Subnet Design Practice - VLSM, Summarization, Drills

TL;DR

• VLSM: sort requirements biggest first, round each up to a power of two of hosts + 2, and place each block on an address that is a multiple of its own size.
• Summarization is the reverse: contiguous, aligned blocks of equal size collapse into one shorter prefix. Four /24s starting on a multiple of four become one /22.
• Same subnet? Apply the mask to both addresses. Equal results mean yes. Nothing else counts.
• Overlap is the real production failure: two networks with intersecting CIDR ranges cannot be routed or peered.
• Cloud subnets lose addresses to the provider (AWS 5, GCP 4, Azure 5), so size with 2h - reserved, not 2h - 2.

This page is practice. The mask arithmetic itself (what /27 means, network and broadcast addresses, the usable-host rule) is owned by IP addressing and is not repeated here. Every answer below was worked by hand on the page and then checked with Python's ipaddress module.

Mental model

ANALOGYEveryday

Cutting a plot of land into building lots. You have one big field and a list of buyers who want different sizes. Hand out the biggest lots first, along the field's own grid lines, and the leftover is one clean strip you can still sell. Start with the small lots and you create awkward gaps that no big buyer can use.

Where it breaks: land can be sold in any width. An address block can only start where its size divides the start address, so a "gap" is not just awkward, it is unusable for that size.

ANALOGYFor engineers

This is bin packing with power-of-two sizes, the same problem a buddy memory allocator solves. Blocks are sizes 2k, a block of size 2k must sit at an offset that is a multiple of 2k, and freeing two adjacent buddies lets them merge into one block of size 2k+1. Summarization is the merge, VLSM is the split.

Where it breaks: an allocator merges buddies automatically. In networking a merge only helps if the two blocks are both yours, adjacent and routed through the same place, otherwise the summary lies about what is behind it.

How it works

VLSM: sort, round up, align

Variable-length subnet masking means subnets from one parent block do not all have to be the same size (RFC 1009 first allowed it, RFC 4632 is the CIDR specification that every modern router assumes). The method has three steps.

1. Sort the requirements from largest to smallest.
2. For each, find the smallest power of two that holds hosts + 2 (network and broadcast, see why minus two). The host bits are the exponent, so the prefix is 32 - h.
3. Place each block at the lowest free address that is a multiple of its size.

Worked example. Split 10.0.0.0/16 for three networks that need 500, 200 and 50 hosts.

• 500 hosts: 500 + 2 = 502, next power of two is 512 = 2⁹, so 9 host bits, prefix /23, usable 510.
• 200 hosts: 202, next power of two is 256 = 2⁸, so /24, usable 254.
• 50 hosts: 52, next power of two is 64 = 2⁶, so /26, usable 62.

Placement, in order. The /23 goes first at 10.0.0.0; it covers 512 addresses, so it ends at 10.0.1.255. The next free address is 10.0.2.0, which is a multiple of 256, so the /24 fits there and ends at 10.0.2.255. The next free address is 10.0.3.0, a multiple of 64, so the /26 fits and ends at 10.0.3.63.

Need (hosts)	Hosts + 2	Block size	Prefix	Network	Usable range	Broadcast
500	502	512	/23	10.0.0.0	10.0.0.1 to 10.0.1.254	10.0.1.255
200	202	256	/24	10.0.2.0	10.0.2.1 to 10.0.2.254	10.0.2.255
50	52	64	/26	10.0.3.0	10.0.3.1 to 10.0.3.62	10.0.3.63

Leftover. The three blocks use 512 + 256 + 64 = 832 addresses. The first free address is 10.0.3.64, and the rest of the /16 is exactly eight aligned blocks: 10.0.3.64/26, 10.0.3.128/25, 10.0.4.0/22, 10.0.8.0/21, 10.0.16.0/20, 10.0.32.0/19, 10.0.64.0/18 and 10.0.128.0/17. Their sizes sum to 65,536 - 832 = 64,704 addresses. The leftover is clean because the biggest blocks were placed first.

The first 1,024 addresses of 10.0.0.0/16 (the span 10.0.0.0 to 10.0.3.255). Solid blocks are allocated, the dashed block is free. Width is proportional to address count at 0.625 px per address.

Summarization: bit alignment check

Route summarization (also called aggregation or supernetting) replaces several prefixes with one shorter prefix that covers exactly them. It is the reason CIDR scaled the routing table (RFC 4632).

