VLSM in practice: allocating and aggregating subnets

VLSM is an allocation problem

Before CIDR, a network used a single mask for all of its subnets, fixed length. That means a link between two routers, which needs 2 addresses, gets the same block as a department of 50 machines. If the common mask is /26, each point-to-point link burns 64 addresses to use 2, wasting 62. Inside a single /24 (256 addresses) that runs out after a handful of links. VLSM (Variable Length Subnet Masking) fixes it by letting each subnet carry its own mask: the department takes a /26, the link takes a /31, and nobody steals space from anybody.

Fixed mask (no VLSM)

One mask for the whole network: you size by the LARGEST subnet and apply it to all.
A 2-host link on a /26: 62 addresses thrown away per link.
Simple to configure, expensive in addresses, impractical with scarce IPv4.

VLSM

Each subnet gets the smallest mask that fits it.
The 2-host link becomes a /31; the waste disappears.
Requires planning and an allocation order, the subject of this guide.

Sizing each subnet

A /n prefix reserves n bits for the network and leaves 32 − n bits for hosts. The number of addresses is 2 raised to the host bits, and the usable ones are that total minus 2, the first address names the network and the last is the broadcast, and neither goes on a network card. To plan, you work backwards: start from the host count and find the prefix.

H = 2^(32 - n) - 2

H: usable hosts in the subnet
n: prefix (network bits)
32 - n: host bits
- 2: network and broadcast addresses, not assignable

How many hosts a prefix holds. The −2 applies from /30 down; /31 and /32 are exceptions (see below).

n = 32 - ceil( log2( N + 2 ) )

N: hosts you need
+ 2: reserves network + broadcast
ceil: rounds up (you cannot borrow half a bit)

The prefix needed for N hosts. Example: N = 50 → log2(52) ≈ 5.70 → ceil = 6 → n = 26. Always round up. On a 2-host link, apply the /31 rule (RFC 3021) instead of /30, which is what the calculator does.

In practice you rarely compute the logarithm: you memorize each mask’s block size and step through it. The “block size” is how far apart subnets start. A /26 has a block of 64, so networks land at .0, .64, .128 and .192; a /28 has a block of 16 and starts at .0, .16, .32 and so on. Knowing the block size is what lets you list network, first host, last host and broadcast in your head.

Block size is the practical tool of subnetting: it tells you where the next network begins.
Prefix	Block size	Usable hosts	Where networks start (last octet)
/25	128	126	.0, .128
/26	64	62	.0, .64, .128, .192
/27	32	30	.0, .32, .64, …
/28	16	14	.0, .16, .32, …
/29	8	6	multiples of 8
/30	4	2	multiples of 4
/31	2	2 (RFC 3021)	multiples of 2

A complete plan, address by address

Let us take a case from start to finish. A company received the private block 192.168.1.0/24 (RFC 1918 space) and must address four departments and three point-to-point links between routers: Sales with 50 hosts, Engineering with 20, Support with 10, Finance with 5, and three links of 2 addresses each. All inside the 256 addresses of a single /24. The VLSM algorithm is always the same.

List and sortWrite down each segment with its host count and sort from largest to smallest: Sales 50, Engineering 20, Support 10, Finance 5, and the three links of 2.
Round up to the power of twoFor each, find the smallest block that fits: 50 → /26 (block 64), 20 → /27 (32), 10 → /28 (16), 5 → /29 (8), 2 → /31 (2, per RFC 3021).
Allocate in sequenceStart at the beginning of the /24 (.0) and step by the block size at each allocation: .0 (Sales), .64 (Engineering), .96 (Support), .112 (Finance), then .120, .122 and .124 for the links.
Align each blockEvery network starts on a multiple of its block size. If the cursor lands in the middle of a boundary, jump to the next one, this is where allocating out of order opens gaps.
Repeat and verifyRepeat to the last segment and check that no range overlaps and everything fits. Here, the last used address is .125, .126 to .255 are left to grow.

