N10-009 · Networking Concepts · Updated July 29, 2026
VLSM: Variable Length Subnet Masking Step by Step
Variable Length Subnet Masking (VLSM) is the practice of carving one parent address block into subnets of different sizes, so a 500-user warehouse and a two-router link each get a prefix sized to what they actually need. You do it by sorting the requirements from largest to smallest, giving each one the smallest prefix that still fits, and placing each block immediately after the previous one. Everything else — the arithmetic, the exam traps, the “which mask do I assign” questions — follows from those two rules: size it, then stack it.
The waste VLSM exists to eliminate
Split a block into equal pieces and every piece must be as big as the biggest requirement. Take 172.31.24.0/22 — 1,024 addresses — divided into eight equal /25s of 126 usable hosts each. A department needing 400 hosts fits in none of them, so you jump to two equal /23s of 510 hosts, at which point a four-device management segment consumes 512 addresses to hold four machines.
That is fixed-length subnet masking (FLSM), and it fails in both directions at once: too coarse for the big segments, wasteful for the small ones. VLSM lets a single parent hold a /23, a /25, a /26, a /28, and a /30 side by side. Modern routing protocols — OSPF, EIGRP, BGP, and static routes — carry a prefix length with every advertised network, which is what makes mixed prefix lengths legal. Classful protocols such as RIPv1 did not, and that is the historical reason VLSM is treated as a distinct skill.
Sizing a subnet: work backwards from host count
The usable host count for a prefix /n is 2^(32−n) − 2, because the all-zeros host pattern is the network address and the all-ones pattern is the broadcast address. So the sizing question is always: what is the smallest number of host bits h where 2^h − 2 covers my requirement?
h = 4 -> 2^4 - 2 = 14 usable -> /28
h = 5 -> 2^5 - 2 = 30 usable -> /27
h = 6 -> 2^6 - 2 = 62 usable -> /26
h = 7 -> 2^7 - 2 = 126 usable -> /25
h = 8 -> 2^8 - 2 = 254 usable -> /24
h = 9 -> 2^9 - 2 = 510 usable -> /23
h = 10 -> 2^10 - 2 = 1022 usable -> /22A department of 60 hosts needs h = 6, not h = 5 — 30 is not enough — so it gets a /26 and mask 255.255.255.192. A department of 300 hosts needs h = 9 (a /23), because a /24’s 254 usable addresses fall short. Exam items love requirements that sit just above a boundary: 100 hosts needs a /25, 130 hosts needs a /24, 260 hosts needs a /23.
A complete allocation, worked end to end
Parent block: 172.31.24.0/22, which spans 172.31.24.0 through 172.31.27.255. Five requirements, sorted largest first.
| Segment | Hosts needed | Prefix assigned | Usable addresses | Network – broadcast |
|---|---|---|---|---|
| Warehouse floor | 400 | /23 (255.255.254.0) | 510 | 172.31.24.0 – 172.31.25.255 |
| Office LAN | 120 | /25 (255.255.255.128) | 126 | 172.31.26.0 – 172.31.26.127 |
| Voice VLAN | 60 | /26 (255.255.255.192) | 62 | 172.31.26.128 – 172.31.26.191 |
| IoT sensors | 12 | /28 (255.255.255.240) | 14 | 172.31.26.192 – 172.31.26.207 |
| Router-to-router link | 2 | /30 (255.255.255.252) | 2 | 172.31.26.208 – 172.31.26.211 |
Follow the hand-off from one block to the next. The warehouse /23 ends at 172.31.25.255, so the next free address is 172.31.26.0 — that becomes the office network address. The office /25 ends at 172.31.26.127, so voice starts at 172.31.26.128. Voice ends at .191, so IoT starts at .192; IoT ends at .207, so the point-to-point link starts at .208 and ends at .211. Total consumed: 172.31.24.0 through 172.31.26.211, leaving 172.31.26.212 through 172.31.27.255 free for growth. No two ranges touch, and every range sits inside the parent’s last address of 172.31.27.255.
