Variable Length Subnet Masking lets you divide one address space into subnets of different sizes, so each subnet's prefix length matches the number of hosts it actually needs instead of every subnet being the same size.

Why should you allocate the largest subnets first in VLSM?

Subnets must start on a boundary that is a multiple of their size. Allocating the largest subnets first keeps the remaining space contiguous; allocating small subnets first leaves gaps that larger subnets cannot fit into.

What prefix length do I need for a given number of hosts?

Pick the smallest prefix whose usable host count covers your requirement: /30 gives 2 usable hosts, /29 gives 6, /28 gives 14, /27 gives 30, /26 gives 62, /25 gives 126 and /24 gives 254.

Should point-to-point links use /30 or /31?

Either works. A /30 gives two usable addresses with a network and broadcast address as overhead; a /31 gives two usable addresses with no overhead and is supported by most enterprise routers.

Variable Length Subnet Masking (VLSM) Explained

The Problem with Fixed Subnets

Imagine you have been given 10.10.0.0/22 — 1,024 addresses — and need to set up four network segments:

Office LAN: 200 devices
Wi-Fi: 80 devices
Server VLAN: 15 devices
Management network: 5 devices

If you split the /22 into four equal /24s (256 addresses each), every segment gets 254 usable addresses. Your management network uses 5 of those 254 — wasting 249. Multiply that across a larger network and the waste becomes significant: unused addresses you can never reclaim for other subnets.

VLSM (Variable Length Subnet Masking) solves this by letting each segment use a prefix length that matches its actual requirements.

Choosing the Right Prefix Length

The rule is: find the smallest subnet that fits your required number of hosts. Since usable hosts = 2^(host bits) − 2, work upwards from your requirement:

Hosts needed	Minimum prefix	Usable hosts
1 – 2	/30	2
3 – 6	/29	6
7 – 14	/28	14
15 – 30	/27	30
31 – 62	/26	62
63 – 126	/25	126
127 – 254	/24	254

For the example above: office LAN needs 200 → /24, Wi-Fi needs 80 → /25, servers need 15 → /27, management needs 5 → /29.

The Golden Rule: Allocate Largest First

Always allocate your largest subnets first. Each subnet's network address must align on a boundary that is a multiple of its own size. If you start with a small subnet and then try to fit a larger one beside it, the larger subnet's address may not align correctly — leaving gaps you cannot use.

Largest-first guarantees every subnet lands on a clean boundary and no space is orphaned.

A Worked Example

Starting with 10.10.0.0/22 (addresses 10.10.0.0 through 10.10.3.255), allocating largest-first:

10.10.0.0/22  ─ 1,024 addresses total
│
├── 10.10.0.0/24    Office LAN      254 usable  (200 needed)
│                   10.10.0.1 – 10.10.0.254
│
├── 10.10.1.0/25    Wi-Fi           126 usable  (80 needed)
│                   10.10.1.1 – 10.10.1.126
│
├── 10.10.1.128/27  Server VLAN      30 usable  (15 needed)
│                   10.10.1.129 – 10.10.1.158
│
├── 10.10.1.160/29  Management        6 usable  (5 needed)
│                   10.10.1.161 – 10.10.1.166
│
└── 10.10.1.168 – 10.10.3.255       Unallocated — available for future growth

Total addresses consumed by the four subnets: 416. Total wasted within those subnets: 111 (the unused addresses in each block). If we had used four equal /24s, the waste would have been 735 — over six times more.

Leave room to grow. Do not allocate right up to the edge of your parent block. Reserve unallocated space for future subnets — a new VLAN for a department, a dedicated security camera network, a VoIP segment. It is far easier to plan for growth upfront than to renumber later.

Point-to-Point Links

Router-to-router links only ever need two addresses — one for each end. Use /30 (4 addresses, 2 usable) rather than wasting a /24 on a link with two interfaces. Modern networks often use /31 for these links, which is supported by most enterprise routers and gives 2 usable addresses with no network or broadcast overhead.

Keeping track of what you've allocated

A VLSM plan is only as good as the record of it. Most people start with a spreadsheet: one row per subnet, a column for the prefix, a column for what it's for. It works for the four subnets above. It stops working the first time someone adds a VLAN and forgets to update the sheet, or two engineers hand out the same /29 in the same week — and you don't find out until something stops answering.

The problem isn't the plan, it's that the plan and the network drift apart. An IPAM keeps them together: the /22 sits at the top, the subnets you carved out of it sit underneath, and every address inside them is either allocated to something, reserved, or free.

If your network runs on a UniFi, Meraki or Mist controller, getIPAM goes a step further and fills the subnets in for you. It reads connected clients from the controller's cloud API — MAC, IP, hostname — and drops each one into the subnet it belongs to. Nothing is written back to the controller, no agent runs on your network, and if a client turns up on an address your plan says is reserved, it's flagged rather than silently reassigned.

IPAM for UniFi — syncs via UniFi Site Manager
IPAM for Meraki — syncs via the Dashboard API
IPAM for Mist — syncs wireless clients per site

Or start with the plan from this article: the Free Sandbox lets you build the /22 hierarchy by hand or import it from a spreadsheet, no card needed. Get started free →

Variable Length Subnet Masking (VLSM)

The Problem with Fixed Subnets

Choosing the Right Prefix Length

The Golden Rule: Allocate Largest First

A Worked Example

Point-to-Point Links

Keeping track of what you've allocated

Put the plan to work

IPAM for UniFi

IPAM for Meraki

IPAM for Mist