VLSM: Variable-Length Subnet Masking

Why VLSM

In traditional fixed-length subnetting, a single subnet mask is applied uniformly to every subnet you carve from a parent block. Every subnet therefore receives an identically sized block of addresses, regardless of how many hosts actually live on that segment. Real networks are lumpy: a large user LAN might need 60 addresses while a router-to-router link needs only 2. With one mask, you must satisfy your largest segment and apply that generous mask everywhere.

Consider a /28 mask (255.255.255.240), which yields 14 usable hosts. Apply that same /28 to a WAN link that needs only 2 usable addresses and you have wasted 12 addresses on a single link. Multiply that across dozens of point-to-point links and you have thrown away thousands of addresses for no reason.

Figure 8.1: Fixed /28 waste vs. right-sized /30 on a 2-host WAN link

VLSM is the technique of dividing a single IP network into subnets of different sizes by using more than one subnet mask within the same parent block. Rather than giving the 2-host WAN link a wasteful /28, VLSM lets you assign it a /30 (255.255.255.252), which provides exactly 2 usable addresses — precisely what a point-to-point link requires. Matching subnet size to the real requirement is called right-sizing, the heart of good address design.

The payoff from right-sizing is address conservation: because each subnet closely fits the devices it serves, few or no addresses go unused. Conservation was a founding motivation for VLSM and CIDR — slowing IPv4 exhaustion — but it matters inside private networks too: a well-conserved plan leaves clean, contiguous free space to grow into rather than a patchwork of exhausted blocks that forces a painful readdressing project later.

The VLSM Procedure

VLSM gives you freedom, and freedom demands discipline. Carve blocks carelessly and you get overlapping subnets or wasteful gaps. The single rule that prevents most mistakes: allocate the subnet with the most hosts first, then the next largest, and work down to the smallest links last. A large subnet needs a big, contiguous block aligned to its own boundary. Placing the big blocks first leaves a single, clean, contiguous free block at the end; allocating small subnets first can leave a later large subnet with no properly aligned space, fragmenting the parent into scattered, unusable gaps.

The full procedure:

• Step 1 — List requirements. Write down every segment with its required number of usable hosts.
• Step 2 — Size each segment. Take the host count, add 2 (network/subnet ID + broadcast), then round up to the next power of two for the block size, and read off the smallest prefix that fits. E.g., 60 → 62 → 64 → /26; 74 → 76 → 128 → /25.
• Step 3 — Sort largest to smallest. Descending order of block size.
• Step 4 — Allocate sequentially. Each new subnet starts exactly where the last ended; every network address is aligned to (a multiple of) its own block size.
• Step 5 — Verify overlap and alignment. Compute each subnet's network ID and broadcast (= network ID + block size − 1). Confirm each broadcast < the next network address (no overlap), and each network address is divisible by its block size (alignment).

Figure 8.2: The five-step VLSM allocation procedure

Keep this prefix reference table close while you work:

Overlap — two subnets whose ranges intersect — is the cardinal sin of subnet design; an address could belong to two segments at once and routing breaks. The largest-first, sequential-allocation approach makes overlap impossible: each block begins where the last ended and is aligned to its own size, so no two ranges can collide. Step 5 is your mathematical safety net.

Figure 8.4: The Step 5 verification checks per subnet

Worked VLSM Example

You are given 192.168.1.0/24 (256 addresses) and asked to accommodate: a Development LAN (74 hosts), Production LAN (52), Administration LAN (28), and three point-to-point WAN links (2 hosts each). No single uniform mask can serve all six sensibly — VLSM is the only answer.

Steps 1–2: Size each segment (add 2, round up to the next power of two):

Steps 3–4: Sort and allocate sequentially. The list is already largest-first. Development takes the first 128 addresses, Production the next 64, Administration the next 32, and the three WAN links 4 each:

Figure 8.3: Carving 192.168.1.0/24 into different-sized subnets, largest first

Step 5: Verify no overlap. Each broadcast lands exactly one below the next network ID — 127→128, 191→192, 223→224, 227→228, 231→232 — confirming no overlap and no wasted gap. Alignment passes too: 0, 128, 192, 224, 228, 232 are each divisible by their block sizes (128, 64, 32, 4, 4, 4). The last link ends at .235, leaving 192.168.1.236–.255 — a clean, contiguous block of 20 addresses — free for future growth precisely because we allocated largest-first.

/30 vs. /31 for point-to-point links. The traditional /30 gives 4 total addresses, 2 usable, reserving 2 for network and broadcast — addresses that do nothing on a two-endpoint link. RFC 3021 permits a /31, which gives 2 usable addresses with zero waste (no reserved network or broadcast). Many designs still standardize on /30 for compatibility and troubleshooting familiarity, but the /31 is the maximally conservative option.