The closed plan: each subnet starts exactly where the previous one ended, no gap and no overlap. On the /31 links there is no network or broadcast, both addresses belong to the routers.
Subnet	Hosts needed	Prefix	Network	Usable range	Broadcast
Sales	50	/26	192.168.1.0	.1 – .62	192.168.1.63
Engineering	20	/27	192.168.1.64	.65 – .94	192.168.1.95
Support	10	/28	192.168.1.96	.97 – .110	192.168.1.111
Finance	5	/29	192.168.1.112	.113 – .118	192.168.1.119
Link R1–R2	2	/31	192.168.1.120	.120 – .121	—
Link R2–R3	2	/31	192.168.1.122	.122 – .123	—
Link R3–R4	2	/31	192.168.1.124	.124 – .125	—

Notice how the fit closes: Sales occupies .0–.63, so Engineering starts at .64; it runs to .95, so Support starts at .96; and so on, without a single address lost between ranges. The total consumed is 64 + 32 + 16 + 8 + 2 + 2 + 2 = 126 addresses, leaving 130 free (.126 to .255). It is exactly this fit that the subnet calculator’s VLSM mode automates, even totaling how many addresses each range wastes. Paste the /24 and the seven demands into the block below and compare against the table.

VLSM mode: enter 192.168.1.0/24 and the demands (50, 20, 10, 5, 2, 2, 2). The tool sorts, allocates and shows the network, range and waste of each subnet, the same numbers as the table.Open the tool full page

Sales /2612

Engineering /2710

Support /284

Finance /291

R1–R2 /310

R2–R3 /310

R3–R4 /310

The cost of rounding up to a power of two: usable addresses allocated minus hosts needed, per subnet (the waste the calculator reports). The cost concentrates in the big blocks whose demand landed just above a boundary; the three /31 links waste zero, that is the RFC 3021 payoff.

View the data

Category	Value
Sales /26	12
Engineering /27	10
Support /28	4
Finance /29	1
R1–R2 /31	0
R2–R3 /31	0
R3–R4 /31	0

Summarization: the way back

Subnetting splits a block into smaller pieces; summarization (or route aggregation, or supernetting) does the opposite: it merges several neighboring blocks into a single shorter route. This is what keeps the internet routing table from listing every network individually. A provider that received a /16 can announce a single /16 route to its neighbors instead of the 256 /24 routes that live inside it. Fewer entries, less router memory, faster convergence. RFC 4632, the CIDR specification, was written precisely around this hierarchical allocation: hand out addresses in blocks that can be aggregated up the hierarchy.

Summarization / aggregation: Representing a set of contiguous subnets by a single shorter prefix that covers them all.
Supernet: The aggregated prefix, shorter than the subnets it encompasses (the opposite of a subnet).
Longest common prefix: The number of leading bits identical across all blocks; it becomes the aggregate’s prefix.

1993CIDR (RFC 1519)
Variable-length prefixing replaces the A/B/C classes and introduces aggregation as the cure for routing-table growth.
1995VLSM table (RFC 1878)
Publishes the subnet-mask table that became a pocket reference. It is Informational and today classified as Historic, useful as a reference, with no normative standing.
1996Private space (RFC 1918)
Reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for internal networks, the space where most VLSM plans happen.
2000/31 on links (RFC 3021)
Authorizes /31 on point-to-point links: both addresses become hosts, with no network or broadcast, saving 2 addresses per link.
2006CIDR consolidated (RFC 4632)
Replaces RFC 1519 and becomes the Best Current Practice (BCP 122) that still governs address allocation and aggregation on the internet.

