IP CIDR Overlap Calculator

CIDR (Classless Inter-Domain Routing) notation writes an IPv4 network as an address followed by a slash and a prefix length, like 10.0.0.0/16. The number after the slash is the count of leading 1 bits in the subnet mask: a /16 means the first 16 bits identify the network and the remaining 16 bits identify hosts inside it. So /16 covers 2^16 = 65,536 addresses, /24 covers 2^8 = 256, and /32 is a single host. Replacing the old class A/B/C scheme with CIDR in 1993 let networks be allocated at any size that is a power of 2, instead of being forced into one of three fixed sizes.

CIDR networks are always aligned, power-of-two sized blocks: a /24 starts on a multiple of 256, a /20 on a multiple of 4,096, and so on. Given any two CIDR blocks, either they sit in completely separate parts of the address space (disjoint), they cover the exact same range (identical), or one is fully contained inside the other. There is no way for two aligned power-of-two blocks to share some addresses without one engulfing the other. If your input ever shows partial overlap, it almost always means one of the addresses is not aligned on its mask boundary, which the parser would normally snap to the network address first.

The block with the smaller mask number (shorter prefix) is the larger network and contains the one with the bigger mask. For example, 10.0.0.0/16 covers all of 10.0.0.0 to 10.0.255.255, so it fully contains 10.0.1.0/24, which is only 10.0.1.0 to 10.0.1.255. In firewall rules and route tables this matters because most routers and stateful firewalls use longest-prefix match: the rule with the more specific (bigger) mask wins on traffic that matches both. If you forget that, a broad 0.0.0.0/0 deny can be silently overridden by a /24 allow underneath it.

Two blocks merge cleanly only when they are the same size, adjacent, and aligned on the next-higher mask boundary. For example, 10.0.0.0/24 and 10.0.1.0/24 are both /24, sit back to back, and together align perfectly on a /23 boundary, so they combine into 10.0.0.0/23. But 10.0.0.0/24 and 10.0.2.0/24 do not merge (there is a gap), and 10.0.0.0/24 plus 10.0.1.0/25 do not merge (different sizes). The technical term is supernetting or CIDR aggregation, and it is what BGP route summarization relies on to shrink internet routing tables.

Two overlapping CIDR entries can silently mask each other. In a firewall, the order of rules and the longest-prefix-match algorithm decide which one applies, so an unintended overlap can let traffic through that you thought you blocked, or block traffic you meant to allow. In a routing table, overlapping routes mean longest match wins (a /24 entry beats a /16 entry for any address inside it), which is the whole point of CIDR aggregation but is a foot-gun if you did not plan for the more specific route. When designing VPC CIDRs, VPN tunnels, on-prem peering, or Kubernetes pod ranges, checking for overlaps up front prevents routing loops, NAT collisions, and unreachable subnets later.