VLSM Subnetting — Step-by-Step Worked Examples With Full Tables

Almost every real network has subnets of very different sizes: a few hundred laptops in one office, a dozen servers in another and a handful of two-address links between routers. Giving each the same size wastes addresses and sometimes makes the design impossible. VLSM is the technique that fixes that, and it is a staple of subnetting questions on Cisco CCNA and CompTIA Network+. If basic subnetting is still new to you, start with our subnetting guide and come back; this article assumes you know that a prefix length such as /26 means 26 network bits. The subnetting guide covers CIDR and general subnet maths; this page is the dedicated VLSM method, with two complete allocation tables you can follow line by line.

What is VLSM?

VLSM is the use of more than one subnet mask within the same classful or CIDR network. Plain subnetting divides a network into equal pieces; VLSM divides it into unequal pieces. Technically you take a subnet and subnet it again, and again, until every piece fits a requirement. The result is a set of non-overlapping subnets, each with the prefix length that best suits its host count, which all fit inside the address block you were given.

VLSM became practical with classless routing. Once routing protocols began to carry the subnet mask with every route, there was no longer any reason for a router to assume that every subnet of a network shares one mask. The wider system of dropping Class A/B/C boundaries is CIDR, described in RFC 4632; VLSM is how you apply it inside your own allocation.

Why use VLSM?

The reasons are practical, and exam questions test all of them:

• Address efficiency. A point-to-point link needs two addresses. Giving it a /24 (254 hosts) throws away 252. A /30 uses exactly what is needed.
• Room to grow. Addresses saved on small subnets stay in the pool for new sites and VLANs, which matters most when you are working within a private range or a small public allocation.
• Cleaner summarization. If you allocate sequentially from one block, a whole site can be advertised as a single summary route, which keeps routing tables small.
• Better fit to the design. VLANs, server segments, management networks and WAN links all have different sizes. VLSM lets the addressing plan follow the design instead of the other way round.

Private ranges are large (see our guide to private IP address ranges), so you can often afford to be generous inside a company. VLSM still matters because a clean, hierarchical plan is easier to summarize and troubleshoot, because overlapping ranges between sites cause real problems when networks merge, and because public IPv4 space is scarce. Comparing address sizes is also a good way to appreciate why IPv6 was designed with so much more room.

Prefix, mask and block size: the lookup table

Block size = 256 minus the mask value in the interesting octet. For /26 the mask value is 192, so the block size is 64. Memorize or rebuild this table; every VLSM problem uses it. Block size is the number of addresses in the subnet (2^n) and is also the step between consecutive subnet addresses in the interesting octet.

Quick formulas to keep in your head: usable hosts = 2^n - 2 (n is the number of host bits); block size = 256 - the mask value in the interesting octet (for /26, 256 - 192 = 64); broadcast = next subnet address - 1; first usable = network + 1; last usable = broadcast - 1. To find the right prefix for a host count, find the smallest power of two that is at least hosts + 2.

How do you do VLSM step by step?

1. List every subnet and its host requirement. Include router-to-router links (2 hosts each) and plan for growth if the brief says so.
2. Sort from largest to smallest. This is the step that keeps blocks aligned and prevents waste.
3. Choose the prefix for each. The smallest 2^n - 2 that is at least the requirement.
4. Allocate in order. The first subnet starts at the first address of your block. Each next subnet starts at the address right after the previous broadcast, which is always a valid multiple of its own block size when you go largest to smallest.
5. Verify. Check that no ranges overlap, that every subnet fits inside the original block, and that the sum of block sizes does not exceed the block.

Worked example 1: one /24 split six ways

Task: you are given 192.168.10.0/24. You need LAN A with 100 hosts, LAN B with 50, LAN C with 25, LAN D with 10, and two router-to-router links with 2 hosts each.

Choose prefixes. 100 hosts needs 7 host bits (2^7 - 2 = 126), so /25. 50 hosts needs 6 bits (62), so /26. 25 hosts needs 5 bits (30), so /27. 10 hosts needs 4 bits (14), so /28. A link needs 2 bits (2), so /30.

Verify. The blocks are 128 + 64 + 32 + 16 + 4 + 4 = 248 addresses, so the allocation ends at 192.168.10.247 and 192.168.10.248 to 192.168.10.255 (8 addresses) remains free for a future /29 or smaller. Each network address is a multiple of its block size (128, 64, 32, 16, 4, 4) and each next network equals the previous broadcast plus one, so nothing overlaps. With a single fixed mask the same job fails: six subnets need at least a /27 (8 subnets of 30 hosts), which cannot hold the 100-host LAN, while a /25 mask would give only two subnets.

Worked example 2: a larger design inside a /22

Task: you are given 172.16.0.0/22 (1,024 addresses, 172.16.0.0 to 172.16.3.255). Requirements: Sales 500 hosts, Engineering 250, HR 120, Guest Wi-Fi 60, Management 28, and three WAN links with 2 hosts each.

