Writing

VLSM explained

Published 15 September 2026

Variable length subnet masking means using different prefix lengths inside one network instead of subnetting it into equal pieces. There are only two rules that matter: allocate the largest subnet first, and start every block on a multiple of its own size, and almost every VLSM mistake is a violation of the second one.

The problem it solves

Split 192.168.10.0/24 into four equal /26 blocks and every network gets 62 usable addresses. That is generous for a point-to-point link between two routers, which needs exactly two, and it means 60 wasted addresses per link. Do that across a dozen sites and you have burned an entire /24 on nothing.

VLSM lets each network be the size it actually needs: a /26 for the office, a /30 for the link. Same parent block, different masks.

A worked VLSM example

You have 192.168.10.0/24 and these requirements:

• Sales: 50 hosts
• Engineering: 25 hosts
• Operations: 12 hosts
• Two router-to-router links: 2 hosts each

Sort by size, largest first. This is not a stylistic preference; the next section explains why it is load-bearing. Then take each in turn, pick the smallest prefix that fits, and place it at the next free address.

Everything from 192.168.10.120 to .255 is still free: 136 addresses left over. Equal-sized /26s would have used the whole block and left nothing.

Note how each prefix is the smallest that fits, not the smallest that matches. Sales needs 50 and a /26 gives 62, because the next size down (a /27) gives only 30. There is no prefix that yields exactly 50; you always round up to the next power of two.

Why largest first is not optional

A subnet must begin at an address that is a multiple of its own size. A /26 spans 64 addresses, so it can only start at .0, .64, .128 or .192. It cannot start at .16, however much free space follows.

Allocate small blocks first and you strand yourself. Place the two /30s at .0 and .4, then Operations at .8, and the next free address is .24, but a /26 cannot begin at .24. Nor at .32, .48 or .96 in a way that keeps everything else intact. You have plenty of free addresses and nowhere to put the thing that needs them.

Going largest first makes alignment take care of itself, because every block you place ends on a boundary the next smaller size can start from.

The mistake that produces overlapping subnets

The classic error is adding the usable host count to the start address instead of the block size. Sales at 192.168.10.0/26 has 62 usable hosts, so the next network goes at .62: except the /26 owns through .63, and .62 is inside it.

Two subnets now overlap. Routing will be inconsistent in a way that looks intermittent rather than broken, which is the worst kind of fault to chase.

Always advance by the block size, not the host count. A /26 is 64 addresses; the next block starts 64 later. The usable count is what you tell the people using it, never what you plan with.

Use /31 for the links

The example above uses /30 for the router links because that is what most courses still teach. A /31 does the same job with two addresses instead of four: RFC 3021 allows both addresses to be assigned on a point-to-point link, since there is nothing to broadcast to that is not simply the other end.

Swapping the two /30s for /31s in the plan above frees four more addresses and every current router platform supports it. The subnet mask table covers why /31 and /32 behave differently from every row above them.

How to check your own plan

1. Does every subnet start on a multiple of its own size?
2. Does each block's first address come immediately after the previous block's last: no gaps you did not intend, no overlaps?
3. Does every subnet sit entirely inside the parent block?
4. Does each one have enough usable addresses, having subtracted network and broadcast?

Four questions, and a plan that passes all four works. The one that catches people is the first.