Range Difference

The Range Difference tool calculates the set difference between two IP ranges -- addresses that exist in range A but not in range B. Enter 10.0.0.0/8 as range A and 10.1.0.0/16 as range B to get the eight CIDR blocks that cover everything in the /8 except that specific /16.

Understanding IP Range Difference

The set difference operation (A minus B) is one of the most practically useful IP range calculations. It answers the question: if I start with range A and remove everything that overlaps with range B, what is left? The result is the portion of A that does not overlap with B, expressed as a minimal list of CIDR blocks.

This comes up frequently in firewall and security policy design. The classic example is "allow everything in this network except the management subnet." You have a broad allow rule for 10.0.0.0/8, but you need to exclude 10.0.0.0/24 because that is your management network with its own stricter rules. The difference 10.0.0.0/8 minus 10.0.0.0/24 gives you the exact list of CIDR blocks you need for the allow rule. Without this tool, you would have to manually figure out which blocks cover the remaining address space, which is tedious and error-prone.

The result of a difference operation often contains many more CIDR blocks than you might expect. When you remove a block from the middle of a range, the remaining space on each side may not align to clean CIDR boundaries. Removing a single /32 from a /24 can produce eight CIDR blocks. This is not a flaw in the tool -- it is a fundamental property of how CIDR blocks work. Every block must be power-of-two sized and binary-aligned, so expressing an arbitrary "range with a hole" requires multiple blocks to tile the remaining space.

How to Calculate IP Range Difference (A Minus B)

1. Enter Range A -- the base range or CIDR block (e.g., 10.0.0.0/8)
2. Enter Range B -- the range to subtract (e.g., 10.1.0.0/16)
3. The tool calculates A minus B -- all addresses in A that are not in B
4. Review the resulting CIDR blocks that represent A with the B portion removed

Range Difference Examples

Subtracting a Small Block from a Large Block

A: 10.0.0.0/8       (10.0.0.0 - 10.255.255.255)
B: 10.1.0.0/16      (10.1.0.0 - 10.1.255.255)

Result (A - B):
10.0.0.0/16          (10.0.0.0   - 10.0.255.255)
10.2.0.0/15          (10.2.0.0   - 10.3.255.255)
10.4.0.0/14          (10.4.0.0   - 10.7.255.255)
10.8.0.0/13          (10.8.0.0   - 10.15.255.255)
10.16.0.0/12         (10.16.0.0  - 10.31.255.255)
10.32.0.0/11         (10.32.0.0  - 10.63.255.255)
10.64.0.0/10         (10.64.0.0  - 10.127.255.255)
10.128.0.0/9         (10.128.0.0 - 10.255.255.255)

The /8 minus a /16 produces 8 CIDR blocks that cover everything in the /8 except the excluded /16.

Other Common Scenarios

Removing a Single Host from a Subnet

A: 10.0.0.0/24       (10.0.0.0 - 10.0.0.255)
B: 10.0.0.100/32     (10.0.0.100)

Result (A - B):
10.0.0.0/26          (10.0.0.0   - 10.0.0.63)
10.0.0.64/27         (10.0.0.64  - 10.0.0.95)
10.0.0.96/30         (10.0.0.96  - 10.0.0.99)
10.0.0.101/32        (10.0.0.101)
10.0.0.102/31        (10.0.0.102 - 10.0.0.103)
10.0.0.104/29        (10.0.0.104 - 10.0.0.111)
10.0.0.112/28        (10.0.0.112 - 10.0.0.127)
10.0.0.128/25        (10.0.0.128 - 10.0.0.255)

Removing a single /32 from a /24 creates a "hole" that requires multiple CIDR blocks to express the remaining addresses.

When to Use the Range Difference Tool

• Firewall "allow everything except" rules -- when you need to allow a broad range but exclude specific subnets, calculate the difference to get the exact CIDR list for your rules
• Address space inventory -- subtract allocated subnets from a parent block to see what remains available for new assignments
• Exception-based security policies -- apply a policy to a network range minus known-good hosts or management subnets
• Split-tunnel VPN configuration -- route all corporate traffic through the VPN except for specific cloud service IP ranges
• Network migration -- track which portions of an old address range have been migrated vs which remain on the legacy network
• DHCP exclusion ranges -- calculate the CIDR blocks to assign when certain addresses within a subnet are reserved

How Set Difference Works for IP Ranges

The range difference operation is mathematically equivalent to A AND (NOT B). It returns addresses that satisfy being in A while simultaneously not being in B.