Choose prefixes. 500 hosts needs 9 host bits (2^9 - 2 = 510), so /23. 250 needs 8 bits (254), so /24. 120 needs 7 bits (126), so /25. 60 needs 6 bits (62), so /26. 28 needs 5 bits (30), so /27. Links use /30.

Verify. The blocks total 512 + 256 + 128 + 64 + 32 + 4 + 4 + 4 = 1,004 addresses out of 1,024. The allocation ends at 172.16.3.235, so 172.16.3.236 to 172.16.3.255 (20 addresses) is free. Notice the /23 spans two third-octet values: its range is 172.16.0.1 to 172.16.1.254 and the broadcast is 172.16.1.255, which is why you work in the octet where the mask changes. Because everything sits inside 172.16.0.0/22, the whole site can be advertised to the rest of the network as one summary route.

Check yourself

VLSM vs FLSM vs CIDR: what is the difference?

A useful way to remember the relationship: CIDR is the rule that any prefix length is allowed; VLSM is you using several prefix lengths on purpose inside one block; summarization is the same idea in reverse, combining many small prefixes into a shorter one. CIDR and VLSM questions often appear in the same exam item, so do not treat the terms as interchangeable.

What are the common VLSM mistakes?

• Forgetting the -2. A /26 holds 64 addresses but only 62 are usable. Choosing a prefix by raw block size causes off-by-two failures at exact boundaries (a 62-host LAN fits a /26; a 63-host LAN does not).
• Allocating small subnets first. This misaligns later blocks and leaves holes, as the callout above showed.
• Overlapping ranges. Two subnets that share any address break routing. Always compare each new network with the previous broadcast.
• Misaligned network addresses. 192.168.10.100/26 is not a valid network address; /26 networks start at .0, .64, .128 and .192. If the address is not a multiple of the block size, it is a host address inside a subnet, not the subnet itself.
• Ignoring links. The router-to-router segments need subnets too, and on a design with many sites they add up quickly.
• Leaving no room to grow. Fitting hosts exactly is fine for an exam, but a real plan reserves headroom, often by rounding up or leaving free space after each tier.
• Using VLSM with a classful protocol. RIPv1 is classful and cannot carry variable masks. Older EIGRP and RIPv2 configurations with auto-summary enabled can also break discontiguous designs, so turn auto-summary off with no auto-summary on those routers.

Which routing protocols support VLSM, and what about summarization?

VLSM works when each route update includes the mask. OSPF, EIGRP, IS-IS, BGP and RIPv2 are classless and support it. RIPv1 is classful and does not; our RIP guide explains why. Static routes always carry a mask, so they work with any design.

When a router holds overlapping routes, it uses the longest prefix match: the most specific route that contains the destination wins. That is why a /30 link route beats a /24 summary for traffic to the link, and why an accidental overlap can silently steal traffic. If you design sequentially, you can also summarize cleanly. The four LAN subnets in worked example 1 (192.168.10.0/25, .128/26, .192/27 and .224/28) together cover 192.168.10.0 to 192.168.10.239, which sits inside 192.168.10.0/24, so the whole site can be advertised upstream as that single /24.

How do you check your VLSM work?

Do the arithmetic by hand until it is automatic, so you do not rely on a calculator in the exam. For real designs, double-check with a tool. Oursubnet calculator shows network, range and broadcast for any prefix, and the Python standard library does the same in a few lines:

import ipaddress
net = ipaddress.ip_network("192.168.10.128/26")
hosts = list(net.hosts())
print(net.netmask, hosts[0], hosts[-1], net.broadcast_address)
# 255.255.255.192 192.168.10.129 192.168.10.190 192.168.10.191

Sanity checks that catch most errors: every network address is a multiple of its block size; each network starts exactly one address after the previous broadcast (or at a deliberate gap); and the sum of the block sizes is no larger than the parent block.

VLSM practice questions with answers

Work each out on paper before opening the answer. For a larger bank of subnetting and addressing scenarios use the CCNA practice exam or the CCNA practice questions article, and keep the CCNA cheat sheet open for the prefix table.

Frequently asked questions

How we wrote and checked this

CertSharp is a practice-exam provider, and we sell the CCNA practice questions linked in this guide. We wrote this article from RFC 4632, RFC 950, RFC 1918 and RFC 3021 and the exam topic pages, all linked in Sources. Every network, range and broadcast address in the worked tables was verified with a script using Python's ipaddress module, as were the totals and free ranges. Last reviewed October 2026. Cisco and CompTIA update their exam topics, so confirm scope on the official pages.

Sources and further reading

• RFC 4632: Classless Inter-domain Routing (CIDR)
• RFC 1918: Address Allocation for Private Internets
• RFC 950: Internet Standard Subnetting Procedure
• RFC 1519: CIDR, an Address Assignment and Aggregation Strategy (obsoleted by RFC 4632)
• Cisco Learning Network: CCNA 200-301 exam topics
• CompTIA Network+ certification page