CIDR aggregator: what is the smallest set of prefixes for these ranges?
How does this check work, and what does the result tell you?
AdminKit's CIDR aggregator takes a pasted list of IPv4 or IPv6 addresses and CIDR blocks and returns the minimal set of prefixes that covers every one of them exactly — merging adjacent and overlapping ranges, dropping blocks already contained in a bigger one, and flagging duplicates — computed entirely in your browser with nothing sent to a server.
Part of the IP & network cluster — more tools, guides and terms on ip & network.
- 192.0.2.0/24
- 198.51.100.0/24
- 2001:db8::/32
What the result means
Each IP version's group shows the input count against the aggregated count — fewer aggregated prefixes than inputs means some ranges were adjacent, overlapping or duplicated. Any range already covered by a wider one, or an exact duplicate, is listed underneath the prefixes so you can see exactly what was redundant in your original list.
Next step
Need the network/broadcast/host-range math for one of the resulting blocks instead? Use the subnet calculator, or check whether a specific address falls inside one of your ranges with IP in CIDR next.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up if something changes? That's early access, not a live feature yet — tell us and we'll set it up by hand.
How it works and limits
Paste a list of IPv4 or IPv6 addresses and/or CIDR blocks — one per line, or comma/space separated — and this tool returns the minimal set of CIDR prefixes that exactly covers the same addresses, the route/ACL/firewall summarization every network engineer eventually does by hand. IPv4 and IPv6 are always aggregated separately: a prefix only ever means something within its own address family under RFC 4632’s classless addressing and RFC 4291’s IPv6 addressing architecture, so the two are never combined into one output group.
Why doesn’t the aggregator ever output a looser supernet?
Because that would silently add addresses nobody entered. Each input CIDR is first normalized the same way AdminKit’s
subnet calculator and IP-in-CIDR tools normalize one — host bits
past the prefix are zeroed, per RFC 4632 — and a bare address is treated as a single-host /32 or /128. From there,
the tool only ever merges two ranges when they are exactly adjacent and fall on a shared power-of-two boundary, and it
only ever drops a range when another entered range already covers it completely. The result is re-expressed as the
fewest classless prefixes that reproduce precisely that union — never a wider block chosen just because it is
shorter to write.
Reading the result
Each IP version gets its own group showing the input count (how many valid addresses/ranges you entered) against the aggregated count (how many prefixes the minimal cover needs), followed by the prefix list itself. Any exact duplicate or any range already covered by a wider one you also entered is called out underneath, so a list copied from several overlapping firewall rules or route tables shows you exactly what was redundant before you paste the aggregated list somewhere else.
Limits
- This produces an exact cover of the addresses you entered — it never rounds up to a looser supernet, and it never drops an address that was actually in your input.
- IPv6 output uses the RFC 5952 canonical compressed form.
- Very large pastes are summarized entirely in your browser; there is no server-side size limit to hit, but a very long list will take longer the larger it is since the tool is not optimized for route-table-scale inputs.
- This is address-range arithmetic only — it does not check whether any resulting prefix is actually routable, allocated to you, or safe to announce.
- For the math on a single block (network, broadcast, host range), use the subnet calculator instead; to test whether one address falls inside a list of ranges, use IP in CIDR.
Frequently asked questions
Does this tool send my addresses or ranges anywhere?
No — the parsing and aggregation run entirely in your browser's JavaScript, the same offline pattern as AdminKit's subnet calculator and IP-in-CIDR tools. Nothing you paste is sent to a server, logged or stored.
Why does my aggregated list have more prefixes than I expected?
Two ranges only collapse into one shorter prefix when they are exactly adjacent and aligned on a power-of-two boundary — e.g. 192.0.2.0/25 and 192.0.2.128/25 collapse into 192.0.2.0/24 because together they form one complete, aligned /24. A gap of even a single address, or a pair that is not aligned the same way, stays as separate prefixes, same as any router's route-summarization logic (RFC 4632).
What counts as a duplicate versus an overlap in the result?
A duplicate is the exact same address or CIDR block entered more than once; an overlap is any other case where one entered range sits fully inside another (for example, a /32 host address inside a /24 you also listed). Two CIDR blocks can never partially overlap — RFC 4632's classless addressing means any two prefixes are either identical, one fully contains the other, or they are disjoint — so this tool only ever reports those two relationships.
Does the aggregator ever round a range up to a looser supernet to make the output shorter?
No — every output prefix is built only from addresses that were actually in the input (after normalizing each CIDR's host bits to its network, as RFC 4632 defines). The tool will not substitute a wider block that happens to contain your ranges plus addresses you never entered, even if that would produce a shorter list.
Can I aggregate a mix of IPv4 and IPv6 in one paste?
Yes — paste both in the same box and the tool sorts them automatically, but it never merges across families: IPv4 addresses are summarized into IPv4 prefixes and IPv6 addresses into IPv6 prefixes, shown as two separate result groups, because a CIDR prefix is only ever valid within its own address family (RFC 4291 for IPv6, RFC 4632 for IPv4).