Algorithm Steps

1. If B does not overlap A at all, the result is simply A (nothing to subtract)
2. If B completely contains A, the result is empty (everything is subtracted)
3. If B partially overlaps A, split A at the boundaries of B:
   • The portion of A before the overlap remains
   • The portion of A after the overlap remains
   • The overlapping portion is removed
4. Convert the remaining portions to minimal CIDR notation

Why the Result Has Many CIDR Blocks

When you remove a block from the middle of a range, the remaining address space on either side may not align to clean CIDR boundaries. Each side must be expressed as a series of decreasing-size CIDR blocks that together cover the gap between A's boundary and B's boundary. This is the same reason that arbitrary IP ranges often require multiple CIDRs -- the binary alignment requirement prevents a single block from covering an arbitrary portion of the address space.

Visualizing the Difference

A:     |==================================|
B:              |==========|

A - B: |========|          |==============|
       ^-- left portion    ^-- right portion

Each portion (left and right) is converted to its minimal set of CIDR blocks independently.

Practical Tips for Range Difference

When building "allow all except" firewall rules, always start by calculating the difference to see how many CIDR blocks the result contains. If removing one management subnet from a /16 produces 15 CIDR blocks, you might decide that deploying 15 separate rules is worse than restructuring your approach -- perhaps using a broader allow rule combined with a higher-priority deny rule for the exception. Many firewall platforms process rules in order and stop at the first match, so a deny rule before an allow rule can achieve the same effect with just two entries instead of fifteen.

When using difference for address space inventory, remember that the result shows you available space at the CIDR level, not necessarily space that is practical to use. A gap of 3 addresses between two allocations will appear as three /32 blocks in the difference output, which is mathematically correct but not useful for allocating a new subnet. Look for the larger blocks in the output when planning new allocations.

The order of operations matters significantly. A - B and B - A produce completely different results. If A is larger than B and B is inside A, A - B gives you A with a hole. But B - A gives you an empty set because everything in B is also in A, so there is nothing in B that is not in A. Always double-check which range is A (the base) and which is B (the subtraction).

Frequently Asked Questions

Is range difference the same as CIDR exclusion?

They are functionally identical. The CIDR Exclusion Tool is designed to subtract multiple exception CIDRs from a single parent block, while Range Difference handles the pairwise A-minus-B case. For subtracting many exceptions, the exclusion tool is more convenient.

Can I chain multiple difference operations?

Yes. To subtract multiple ranges from A, compute A - B1, then subtract B2 from that result, and so on. Alternatively, use the CIDR Exclusion Tool which handles multiple subtractions in one step.

Does order matter? Is A-B the same as B-A?

No, order matters significantly. 10.0.0.0/8 - 10.1.0.0/16 removes a small piece from a large block. 10.1.0.0/16 - 10.0.0.0/8 removes everything because B completely contains A, resulting in an empty set.

Why does removing one IP from a /24 produce so many blocks?

A /24 has 256 addresses. Removing one creates 255 remaining addresses, which cannot be expressed as a single CIDR block (255 is not a power of two). The tool must tile the remaining space with the largest possible aligned blocks, resulting in 8 blocks for a middle removal.

What if A and B do not overlap at all?

The result is simply A unchanged. Since B has no addresses in common with A, there is nothing to subtract, and the entire original range remains.

Can I use this with IPv6 ranges?

Yes. The same difference algorithm applies to 128-bit IPv6 addresses. The results may contain more CIDR blocks due to the larger address space, but the logic is identical.

Related Tools

• Range Union - Merge overlapping IP ranges into a unified list
• Range Intersection - Find common addresses between two IP ranges
• CIDR Exclusion Tool - Subtract exception CIDRs from a parent block
• CIDR Gap Finder - Find unallocated gaps within a parent CIDR
• Next Available Subnet Finder - Find the next available subnet within a parent block