CIDR Aggregator
Aggregate multiple CIDR blocks into summarized routes
Input CIDRs
Aggregated Output
Aggregated results will appear here
The CIDR Aggregator combines multiple CIDR blocks into the minimal set of summarized routes that cover the same address space. Enter a list like 192.168.0.0/24 and 192.168.1.0/24 to get a single 192.168.0.0/23, or paste hundreds of blocks to see how much your routing table or firewall ruleset can be reduced through route summarization (supernetting).
Understanding Route Aggregation
If you manage routers, firewalls, or cloud networking, you will inevitably encounter the problem of too many routes or too many rules. A router with 10,000 routes in its table uses more memory and takes longer to perform lookups than one with 500 routes that cover the same address space. A firewall with 2,000 ACL entries is harder to audit and slower to process than one with 200 entries that provide the same coverage. Route aggregation -- also called supernetting or summarization -- is the technique of combining smaller, adjacent CIDR blocks into larger ones to reduce these counts.
The core idea is simple. If you have two /24 blocks that are numerically adjacent and share the same parent prefix, they can be merged into a single /23. If that /23 is adjacent to another /23 with the same parent, those merge into a /22, and so on. The aggregator handles this iterative merging automatically, finding every possible combination in your input list and producing the absolute minimum number of CIDR blocks that cover the same total address space.
This is not just a theoretical optimization. In BGP, upstream providers often require you to announce aggregated prefixes rather than individual /24 blocks to keep the global routing table manageable. In cloud environments, AWS Security Groups and Azure NSGs have hard limits on the number of rules you can create, so aggregating your allowlists and blocklists maximizes the addresses you can cover within those limits. Even for documentation, a clean list of aggregated blocks is easier to review and maintain than a sprawling collection of overlapping entries accumulated over years.
How to Aggregate CIDR Blocks
- Enter a list of CIDR blocks, one per line or comma-separated (e.g.,
192.168.0.0/24,192.168.1.0/24) - The tool identifies adjacent and overlapping blocks that can be merged
- It iterates until no further combinations are possible
- Review the aggregated output showing the minimal set of CIDR blocks and the reduction statistics
CIDR Aggregation Examples
Adjacent Blocks
Input: Output:
192.168.0.0/24 --> 192.168.0.0/23
192.168.1.0/24
Two adjacent /24 blocks combine into a single /23.
Multiple Adjacent Blocks
Input: Output:
10.0.0.0/24 --> 10.0.0.0/22
10.0.1.0/24
10.0.2.0/24
10.0.3.0/24
Four contiguous /24 blocks aggregate into one /22.
Overlapping Blocks
Input: Output:
192.168.0.0/24 --> 192.168.0.0/24
192.168.0.128/25
The /25 is already contained within the /24, so it is eliminated as redundant.
Mixed Aggregation
Input: Output:
10.1.0.0/24 --> 10.1.0.0/23
10.1.1.0/24 10.1.4.0/24
10.1.4.0/24
172.16.0.0/16 172.16.0.0/16
Adjacent blocks aggregate where possible. Non-adjacent blocks and blocks from different ranges remain separate.
When to Use the CIDR Aggregator
- Routing table optimization -- reduce the number of routes in routers and switches to save memory and improve lookup performance
- BGP announcement reduction -- upstream providers often require aggregated announcements; smaller routing tables benefit the global internet
- Firewall rule simplification -- fewer rules are easier to audit, maintain, and process faster at packet inspection time
- Cloud security groups -- AWS Security Groups and Azure NSGs have rule limits; aggregation maximizes entries within those limits
- Documentation cleanup -- consolidate sprawling network allocations into clean, summarized blocks
- Migration preparation -- before migrating firewall rules between platforms, aggregate to reduce the total rule count
How Route Aggregation (Supernetting) Works
CIDR aggregation is the reverse of subnetting. Two CIDR blocks can be merged if and only if:
- They have the same prefix length (e.g., both are
/24) - They are numerically adjacent (the second block starts exactly where the first ends)
- They share the same parent prefix at one bit shorter (e.g., both
/24blocks fall within the same/23)
Binary Alignment Example
192.168.0.0/24 = 11000000.10101000.00000000.xxxxxxxx
192.168.1.0/24 = 11000000.10101000.00000001.xxxxxxxx
^
Only bit 24 differs, so they merge to /23:
192.168.0.0/23 = 11000000.10101000.0000000x.xxxxxxxx
The aggregator repeats this process iteratively. After merging two /24 blocks into a /23, it checks whether that /23 can merge with an adjacent /23 to form a /22, and so on.