Aggregating four /26 into a /24

Finding the aggregate is an exercise in looking at the addresses in binary and seeing how far the bits agree. Take the four /26 subnets from the same /24: 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26 and 192.168.1.192/26. They are contiguous and together cover .0 to .255. Write the networks in binary and align the prefixes:

192.168.1.0/26    11000000.10101000.00000001.00000000
192.168.1.64/26   11000000.10101000.00000001.01000000
192.168.1.128/26  11000000.10101000.00000001.10000000
192.168.1.192/26  11000000.10101000.00000001.11000000
                  └──────── 24 bits ───────┘ ↑↑
                                             estes 2 bits variam: 00 01 10 11

192.168.1.0/24    11000000.10101000.00000001.00000000

atalho: 2^2 = 4 blocos contiguos e alinhados  ->  26 - 2 = /24

The first three octets (192.168.1) are identical across all four: 24 identical bits. In the last octet, only the first two bits change, taking 00, 01, 10 and 11. Since those 2 bits vary, the longest common prefix is 24, the aggregate is 192.168.1.0/24. Shortcut: 4 = 2^2 contiguous, aligned blocks, so the prefix shortens by 2 bits (26 − 2 = 24).

Two conditions must hold for the aggregate to be honest. First, the blocks must be contiguous and leave no gaps, the four /26 fill the entire /24. Second, the aggregate must be aligned: a /24 starts at .0, and that is where the first /26 starts. If you only had three of the four /26 (say, without .192/26), announcing a /24 would be a lie, because it would include .192–.255, which are not yours. The best you could do there is aggregate the first two into a /25 (192.168.1.0/25 covers .0–.127) and leave .128/26 on its own, two routes instead of one. Non-contiguous blocks, or blocks that cross a power-of-two boundary, simply do not aggregate.

When the same destination matches more than one route, the router does not hesitate: it forwards via the longest-prefix route, the most specific one. RFC 1812 (Requirements for IPv4 Routers) mandates this behavior, longest prefix match. That is why a more specific /24 route beats the /16 supernet that contains it, and why announcing a more specific block attracts that range’s traffic even with an aggregate route present. Aggregation shrinks the table; more-specifics bloat it again, and that is the permanent tension of global routing. In January 2026 the IPv4 BGP table was already around 1.05 million routes, with /24, /23 and /22 prefixes accounting for 84% of the total, a sign of how much de-aggregation there is. The number keeps growing and should be read as an order of magnitude, not a fixed figure.

Verification and edge cases

Sorted from the largest subnet to the smallest before allocating.
Each network starts on a multiple of its block size (correct boundary).
Applied the −2 on /30 or larger blocks; used /31 on point-to-point links.
No range overlaps and everything fits inside the source block.
The gateway did not land on the network or broadcast address.
To aggregate: contiguous blocks, a power-of-two count, aligned on the aggregate boundary.

/31 on point-to-point links: why it saves 2 addresses

A link between two routers has exactly two ends. With a classic /30, the 4-address block spends 1 on the network, 1 on the broadcast and leaves 2 for the routers, half thrown away. RFC 3021 noted that a point-to-point link needs no broadcast (there is only one other side to talk to) and no separate network address, and authorized the /31: both addresses in the block become host addresses. Result: 2 addresses used of 2 allocated, zero waste, versus 2 of 4 on the /30.

In this guide’s case, the three /31 links spend 6 addresses in total. On /30 they would spend 12, double. Saving 2 per link sounds small, but on a network with hundreds of WAN links it hands back entire blocks. The only caveat is that very old gear may not support /31; there, the /30 remains the safe fallback.

Longest prefix match: how the router chooses

The routing table may hold several routes matching the same destination: a default 0.0.0.0/0, a /16 supernet, a specific /24 and even a host /32. The router does not add them up or pick at random, it chooses the longest prefix, that is, the one matching the most bits with the destination. A /24 (24 matching bits) beats a /16 (16 bits); a /32 beats them all. It is this rule, required by RFC 1812, that lets aggregation and more-specific announcements coexist: the supernet covers the general case, and a more specific route diverts exactly the range that needs different handling.

When VLSM is not worth it

VLSM trades addresses for complexity. In private IPv4, where you have a whole /8 (16 million addresses) to play with, many teams deliberately standardize everything on /24: each VLAN becomes a /24, the third octet becomes the VLAN number, and reading the plan is trivial. It wastes addresses nobody misses and removes boundary mistakes. Save tight VLSM for where space is genuinely scarce, public blocks, a single /24 like the example, or WAN links, not for a roomy internal network.

