Range Intersection

The Range Intersection tool calculates the overlap between two IP ranges or CIDR blocks, returning only the addresses that exist in both inputs. Enter 192.168.0.0/23 and 192.168.1.0/24 to find that the intersection is 192.168.1.0/24 -- the 256 addresses shared by both ranges.

Understanding IP Range Intersection

In set theory, the intersection of two sets is the collection of elements that belong to both. When applied to IP ranges, this means finding the addresses that are simultaneously inside range A and inside range B. This operation answers a precise question: which addresses are affected by both of these rules, allocations, or policies at the same time?

This comes up constantly in network operations. When two firewall rules overlap, you need to know exactly which addresses are subject to both rules to understand whether they conflict or are simply redundant. When planning a network merger, you need to identify where the address allocations of both organizations overlap so you can plan re-addressing. When auditing security controls, you need to verify that a protected range is actually covered by a monitoring rule by checking whether their intersection equals the protected range.

The intersection can produce four possible outcomes. If the ranges do not overlap at all, the intersection is empty -- there are no shared addresses. If one range completely contains the other, the intersection is the smaller range. If the ranges partially overlap, the intersection is just the overlapping portion. And if both ranges are identical, the intersection equals either one. Understanding which case applies tells you about the relationship between the two ranges and guides your next steps.

How to Find the Intersection of Two IP Ranges

1. Enter the first IP range or CIDR block (e.g., 192.168.0.0/23)
2. Enter the second IP range or CIDR block (e.g., 192.168.1.0/24)
3. The tool calculates the addresses common to both inputs
4. Review the intersection result in both CIDR notation and start-end range format, along with address counts

Range Intersection Examples

Detailed Example: Partial Overlap

Range A: 192.168.0.0/23  (192.168.0.0 - 192.168.1.255)
Range B: 192.168.1.0/24  (192.168.1.0 - 192.168.1.255)

Intersection: 192.168.1.0/24  (192.168.1.0 - 192.168.1.255)

Range A only: 192.168.0.0/24  (192.168.0.0 - 192.168.0.255)
Range B only: (none -- B is entirely within A)

Detailed Example: No Overlap

Range A: 192.168.1.0/24  (192.168.1.0 - 192.168.1.255)
Range B: 192.168.2.0/24  (192.168.2.0 - 192.168.2.255)

Intersection: Empty

The ranges are adjacent but do not share any addresses.

When to Use the Range Intersection Tool

• Firewall rule conflict detection -- find addresses affected by multiple overlapping rules to identify potential conflicts or redundancies
• IP allocation audit -- detect overlapping allocations between departments, sites, or VRFs that could cause routing conflicts
• Security policy analysis -- identify addresses covered by two different security policies to understand where policies overlap
• Compliance verification -- verify that a protected address range is actually covered by a specific security control by intersecting the two
• Migration planning -- when merging networks, identify overlapping address space that will need re-addressing
• Rule scope validation -- confirm that a proposed new rule will not overlap with existing rules in unexpected ways

How Range Intersection Is Calculated

The intersection of two ranges is the set of addresses that fall within both. Mathematically, this is the classic set intersection operation applied to IP address ranges.

Algorithm

1. Convert both inputs to start-end integer ranges
2. The intersection start is max(start_A, start_B)
3. The intersection end is min(end_A, end_B)
4. If intersection_start > intersection_end, the ranges do not overlap and the intersection is empty
5. Otherwise, convert the resulting range back to minimal CIDR notation

Possible Outcomes

There are four possible relationships between two ranges:

• No overlap -- the ranges are completely separate, intersection is empty
• Partial overlap -- the ranges share some addresses but each also has unique addresses
• Full containment -- one range is entirely within the other, intersection equals the smaller range
• Identical -- both ranges cover exactly the same addresses, intersection equals either range

No Overlap:     |---A---|     |---B---|
Partial:        |---A---|
                      |---B---|
Containment:    |--------A--------|
                    |---B---|
Identical:      |--------A--------|
                |--------B--------|

Practical Uses of Range Intersection

The most common use of intersection in day-to-day operations is firewall rule auditing. When you have hundreds or thousands of rules accumulated over years, overlapping rules are almost inevitable. Two rules might allow different ports from the same source range, or one broadly permissive rule might shadow a more specific deny rule. By intersecting the address ranges of pairs of rules, you can identify exactly which addresses are affected by both and investigate whether the overlap is intentional or accidental.

Intersection is also valuable during network mergers and acquisitions. When two organizations combine their networks, the first question is whether their private address ranges overlap. If Company A uses 10.0.0.0/16 and Company B uses 10.0.0.0/8, the intersection is 10.0.0.0/16 -- meaning Company A's entire network falls within Company B's address space. This overlap must be resolved through re-addressing before the networks can be interconnected.

For compliance and security audits, intersection provides a rigorous way to verify coverage. If your policy says that 10.0.0.0/16 must be monitored, you can intersect that range with your monitoring tool's configured scope. If the intersection equals the policy range, coverage is complete. If the intersection is smaller, you have gaps that need to be addressed.

Frequently Asked Questions

Is the intersection always a single CIDR block?

Not necessarily. While the intersection of two CIDR blocks is always a contiguous range, that range may not align to a single CIDR boundary. In most practical cases with standard CIDR inputs the result is a single block, but when one input is an arbitrary start-end range, the intersection could require multiple CIDR blocks to express.

What is the difference between intersection and overlap checking?

An overlap checker answers a yes/no question: do these ranges overlap at all? The intersection tool goes further by calculating exactly which addresses are shared and expressing them as CIDR blocks. Use the overlap checker for quick validation; use intersection when you need the actual shared addresses.

Can I intersect more than two ranges?

This tool handles two ranges at a time. To intersect multiple ranges, apply the tool iteratively: intersect the first two, then intersect that result with the third range, and so on. The result is the set of addresses common to all inputs.

What happens if one range is a single IP (/32)?

The intersection will be either that single IP (if it falls within the other range) or empty (if it does not). This is a quick way to check whether a specific IP belongs to a given CIDR block, though the IP in Subnet Checker is more purpose-built for that task.

Is intersection commutative? Does the order of A and B matter?

Yes, intersection is commutative. A intersect B gives the same result as B intersect A. The order of inputs does not affect the output.

Related Tools

• Range Union - Merge overlapping IP ranges into a unified list
• Range Difference - Calculate A minus B for IP ranges
• Subnet Overlap Checker (Two CIDRs) - Check if two CIDR blocks overlap
• Subnet Contains Subnet Checker - Check if one CIDR block contains another
• CIDR Exclusion Tool - Subtract exception CIDRs from a parent block