the VPC infrastructure. This (256 -2 -3 = 251) establishes the baseline maximum available for /24 networks of 251 addresses.

The missing address in your configuration would presumably be your NAT Gateways, but in any event you should be able to find it under Network Interfaces.

An ELB under light load will also establish 1 ENI in each subnet where it is configured. If the ELB automatically scales up (out) significantly under load, it will need to establish more ENIs, and this is one important reason not to size your subnets based only on the forecasted number of instances.

Possibly worth mentioning: the peering addresses for VPC Hardware VPN and AWS Direct Connect are assigned from the IPv4 Link Local address space 169.254.0.0/16. These connections have access to but are not actually "on" any VPC subnet, so they don't consume any addresses from your VPC's private address space.

Michael - sqlbot
  • 21,988
  • 1
  • 57
  • 81