Take 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24 and 10.0.3.0/24. Only the third octet differs: 0, 1, 2, 3 is 00000000, 00000001, 00000010, 00000011. The first six bits of that octet are identical, so the common prefix is 16 + 6 = 22 bits and the summary is 10.0.0.0/22 (4 x 256 = 1,024 = 2¹⁰ addresses).

Two conditions make it legal. The count of blocks is a power of two (4), and the first block's start is a multiple of the summary size (the third octet 0 is a multiple of 4). The gap case is in the deep dive.

Four aligned /24 blocks share their first 22 bits and collapse into one /22. The bracket spans exactly the four blocks, no more.

Same-subnet drill

Are 10.1.1.130 and 10.1.1.200 on the same subnet? Mask both and compare.

• With /25 (block size 128): the fourth octet's blocks are 0-127 and 128-255. 130 and 200 are both in 128-255, so the network is 10.1.1.128/25 for both. Same subnet.
• With /26 (block size 64): the blocks are 0-63, 64-127, 128-191, 192-255. 130 is in 128-191, 200 is in 192-255. Different subnets: 10.1.1.128/26 and 10.1.1.192/26.

What a host does with the answer (on-link delivery versus sending to the gateway) is in host forwarding decision.

Try it: pick a question type, type your answer, then Check for the worked method or Reveal. The seed is editable, so a question can be shared or repeated.

○unanswered✓matches✕incorrect (expected value shown)◆revealed

Host 172.56.20.60/29. Find its network, broadcast, first and last usable host, and the usable host count.

Network addressBroadcast addressFirst usable hostLast usable hostUsable host count

○ Unanswered

Seed

Deep dive

Why alignment matters

A block of 2h addresses has h zero host bits. Its start address must therefore have h trailing zero bits, which means it is a multiple of 2h. 10.0.1.0/23 is invalid because 10.0.1.0 is not a multiple of 512 (third octet 1 is odd, and a /23 needs it even). Python rejects it with 10.0.1.0/23 has host bits set. That is why you cannot "start the /23 right after a /24": the /23 waits for the next multiple of 512 and the skipped space is wasted.

This is also why order matters. Place the /26 first at 10.0.0.0 and the /23 can no longer start there; its next legal start is 10.0.2.0, stranding 10.0.0.64 through 10.0.1.255 unless smaller blocks later fill them.

Summarization needs contiguity and alignment

10.0.1.0/24 and 10.0.2.0/24 are adjacent but do not collapse: 1 and 2 differ in their last two bits, so the pair is not a /23. Python's collapse_addresses returns both unchanged. The aligned pairs would be 10.0.0.0/24 plus 10.0.1.0/24, or 10.0.2.0/24 plus 10.0.3.0/24.

The black-hole case: advertise 10.0.0.0/24, 10.0.1.0/24 and 10.0.3.0/24 as 10.0.0.0/22 and you also claim 10.0.2.0/24, which is not behind you. Traffic for it arrives and has nowhere to go. The honest summary of those three is 10.0.0.0/23 plus 10.0.3.0/24. How the router chooses between a summary and a more specific route is longest-prefix match; a more specific route elsewhere always wins over your summary, which is also how the gap gets repaired.

Overlap detection

Two CIDR blocks either do not intersect or one contains the other, because both are aligned power-of-two ranges. 172.16.0.0/16 and 172.16.200.0/24 overlap (the second sits inside the first). 10.0.0.0/16 and 10.1.0.0/16 do not. Overlap checks are the first step of any peering, VPN or merger plan.

Hierarchical plans and growth room

A company plan carves the top block by meaning, so summaries fall out for free. For example one /16 per region, split by environment, then by tier. Each level is aligned, so each level has a single summary a remote site can hold. Leave a gap after every block (reserve the next aligned block of the same size) so a tier can double without renumbering. A complete worked VPC plan is in design a VPC.

Cloud subnets: reserved addresses

Cloud providers keep addresses in every subnet. The per-cloud table (AWS 5, GCP 4, Azure 5) and what each reserved address does is in the cloud network model; the vendor sources are AWS subnet sizing, GCP subnets and the Azure VNet FAQ. For sizing, replace the - 2 of the textbook with the provider's number. A /28 has 16 addresses: 11 usable on AWS or Azure, 12 on GCP. A /24 has 251 on AWS and Azure, 252 on GCP.