Usable ranges, if the question asks for first and last host: warehouse 172.31.24.1–172.31.25.254; office 172.31.26.1–172.31.26.126; voice 172.31.26.129–172.31.26.190; IoT 172.31.26.193–172.31.26.206; the link 172.31.26.209–172.31.26.210.
Alignment: the rule that makes an allocation legal
A subnet’s network address must be a multiple of its own block size, where block size = 2^(32−n) counted in the last octet the mask touches. This is the single constraint people violate when they allocate by eye.
/26 -> block 64 -> legal starts: .0, .64, .128, .192
/28 -> block 16 -> legal starts: .0, .16, .32, .48, .64 ...
/30 -> block 4 -> legal starts: .0, .4, .8, .12 ...
/23 -> block 2 in the THIRD octet -> legal starts: x.0, x.2, x.4 ...172.31.26.192/28 is legal because 192 ÷ 16 = 12 exactly. 172.31.26.200/28 would not be — 200 is not a multiple of 16, so the address is a host inside 172.31.26.192/28, not a network address. Allocating largest-first automatically satisfies alignment, which is the real reason the ordering rule exists: a /23 placed after a /28 would land on an odd third-octet value and be illegal. If you need a refresher on how prefix lengths map to dotted-decimal masks, see CIDR notation and subnet masks.
Point-to-point links: /30 versus /31
A /30 gives you exactly two usable addresses and is the traditional choice for a serial or routed link between two devices, at a cost of four addresses. RFC 3021 (Request for Comments 3021) defines /31 links, where both addresses are usable hosts and the network/broadcast convention is suspended — two addresses consumed instead of four. Many modern routers support /31 on point-to-point interfaces. For N10-009 purposes, treat /30 as the safe default answer for a two-host link unless the question explicitly raises /31.
One block VLSM never carves up
169.254.0.0/16 is reserved for link-local addressing. When a client’s DHCP request goes unanswered, the operating system self-assigns an address from that range — a mechanism named Automatic Private IP Addressing (APIPA), standardized as dynamic link-local configuration in RFC 3927. The tell is unmistakable: a 169.254.x.x address with mask 255.255.0.0 and no default gateway. Such a host can still reach other APIPA hosts in the same broadcast domain, because ARP works fine locally, but it cannot route anywhere. It is not part of your VLSM plan and it should never appear in an allocation table — if it shows up on a device, DHCP failed.
How the N10-009 exam tests this
- “Which mask for department X?” — a host requirement is given and four masks are offered, one of which is exactly one size too small. Compute 2^h − 2 and reject anything that doesn’t cover the requirement.
- Continuation problems. The question hands you the first two or three allocations already made and asks for the next network address and mask. The answer is always: last address used, plus one — then confirm that value is a legal multiple for the new prefix.
- Overlap detection. You’re shown a proposed allocation table and asked which entry is wrong. Compute each broadcast address and look for a network address that falls inside an earlier range.
- Largest-first ordering. A distractor allocates the smallest department first, producing a plan that is misaligned or runs out of room in the parent block.
Allocation-table questions get fast with repetition — the N10-009 question bank has plenty of them.
Quick reference
- VLSM = different prefix lengths inside one parent block; FLSM = every subnet the same size.
- Sizing rule: smallest h where 2^h − 2 ≥ required hosts; prefix = 32 − h.
- Allocate largest requirement first, each new block starting at the previous block’s broadcast address + 1.
- A network address must be an exact multiple of its block size (2^(32−n)) — otherwise it’s a host address, not a subnet.
- Verify a finished plan two ways: every block sits inside the parent’s range, and no block’s network address falls inside another block’s span.
- /30 = 2 usable for point-to-point; /31 (RFC 3021) also yields 2 usable by dropping the network/broadcast reservation.
- 169.254.x.x with a 255.255.0.0 mask means APIPA self-assignment after DHCP failure — never a designed subnet.
- Drill the mechanics on subnetting practice problems, or start from the fundamentals in subnetting explained.