Variable Length Subnet Masking (VLSM) Calculator

Variable Length Subnet Masking (VLSM) Calculator

VLSM allocates different subnet sizes from one address block. Each segment gets exactly the prefix length it needs instead of one uniform size.¹

Before VLSM, classful routing required every subnet to be the same size, wasting address space in segments with few devices. VLSM lets you carve a /24 into a /27 for an office floor (30 hosts), a /29 for a server room (6 hosts), and a /30 for a router-to-router link (2 hosts). This precise allocation is essential in constrained address spaces like enterprise campus networks and cloud VPCs where you pay for each address block you reserve.

How VLSM allocation works

Calculating a VLSM design starts with sorting all network segments by device count, largest first.² For each segment, find the smallest prefix where 2^(32-n) - 2 covers the device count plus 20 to 30 percent headroom.³ Assign the first available block of that size from the parent address space, then move to the next non-overlapping boundary for the subsequent segment.

Why largest subnets come first

Assigning the largest subnet first minimizes wasted space because a /26 must start on a 64-address boundary, and starting it after a /30 wastes 58 addresses of padding. Building on this, each subnet boundary must align naturally: a /27 starts at an address divisible by 32, a /28 at a multiple of 16, and a /30 at a multiple of 4, so placing large blocks first guarantees they fit on their required boundaries.

Visualize the allocation as filling a truck from the biggest crates downward. A /16 parent holds 65,534 usable addresses, and if you reserve the /24 for the main office first, the remaining 63,486 addresses stay contiguous for smaller blocks. CapyToolkit confirms each boundary as you allocate, so you can see the next free starting address before assigning the next segment.

VLSM in cloud and campus networks

AWS VPC subnet design is inherently VLSM: a /16 VPC CIDR is subdivided into /24 application subnets, /27 gateway subnets, /28 database subnets, and /30 transit gateway attachments, each sized for its function.⁴ Building on this, enterprise campus networks use VLSM to carve a single /16 into floor subnets (/24), server subnets (/26), management subnets (/28), and point-to-point WAN links (/30) from a coherent address plan. Yet the planning discipline is the same in both contexts: sort by size, allocate from the largest block downward, and verify that each subnet boundary aligns correctly. Consequently, misaligned boundaries, such as a /26 starting at 192.168.1.70 instead of 192.168.1.64, cause routing failures that are difficult to diagnose.

Using the subnet calculator for VLSM

The subnet calculator assists with each individual allocation in a VLSM design. Enter the starting address and desired prefix to confirm the exact network address, block size, usable host range, and next available starting address after that block. Consequently, you can walk through the allocation list segment by segment, verifying each block before moving to the next. For a /24 being subdivided: enter 192.168.1.0/26 and the calculator confirms the first subnet ends at 192.168.1.63, so the next subnet starts at .64. Enter 192.168.1.64/28 and it ends at .79. Enter 192.168.1.80/30 and it ends at .83. Each verification step prevents misaligned boundaries from entering the final design.

VLSM and route summarization interaction

VLSM and route summarization are complementary: VLSM conserves address space within a site, while summarization reduces routing table size between sites. A branch office that uses VLSM to carve 10.0.0.0/22 into a /24 for workstations, a /26 for servers, and a /30 for the WAN link can advertise a single 10.0.0.0/22 summary route to headquarters. The headquarters router does not need to know about the individual subnets; it sends all 10.0.0.x traffic to the branch, where the branch router's more specific routes handle local delivery.

Finding the correct summary prefix

Building on this, the summary route must cover only the subnets that actually exist. If the branch advertises 10.0.0.0/22 but only uses 10.0.0.0/24 and 10.0.1.0/26, packets for 10.0.2.x and 10.0.3.x blackhole at the branch.⁵ The subnet calculator identifies the correct summary prefix: enter all allocated subnets and find the longest common prefix. For 10.0.0.0/24 and 10.0.1.0/26, the summary is 10.0.0.0/23, not /22. Consequently, accurate summarization requires an up-to-date allocation map, which is where VLSM planning tools and IPAM systems earn their value.

Common VLSM mistakes and how to avoid them

The most frequent VLSM error is allocating subnets from the smallest to the largest, which fragments the address space and prevents large subnets from fitting on their required boundaries. When a /30 WAN link is allocated first at 10.0.0.0/30, the next available boundary is 10.0.0.4. A /24 workstation subnet cannot start at 10.0.0.4 because /24 boundaries must be multiples of 256. The /24 must start at 10.0.1.0, wasting the 252 addresses between 10.0.0.4 and 10.0.0.255. Allocating the /24 first at 10.0.0.0, then the /30 at 10.0.1.0, uses the space without gaps, and the subnet calculator shows each block boundary while you align VLSM subnet boundaries.

Cloud reservation pitfalls

Building on this, the second common mistake is forgetting that each subnet's network and broadcast addresses consume space. A segment needing 30 hosts requires a /27 (30 usable), not a /28 (14 usable). The subnet calculator's host-count mode shows the usable count for each prefix, preventing undersizing. For cloud environments, remember that AWS and Azure reserve 5 addresses: a segment needing 30 usable addresses in AWS requires a /27 (32 minus 5 equals 27 usable), which is too small; a /26 (64 minus 5 equals 59 usable) is the correct choice.²⁴

When to use this

Use VLSM when you have one address block and multiple segments with different device counts. Your segments need different subnet sizes; otherwise, uniform subnetting wastes less effort than VLSM planning.

Examples