CIDR, subnet and VLAN

Three words that people swap. CIDR is the notation and the allocation scheme: an address plus a prefix length. A subnet is one IP block that shares a prefix and, by convention, one broadcast domain. A VLAN is a layer 2 construct: a tagged separation of one switch fabric into several broadcast domains (VLANs). Practice usually maps one VLAN to one subnet, but nothing forces it: you can have two subnets on one VLAN. CIDR is neither of them; it is how you write and size the subnet.

Drills with answers

Work each one on paper first, then open the answer. Every answer was verified with Python ipaddress.

1. Which network contains 172.16.37.9/20, and what is its broadcast address?

A /20 leaves 4 host bits in the third octet plus all 8 in the fourth, so the block size in the third octet is 16. 37 divided by 16 gives 2 remainder 5, so the block starts at 16 x 2 = 32. Network 172.16.32.0/20, last address 172.16.47.255 (32 + 15 = 47).

2. What are the usable hosts in the subnet of 192.168.10.77/27?

Block size 32. 77 divided by 32 gives 2, so the block starts at 64. Network 192.168.10.64/27, usable 192.168.10.65 to 192.168.10.94, broadcast 192.168.10.95.

3. How many usable hosts does 10.4.0.0/14 hold?

32 - 14 = 18 host bits, 2¹⁸ = 262,144, minus 2 = 262,142. It covers 10.4.0.0 to 10.7.255.255, valid because 4 is a multiple of 4 (a /14 spans four values of the second octet).

4. How many hosts does a /22 give? How many /22s fit in a /16, and how many /24s?

A /22 has 10 host bits: 1,024 addresses, 1,022 usable. A /16 holds 2^{22 - 16} = 64 of them, or 2^{24 - 16} = 256 /24s.

5. Can 192.168.4.0/24 through 192.168.7.0/24 be summarized? What about 192.168.5.0/24 through 192.168.8.0/24?

First set: four blocks, the third octet 4 is a multiple of 4, so yes: 192.168.4.0/22. Second set: four blocks again, but 5 is not a multiple of 4. The best you can do is 192.168.5.0/24, 192.168.6.0/23 and 192.168.8.0/24. Four in a row is not enough, alignment decides.

6. Do 172.16.0.0/16 and 172.16.200.0/24 overlap? Do 10.0.0.0/16 and 10.1.0.0/16?

The first pair overlaps: 172.16.200.0/24 lies inside 172.16.0.0/16. The second does not: the second octets 0 and 1 differ and both blocks stop at the octet boundary.

7. You need 1,000 hosts in one subnet. Which prefix, and how many usable addresses are spare?

1,000 + 2 = 1,002, next power of two is 1,024 = 2¹⁰, so /22 with 1,022 usable. Spare usable hosts: 22.

8. A cloud subnet is a /28. How many instances fit on AWS, on GCP, and on Azure?

16 addresses. AWS reserves 5 and Azure reserves 5, leaving 11. GCP reserves 4, leaving 12 (see the reserved address table and the vendor docs linked above).

Textbook vs real world

The textbook says	Production does	Why
Pack subnets tightly with VLSM to waste nothing.	Fixed-size subnets per tier and zone (often /20 to /24), with deliberate unallocated gaps.	Operators trade address efficiency for a plan anyone can read and for room to grow a tier without renumbering.
The exam puzzle is the hard part.	Overlap with on-premises, another VPC or an acquired company is the failure that hurts.	Everyone starts with the first easy 10.0.0.0/16, and overlapping ranges cannot be peered or routed.
Usable hosts are 2h - 2.	Cloud subnets are 2h minus 4 or 5.	The provider keeps the gateway, DNS and future-use addresses in every subnet.
Summarize everything you can.	Summarize at boundaries you own, and keep specifics where you may need to move one block.	A summary hides a gap, and a gap is a black hole.

In production

• AWS documents the sizing rule and the 5 reserved addresses (subnet sizing), and refuses peering between VPCs with overlapping CIDR blocks (VPC peering basics).
• Address exhaustion on EKS. With the AWS VPC CNI each pod takes a VPC address, so small subnets run out before nodes run out of CPU. AWS recommends prefix delegation, a secondary CIDR for pods and larger subnets (EKS IP optimization). The Kubernetes side is in Kubernetes networking.
• Secondary CIDR from 100.64.0.0/10. Teams that cannot find free RFC 1918 space sometimes attach a secondary VPC range for pods. That block is shared address space defined by RFC 6598, not RFC 1918 private space, so it does not collide with corporate 10.x ranges. Check the VPC CIDR block rules before relying on a range.
• IPAM. Teams running many VPCs allocate each VPC range from a central manager such as AWS VPC IPAM so no two overlap. The planning rationale is in design a VPC.
• GCP documents which ranges a subnet may not use, including ranges that overlap reserved blocks (GCP subnets).

