VLSM, CIDR and route summarisation with worked examples

From classes to CIDR

Early IPv4 used fixed classes: a class A network had 16 million addresses, class C only 254. Organisations either wasted huge blocks or needed many small ones. Classless Inter-Domain Routing (CIDR), introduced in 1993, removed the fixed sizes. A network is written as an address plus a prefix length, such as 10.20.0.0/14, and the prefix can be any length. Classes survive today only as vocabulary.

CIDR does two jobs. Inside an organisation it allows VLSM (variable length subnet masks). Between networks it allows aggregation, so an ISP can advertise one large block instead of thousands of small ones.

VLSM: the right size for each subnet

Suppose you have 192.168.10.0/24 for a small site: Sales needs 100 hosts, Staff 50, Guests 20, plus two point-to-point router links. Fixed /26 subnets would give 62 hosts each, which is too small for Sales. VLSM sizes each one separately.

1. List the requirements from largest to smallest.
2. For each, pick the smallest block where 2 to the power of the host bits, minus 2, is enough: 100 hosts needs /25 (126), 50 needs /26 (62), 20 needs /27 (30), a link needs /30 (2).
3. Allocate the largest first, starting at the beginning of the range, so every block starts on its own boundary.
4. Write down network, first and last usable, and broadcast for each.

The space from .232 to .255 is left for growth. On router-to-router links you can also use /31 (RFC 3021), which has no network or broadcast address and saves two addresses per link. Check your work with the VLSM calculator.

Route summarisation

A branch router has 172.16.0.0/24 to 172.16.3.0/24 behind it. Instead of advertising four routes, it can advertise one summary. To find it:

1. Write the third octets in binary: 0 = 00000000, 1 = 00000001, 2 = 00000010, 3 = 00000011.
2. The first six bits of that octet are identical; the last two vary.
3. Common bits: 16 (first two octets) + 6 = 22. The summary is 172.16.0.0/22.

Summaries only work cleanly when the networks are contiguous and start on a block boundary. Summarising 172.16.1.0 to 172.16.4.0 would need a bigger, less accurate summary. That is why good address plans give each site a power-of-two block.

Why it matters at work

• Smaller routing tables use less memory and converge faster.
• Stability: when one branch LAN flaps, the summary stays up, so the change does not ripple across the whole network.
• Simpler firewall rules: one rule for 10.40.0.0/16 covers a whole region.

Real-world example: a company with 40 branches gave each one a /21 out of 10.64.0.0/15 (branch 1 got 10.64.0.0/21, branch 2 got 10.64.8.0/21, and so on). The head office routers see one summary per region instead of 300 small routes, and a single firewall object covers all branch traffic.

Watch out: a summary can attract traffic for addresses that don't exist. Routers usually add a route to Null0 for the summary so that such packets are dropped instead of looping.