Headroom costs one bit of prefix and buys back a re-addressing project

Every VLAN gets exactly the addresses it needs on the day it is planned, because the block is scarce and the arithmetic says a /25 holds 126 hosts and the VLAN has 100. Eighteen months later the VLAN has 130 hosts, and the fix is not a new prefix — it is a maintenance window, a new DHCP scope, and a list of everything that has an address hardcoded in it.

Headroom is the cheapest thing you will ever buy with address space, because the bill arrives in bits and the alternative arrives in weekends.

What a re-addressing actually touches

The visible cost is a change to a number. The real cost is the list: DHCP scopes and their lease behaviour, static addresses on switches, routers, printers, cameras and door controllers, ACLs and firewall rules that name the old range, NAT and route-map entries, monitoring and SNMP targets, DNS records and the reverse zone, the documentation nobody wants to edit, and every host that needs a human. If the VLAN crosses a site boundary, it is one change window per site and a routing change between them.

A prefix costs a power of two. That is the whole argument.

The arithmetic

Two steps, and only the second one has a trap in it.

• Inflate the demand by the headroom you want. Thirty percent is a common figure for user VLANs: it is roughly one refresh cycle of growth, and it does not multiply the block size the way fifty percent sometimes does.
• Round up to the next power of two, remembering that a normal prefix spends two addresses on the network and broadcast addresses. So a demand of n hosts needs at least n + 2 addresses before you round.

The trap is the second step. It is easy to compute 2^h - 2 and then compare the inflated demand to that number — and it is easy to do it one prefix short. Worked through for four VLAN sizes:

Note the last row. Headroom does not always cost a bit: 10 hosts inflated to 13 still fits a /28, because 13 is below the 14 usable addresses and the rounding has already happened. This is why the number has to be computed per VLAN rather than assumed.

A /21, worked through end to end

Requirements: four user VLANs of 400, 200, 100 and 50 hosts, a management VLAN of 25, an IoT VLAN of 10, and two point-to-point links between sites. Thirty percent headroom, allocated from 10.20.0.0/21.

The total is 2,004 addresses out of 2,048, which leaves 10.20.7.212 to 10.20.7.255 — forty-four addresses, enough for the next VLAN that appears without asking anyone.

Now the comparison that makes the argument. Run the same plan with no headroom: 400 hosts fits a /23, 200 a /24, 100 a /25, 50 a /26, 25 a /27, 10 a /28, plus the two /31s. That is 1,012 addresses — it fits inside 10.20.0.0/22 with twelve to spare.

So thirty percent headroom costs exactly one bit of prefix. The plan moves from a /22 to a /21: 1,024 addresses, once, in exchange for not having a re-addressing project on the calendar. That is the trade, stated in the units it is actually paid in.

Allocate largest first

A best-fit allocator has to hand out the big blocks before the small ones or it fragments the space and then cannot place the last /23 even though the free addresses exist in total. Descending order is not a style preference; it is what makes a first-fit plan deterministic. The VLSM Subnet Planner sorts before it allocates for exactly this reason, and reports the leftover free blocks so you can see whether the result is genuinely tidy or merely fits.

Where headroom is waste, not insurance

Three cases where the thirty percent should not be applied:

• Loopbacks. A /32 per device is the correct size and always will be. The “/32 per loopback” convention is also what makes a loopback usable as a router ID.
• Point-to-point links. A /31 carries two addresses and both are usable (RFC 3021), so a two-site link needs two addresses, not four. Reserving a /24 for transit links is the single most common way a /21 disappears.
• Anything with a fixed, known count. A VLAN that holds exactly two firewalls does not need to accommodate 2.6 firewalls next year.

The pattern to avoid is applying one blanket rule to every VLAN. Headroom is insurance against user growth; it is pure cost on infrastructure links, where the count is decided by the topology rather than by the number of people who join.