History and evolution

HISTORY

• 1985 RFC 950 defines subnetting: one classful network can be divided into subnets with a mask.
• 1987 RFC 1009 lets different subnets of one network use different masks, which is VLSM, so a small link no longer wastes a whole large subnet.
• 1993 Classful addressing was exhausting class B space and bloating routing tables. CIDR (RFC 1518 and RFC 1519) removes classes and makes aggregation the main scaling tool.
• 2006 RFC 4632 restates CIDR and obsoletes RFC 1519. RFC 1918 private space is by now the default for every enterprise and cloud plan, which creates the overlap problem.
• Now Plans are held in IPAM tools and cloud route tables, and overlap checks are automated. Cloud providers reserve addresses per subnet.
• Next IPv6 plans stop packing and start labeling: sites receive a /48 and each LAN a /64 (RFC 6177), so a /48 holds 2¹⁶ = 65,536 subnets. See IPv6.

Hands-on

Check any drill with Python's standard ipaddress module (macOS and Linux, Python 3).

python3 -c "

import ipaddress as i

b = i.ip_network('10.0.0.0/16')

print(list(b.subnets(new_prefix=18)))

print(list(i.collapse_addresses(i.ip_network(f'10.0.{k}.0/24') for k in range(4))))

print(i.ip_network('10.0.1.0/24').supernet(prefixlen_diff=2))

print(i.ip_network('172.16.0.0/16').overlaps(i.ip_network('172.16.200.0/24')))

"

[IPv4Network('10.0.0.0/18'), IPv4Network('10.0.64.0/18'), IPv4Network('10.0.128.0/18'), IPv4Network('10.0.192.0/18')]

[IPv4Network('10.0.0.0/22')]

10.0.0.0/22

True

The first line is the junior question "split 10.0.0.0/16 into 4 equal subnets": two extra bits give four /18s of 16,384 addresses each. collapse_addresses is the summarizer, supernet climbs the tree, overlaps is the peering check.

Other tools: ipcalc 192.168.10.77/27 (Linux package, also on Homebrew) or sipcalc print network, broadcast and range. On AWS, aws ec2 describe-subnets --query 'Subnets[].[CidrBlock,AvailableIpAddressCount]' lists the free address count, which for a fresh /24 is 251 (see design a VPC).

Gotchas

GOTCHAS5

A block can start anywhere that is free

It must start at a multiple of its own size. 10.0.1.0/23 is invalid, and Python rejects it with "has host bits set". Skipping ahead to the next aligned start is not optional.

Four adjacent /24s always summarize to a /22

Only if the first starts on a multiple of four. 192.168.5.0/24 to 192.168.8.0/24 cannot, and advertising a /22 over a gap claims addresses you do not own.

Summarizing over a gap is harmless

The gap becomes a black hole: traffic for it follows your summary to you and is dropped, because nothing behind you owns it. Summarize only exactly-covered ranges or accept the hole on purpose.

CIDR, subnet and VLAN are the same thing

CIDR is the notation and the allocation scheme, a subnet is an IP block, and a VLAN is a layer 2 broadcast domain. They are usually mapped one-to-one, not identical.

A /28 gives 14 hosts in the cloud

24 - 2 = 14 is the textbook rule. AWS and Azure give 11, GCP gives 12.

Interview questions

INTERVIEWSplit 10.0.0.0/16 into 4 equal subnets.junior

Show answer

Four subnets need 2 extra bits (2² = 4), so the new prefix is /18. The blocks are 10.0.0.0/18, 10.0.64.0/18, 10.0.128.0/18 and 10.0.192.0/18, each 16,384 addresses. The step is 64 in the third octet because 256 / 4 = 64.

Follow-ups:

• Equal subnets of 100 hosts? 102 needs 128 = 2⁷, so /25, which gives 2^{25 - 16} = 512 subnets from the /16.
• How do you check it? ip_network('10.0.0.0/16').subnets(new_prefix=18).

