VLSM Explained: Variable Length Subnet Masking for Network+

Variable Length Subnet Masking is the practice of using different subnet mask lengths within the same address block, sizing each subnet to the hosts it actually needs. It is the difference between cutting every board to the same length and cutting each one to fit. On the Network+ exam it appears both as a concept question and as a subnetting problem you have to work by hand.

The waste VLSM eliminates

Suppose you are given 192.168.10.0/24 and you need four networks: a user LAN with 100 hosts, a server segment with 25, a management segment with 10, and a point-to-point WAN link with exactly 2.

With fixed-length subnetting you must size every subnet for the largest requirement. Four subnets of /26 give you 62 usable addresses each — which fails immediately, because the user LAN needs 100. Go to /25 and you get 126 usable addresses per subnet, but a /24 only yields two /25s, so you cannot make four networks at all. Fixed-length subnetting has boxed you in while three of your four segments would sit nearly empty.

VLSM solves this by letting each subnet carry its own mask. The 2-host WAN link gets a /30 with exactly two usable addresses. The management segment gets a /28. The servers get a /27. The user LAN gets a /25. Everything fits inside the original /24 with room left over.

The largest-first rule

The one procedural rule that matters: always allocate the largest subnet first, then work down in descending size order. Allocate small subnets first and you fragment the block so the large ones no longer have a properly aligned space to sit in. Subnets must begin on a boundary that is a multiple of their own size, and small allocations scattered through the block destroy those boundaries.

A worked example

Take 192.168.10.0/24 and the four requirements above, sorted largest to smallest: 100, 25, 10, 2.

100 hosts needs 128 addresses, so a /25. Allocate 192.168.10.0/25 — usable range .1 to .126, broadcast .127. Next free address is .128.

25 hosts needs 32 addresses, so a /27. Allocate 192.168.10.128/27 — usable .129 to .158, broadcast .159. Next free is .160.

10 hosts needs 16 addresses, so a /28. Allocate 192.168.10.160/28 — usable .161 to .174, broadcast .175. Next free is .176.

2 hosts needs 4 addresses, so a /30. Allocate 192.168.10.176/30 — usable .177 and .178, broadcast .179.

Total consumed: 180 addresses out of 256, leaving 192.168.10.180 through .255 free for growth. The fixed-length approach could not even produce a working design from the same block.

The arithmetic to memorize

Usable hosts equal 2 raised to the number of host bits, minus two for the network and broadcast addresses. That gives /30 → 2 usable, /29 → 6, /28 → 14, /27 → 30, /26 → 62, /25 → 126, /24 → 254. Work from the requirement upward to the first prefix that covers it, and remember the minus two — a requirement for 30 hosts needs a /26, not a /27, because a /27 gives exactly 30 and leaves no room at all for growth.

Point-to-point links are the classic /30 case. A /31 can be used for routed point-to-point links where both ends support it, but Network+ expects /30.

What VLSM needs to work

Because the mask varies per subnet, routers cannot infer it — the routing protocol has to carry it. Classless protocols such as OSPF, EIGRP, and RIPv2 advertise the mask with each route and therefore support VLSM. The obsolete classful protocols do not, which is the historical reason VLSM is discussed alongside the retirement of IPv4 address classes.

In practice you apply VLSM inside RFC 1918 private ranges, and each resulting subnet becomes a scope on your DHCP server, so the scope boundaries and the subnet boundaries must match exactly. A scope that spans a subnet boundary hands out addresses that cannot reach their own gateway.

Exam angles

Expect to be handed a block and a list of host requirements and asked which subnet a given address belongs to, or what the next available network address is. Sort largest to smallest before you start, add two to every host requirement, and write down the next free address after each allocation. Know that VLSM requires a classless routing protocol, that summarization (CIDR) is the complementary idea working in the opposite direction, and that the point of the whole exercise is conserving addresses while keeping the block contiguous and summarizable.