Short answer: A prefix sets the subnet boundary. A /26 leaves 6 host bits, giving 64 addresses and ordinarily 62 usable hosts. VLSM uses different prefix lengths inside one parent block so each subnet fits its requirements.
Before this: OSI and TCP/IP and switches and routers.
Network bits and host bits
An IPv4 address is 32 bits, written as four decimal bytes like 192.168.10.37. On its own, that number doesn't tell you anything about which network the device is on. You need a second number, the subnet mask, to split those 32 bits into a network portion and a host portion.
Think of a whole office building's street address as the network part, and each individual unit number as the host part. 192.168.10.0/24 means the first 24 bits are the "building," and the remaining 8 bits are free for up to 254 "units" inside it.
CIDR replaced fixed classes
IPv4 originally split addresses into fixed-size classes (A, B, C), each with a mask baked into the address range itself. That was inflexible, and wasteful for anyone who needed a network with, say, 40 hosts, but not 254. CIDR (Classless Inter-Domain Routing) replaced that with the /prefix notation you actually use today: the number after the slash is just how many bits are network bits, period, independent of any class.
| CIDR prefix | Subnet mask | Usable hosts |
|---|---|---|
| /24 | 255.255.255.0 | 254 |
| /25 | 255.255.255.128 | 126 |
| /26 | 255.255.255.192 | 62 |
| /27 | 255.255.255.224 | 30 |
| /28 | 255.255.255.240 | 14 |
| /30 | 255.255.255.252 | 2 (point-to-point link) |
VLSM: Sizing each subnet to what it actually needs
VLSM (Variable Length Subnet Masking) allows different-sized subnets inside the same address block. Suppose the main office needs 50 host addresses, a branch needs 25, and a router link needs 2, including any interface and gateway addresses. Giving all three a /26 would waste space. Instead, allocate a /26, a /27, and a /30, largest first. In the building analogy, each subnet is a wing with its own range of unit numbers; a small wing doesn't need as many numbers as a large one.
Worked allocation: boundaries matter
A /26 advances in blocks of 64, a /27 in blocks of 32, and a /30 in blocks of 4. Start each subnet on a matching boundary. The network address identifies the wing; the broadcast address reaches the whole wing. Neither is an ordinary host address.
| Requirement | Network/prefix | Usable range | Broadcast | Capacity |
|---|---|---|---|---|
| 50 hosts | 10.0.1.0/26 | 10.0.1.1 to 10.0.1.62 | 10.0.1.63 | 62 |
| 25 hosts | 10.0.1.64/27 | 10.0.1.65 to 10.0.1.94 | 10.0.1.95 | 30 |
| 2 hosts | 10.0.1.96/30 | 10.0.1.97 to 10.0.1.98 | 10.0.1.99 | 2 |
The allocation consumes 100 of the parent's 256 addresses, leaving 156 unallocated. The remainder is not one CIDR subnet: 10.0.1.100/30, 10.0.1.104/29, 10.0.1.112/28, and 10.0.1.128/25 cover it without overlaps. A new /27 cannot start at .100; its next aligned start is .128.
Check one host's configuration
For 10.0.1.70/27, the last mask byte is 224. Bitwise AND gives 70 & 224 = 64, so the host belongs to 10.0.1.64/27. Its ordinary usable range is .65 through .94. A default gateway of .65 fits; .97 belongs to the router-link subnet instead.
| Symptom | Check | Interpretation |
|---|---|---|
| A host can reach some neighbors but not others | Compare address, prefix, and gateway on both hosts | A mismatched mask changes which destinations are treated as on-link. It is one possible cause, not proof by itself. |
| A proposed subnet overlaps another | Calculate each network through broadcast range | Disjoint ranges, not different-looking prefix labels, establish separate allocations. |
Ordinary IPv4 subnets reserve the first address for the network and the last for broadcast. A /30 therefore has 4 total addresses and 2 usable. Two exceptions matter: a /31 on a supported point-to-point link uses both addresses as endpoints (RFC 3021), and a /32 identifies one address, often as a host route or loopback address. Do not apply the "subtract two" rule blindly to these prefixes.
Related topics and sources
Continue with longest prefix match, ARP and on-link delivery, or inter-VLAN routing.