Why Some Blocks Cannot Be Aggregated
Not all adjacent blocks can merge. 192.168.1.0/24 and 192.168.2.0/24 are numerically adjacent, but they cannot form a valid /23 because 192.168.1.0 is the upper half of 192.168.0.0/23 while 192.168.2.0 is the lower half of 192.168.2.0/23. They belong to different parent /23 blocks, so the binary alignment requirement is not met.
Handling Overlapping Input
When one CIDR block fully contains another, the contained block is redundant. For example, if your input includes both 10.0.0.0/8 and 10.1.2.0/24, the /24 is entirely within the /8 and is removed. This deduplication happens before aggregation.
Aggregation Best Practices
The biggest wins from aggregation come when your input list has grown organically over time. Firewall rules accumulate as different administrators add entries for new projects, and nobody goes back to clean up. You might find that a dozen separate /24 allow rules for 10.0.0.0/24 through 10.0.11.0/24 could be expressed as just three aggregated blocks. Running your entire ruleset through an aggregator periodically is a good housekeeping practice.
Be aware that aggregation only combines blocks that are truly adjacent and share the same parent. If you need to combine non-adjacent blocks into a single covering CIDR, that is a different operation (supernetting) that may include extra addresses between the blocks. The aggregator never includes addresses that were not in your original input. This makes it safe to use for firewall rules and security policies -- the aggregated output covers exactly the same addresses as the original list.
When preparing BGP announcements, remember that many upstream providers filter announcements more specific than /24 for IPv4. If your aggregated output still contains blocks smaller than /24, you may need to pad your announcements to reach /24 boundaries, which is a manual step that requires understanding your actual address allocations.
Frequently Asked Questions
What is the difference between CIDR aggregation and route summarization?
They are the same operation. "Aggregation" and "summarization" (or "supernetting") are interchangeable terms. All three refer to combining multiple specific prefixes into fewer, less-specific prefixes that cover the same address space.
Will aggregation change which addresses are covered?
No. The aggregator only merges blocks that are adjacent or overlapping. It never fills gaps between non-contiguous ranges. The aggregated output covers exactly the same set of addresses as the original input.
How much reduction can I expect?
The reduction depends on your input. A perfectly contiguous set of 256 /24 blocks all within the same /16 would aggregate to a single /16 -- a 256:1 reduction. Random, scattered blocks may see little or no reduction if no two blocks are adjacent.
Can I aggregate blocks of different prefix lengths?
The aggregation algorithm first deduplicates overlapping blocks, then merges same-length adjacent pairs. Different prefix lengths can only merge if one contains the other (in which case the smaller is eliminated) or if intermediate aggregation steps produce same-length blocks that become eligible for further merging.
Does aggregation work with IPv6?
Yes. The same binary merging rules apply to IPv6 CIDR blocks with 128-bit addresses. The prefix lengths are larger, but the adjacency and parent-prefix requirements are identical.
Related Tools
- CIDR Deaggregator - Expand a CIDR block into smaller blocks (the reverse operation)
- IP Range to CIDR Converter - Convert an IP range to minimal CIDR blocks
- Range Union - Merge overlapping IP ranges into a unified list
- Adjacency Checker - Check if two CIDR blocks can be merged
- Minimal Merge Tool - Merge all mergeable CIDR blocks in a list