How to Use This Tool
Enter a start and end address. You get the smallest set of CIDR blocks whose union is exactly that range — no address outside it, none inside it missed.
Why a range is not one block
A CIDR block is not an arbitrary interval. Its size is always a power of two, and it must start on a multiple of its own size. A /24 holds 256 addresses and can only begin at .0; a /31 holds two and can only begin at an even address.
So a range that starts on an odd address, or whose length is not a power of two, cannot be one block. The algorithm walks from the start and repeatedly takes the largest block that satisfies both constraints — correct boundary, and does not run past the end — then continues from where that block finished.
Both constraints matter. A block that is too large for the boundary would silently begin before your start address; one that overruns the end would include addresses after it. In a firewall rule either mistake means permitting traffic you did not intend, with nothing to warn you.
Reading the prefix length
The number after the slash counts the fixed leading bits, so a bigger number means a smaller block. A /32 is one address, /31 is two, /30 is four, /24 is 256. Each step down the number doubles the block. This is why counting blocks is a poor proxy for how much you are allowing: one /8 covers more than sixteen million addresses, and four /32s cover four.
Practical notes
- Fewest blocks is not always what you want. A shorter rule list is easier to read, but if a device has a hard limit on rules, or you plan to remove part of the range later, a slightly longer decomposition along cleaner boundaries can be more maintainable.
- /31 and /32 are legitimate. Older habits reserve network and broadcast addresses, but for firewall and routing rules these single- and double-address blocks are normal and correct.
- Check the direction. If the end address is lower than the start, there is no range to cover. This tool reports that instead of silently producing something.