INTERVIEWSubnet 10.0.0.0/16 for networks of 500, 200 and 50 hosts.mid

Show answer

Use VLSM, largest first. 500 needs 502 so 512 addresses, /23 at 10.0.0.0. 200 needs 202 so 256, /24 at 10.0.2.0. 50 needs 52 so 64, /26 at 10.0.3.0. The next free address is 10.0.3.64, and everything from there to the end of the /16 stays available as clean aligned blocks.

Follow-ups:

• Why largest first? Each start must be a multiple of its size; placing a small block first strands space the big block cannot use.
• What if the 50-host network later needs 100? Its block ends at 10.0.3.63, so it cannot grow in place; use the free 10.0.3.128/25 or leave a gap after each block in the plan.

INTERVIEWAre 10.1.1.130 and 10.1.1.200 on the same subnet with a /25? With a /26?junior

Show answer

Apply the mask to both. With /25 they land in 10.1.1.128/25, so yes. With /26 the first is in 10.1.1.128/26 (128 to 191) and the second in 10.1.1.192/26 (192 to 255), so no. A host would then send traffic between them through its gateway.

Follow-ups:

• What does the host do differently? On-link delivery uses ARP directly, off-link sends to the gateway (host forwarding decision).

INTERVIEWHow many hosts does a /22 give?junior

Show answer

A /22 has 10 host bits: 1,024 addresses, 1,022 usable. Cut out of a /16 it is one of 2^{22 - 16} = 64 such blocks.

Follow-ups:

• In AWS? 1,024 - 5 = 1,019 usable.
• Split into /24s? Four of them, 254 usable hosts each.

INTERVIEWSummarize 10.0.0.0/24 through 10.0.3.0/24.mid

Show answer

The third octet runs 0 to 3, 000000xx, so the first 22 bits are common: 10.0.0.0/22, 1,024 addresses. It is legal because there are four blocks (a power of two) and the first starts at a multiple of four.

Follow-ups:

• And 10.0.1.0/24 through 10.0.4.0/24? Not one block; 1 is not a multiple of 4. You need 10.0.1.0/24, 10.0.2.0/23 and 10.0.4.0/24.
• What if 10.0.2.0/24 is missing? A /22 summary black-holes that range.

INTERVIEWWhat breaks when two VPCs with overlapping CIDRs are peered?senior

Show answer

A route table cannot tell which side an address like 10.0.5.9 belongs to, so providers refuse the peering: AWS rejects peering between VPCs with overlapping CIDR blocks (VPC peering basics). The same wall applies to transit gateways and VPN. The fixes are renumbering, adding a non-overlapping secondary CIDR for the connected parts, or NAT between them (NAT). Prevention is a central IPAM that allocates every range.

Follow-ups:

• Partial overlap? Still a problem; any intersection is overlap, and one block usually contains the other.
• Cheapest fix? Renumber the smaller, newer network if you can.

INTERVIEWWhat is the difference between CIDR, a subnet and a VLAN?mid

Show answer

CIDR is the notation and allocation method: an address plus a prefix length, any length, no classes (RFC 4632). A subnet is an IP block with one prefix, usually one broadcast domain. A VLAN is a layer 2 separation of a switch network into broadcast domains. Convention maps one VLAN to one subnet, but they are different layers.

Follow-ups:

• Can two subnets share a VLAN? Yes, though you rarely want it (VLANs).

Fun facts

FACTSNumbers worth knowing

• A /16 split into /24s gives 2⁸ = 256 subnets, and into /22s gives 64.
• A /24 has 256 addresses, but only 251 or 252 are usable in a cloud subnet.
• A /48 of IPv6 holds 65,536 /64 subnets, so IPv6 plans are labeled, not packed.

Cheat sheet

Task	Method	Example
Size a block	Smallest 2h that holds hosts + 2, prefix 32 - h	500 hosts: /23
Place a block	Start at a multiple of its size	/23 at 10.0.0.0, 10.0.2.0, never 10.0.1.0
Summarize	Power-of-two count, aligned first block, no gaps	10.0.0.0/24 to 10.0.3.0/24 is 10.0.0.0/22
Same subnet?	Mask both, compare	10.1.1.130 and .200 on /25 yes, /26 no
Overlap?	One block contains the other, or they are disjoint	172.16.0.0/16 vs 172.16.200.0/24: yes
Cloud usable	2h minus reserved	/28: AWS 11, GCP 12, Azure 11