Because of the binary structure of the IP address prefixes, the
blocks of addresses they match always group in powers of two.
This can best be understand through example.
Let's begin with a /24 prefix length, which exactly matches
the first three bytes, and study the effect on the third byte as
we begin to shorten the prefix. In the diagram, I've
written the values of the third byte from 0 to 15, in both
decimal and binary. So, a prefix
of 10.10.10/24 matches only 10 in the third byte.
A prefix of 10.10.11/24 matches only 11. Each number in
the diagram represents a single prefix matching a single number
in the third byte.
Now let's make our prefix one bit shorter - /23.
What happens? Since we are now ignoring the last bit in the third
byte, even and odd numbers become paired together. 10.10.0/23
matches both 0 and 1 in the third byte. 10.10.2/23 matches
2 and 3, and so on. This is illustrated with the red lines, grouping
pairs of numbers together.
Moving our prefix shorter still, we find that /22 groups
in blocks of four, as illustrated in purple. 10.10.4/22,
for example, matches 4, 5, 6 and 7 in the third byte.
Pay particular attention to the binary expansions.
Note that we can't match 5, 6, 7 and 8; these four numbers don't
share a common 22-bit prefix.
There is no IP address prefix that can match exactly 5, 6, 7 and 8.
/21, which matches blocks of eight in the third byte, is
illustrated in blue. The beginning of a /21 block always
falls on a multiple of eight, so 10.10.8/21 matches from
8 to 15 in the third byte, 10.10.16/21 matches from
16 to 23, and 10.10.80/21 matches from 80 to 87
(80 is a multiple of 8). The next block would be 10.10.88/21
which would range from 88 to 95, all in the third byte.
We can continue on with /20, which matches blocks of 16 on
boundaries of multiples of 16, /19, which matches blocks
of 32 on boundaries of multiples of 32, and so on. Yet let's
return to /24 for a moment and consider what happens if
we move toward longer prefix lengths.