In IPv6 the math changes entirely: the recommendation is to give each subnet a /64 regardless of host count, so there is no “sizing by host”. What survives from VLSM there is the prefix hierarchy and aggregation; summarization, in fact, matters even more in IPv6.

With the plan closed, the guide on public and private IP helps decide which of these ranges reach the internet via NAT and which stay on the LAN. And if the theory of the prefix and mask still feels fuzzy, go back to the sibling guide on CIDR, IPv4 subnet and IPv6 before configuring in production.

Frequently asked questions

Why allocate from the largest subnet to the smallest?

Because large blocks only fit on specific boundaries (a /26 starts on multiples of 64). If you place the small ones first, they land in the middle of those boundaries and there is no longer a contiguous stretch big enough for the large block. Starting with the largest, each block finds its boundary and the smaller ones fill the rest with no gaps and no overlap.

What is the difference between subnetting and summarization?

They are opposite moves. Subnetting splits a block into smaller subnets (a longer prefix), to organize an internal network. Summarization, or aggregation, merges contiguous subnets into a single shorter prefix (the supernet), to shrink the routing table. An admin subnets inside their network; providers and edge routers summarize to announce fewer routes to the world.

Should I use /30 or /31 on a point-to-point link?

Use /31 when the gear supports it. RFC 3021 allows /31 on point-to-point links: both addresses in the block become hosts, with no network or broadcast, and you save 2 addresses per link compared with /30. The /30 (2 usable hosts out of 4 addresses) only still makes sense on old hardware that does not implement /31.

How do I know if a set of subnets can be aggregated?

Three conditions: the blocks must be contiguous (no gaps), must be a power-of-two count (2, 4, 8…), and the first must be aligned on the aggregate boundary. If all three hold, write the networks in binary and count the leading identical bits, that is the longest common prefix, and it is the supernet’s prefix. Four contiguous, aligned /26, for instance, become a /24 (26 − 2 = 24).

What is longest prefix match?

It is the forwarding rule: when a destination matches several routes, the router picks the longest prefix, that is, the most specific one. A /24 beats a /16 containing it; a /32 beats them all. RFC 1812 requires this behavior, and it is what lets an aggregate route (general) coexist with more specific routes (that divert particular ranges).

Does VLSM exist in IPv6?

The concept of variable-length masks exists, but its use changes. In IPv6 the recommendation is to give each subnet a /64, regardless of how many hosts it has, the space is enormous, so you do not size by host as in IPv4. What still holds is the prefix hierarchy and route aggregation; in fact, summarization matters even more in IPv6 to keep the routing table lean.

VLSM is allocation: sort largest to smallest, size each subnet with prefix = 32 − ceil(log2(N + 2)), allocate in sequence respecting the block size, and use /31 on point-to-point links (RFC 3021). The way back is summarization: 2^k contiguous, aligned blocks become a prefix k bits shorter, found by the longest common prefix in binary. Aggregate only what is contiguous and aligned, and remember the router always forwards via the most specific route (longest prefix match).

Sources & references

NetworkingCIDR, IPv4 subnet and IPv6: what the mask does in binaryA subnet mask is a bit-by-bit operation, not a memorized table. This guide opens the binary AND that produces the network address, shows why CIDR replaced Class A/B/C and why IPv6 drops broadcast and NAT.NetworkingPublic vs private IP: NAT, CGNAT and what your IP revealsThe RFC 1918 private ranges, how NAT really translates port and state, why CGNAT makes your public IP not yours, and why IP geolocation points at the provider, not your home.DevelopmentCron expressions explained (and the OR trap)The five cron fields, the * , - / operators, the @daily/@reboot shortcuts, the non-POSIX Quartz extensions and the rule almost everyone gets wrong: when day-of-month and day-of-week are an OR, not an AND.