Smallest Covering CIDR (Two IPs)

The Smallest Covering CIDR (Two IPs) tool calculates the minimal CIDR block that encompasses both specified IP addresses. Enter 192.168.1.10 and 192.168.1.20 to find that the smallest covering CIDR is 192.168.1.0/27, which spans 32 addresses from .0 through .31.

Understanding Covering CIDRs

When you need to write a single firewall rule or routing entry that covers two specific IP addresses, you need to find the smallest CIDR block that contains both of them. This is not as simple as picking a subnet that looks right -- CIDR blocks are defined by binary prefix alignment, and the result depends on exactly where the two addresses differ at the bit level.

The key concept is the longest common binary prefix. Every IP address is a 32-bit number (for IPv4), and two addresses share some number of leading bits before they diverge. The point where they first differ determines the covering CIDR. If 192.168.1.10 and 192.168.1.20 share their first 27 bits, then the covering CIDR has a /27 prefix, which defines a block of 32 addresses. The covering CIDR always includes some addresses beyond your two inputs because CIDR blocks must be power-of-two sized and binary-aligned.

Understanding this "extra address" count is critical for security and routing decisions. A covering CIDR for two addresses that are close together (like .10 and .12) might only include a handful of extras. But a covering CIDR for two addresses in different parts of the same /16 could include tens of thousands of extras. If you are writing a firewall rule, those extra addresses represent traffic you are permitting or denying beyond your original two hosts. This tool shows you exactly how many extra addresses are included so you can make an informed decision about whether the covering CIDR is appropriate or whether you should use two separate, more specific rules instead.

How to Find the Smallest CIDR Containing Two IPs

1. Enter the first IP address (e.g., 192.168.1.10)
2. Enter the second IP address (e.g., 192.168.1.20)
3. The tool computes the longest common binary prefix shared by both addresses
4. Review the resulting CIDR block along with the full range it covers and any extra addresses included

Covering CIDR Examples for Two IP Addresses

Notice that the covering CIDR always includes some addresses beyond the two inputs because CIDR blocks must align to binary boundaries.

When to Use the Smallest Covering CIDR Tool

• Firewall rule scoping -- determine the minimum CIDR range to allow or deny traffic between two specific hosts
• Network proximity analysis -- understand how "close" two IPs are in network terms by examining the covering prefix length
• Subnet verification -- check whether two hosts belong to the same subnet by seeing if the covering CIDR matches the expected subnet
• Access control planning -- define the narrowest possible security group or ACL entry that includes both endpoints
• Troubleshooting connectivity -- determine if two hosts should be reachable at layer 2 by finding their common subnet
• Route planning -- find the minimum summary route that would cover both destinations

How the Longest Common Prefix Algorithm Works

The covering CIDR is determined by finding where the binary representations of the two IP addresses first differ.

Step-by-Step Calculation

For 192.168.1.10 and 192.168.1.20:

192.168.1.10  = 11000000.10101000.00000001.00001010
192.168.1.20  = 11000000.10101000.00000001.00010100
                ^^^^^^^^ ^^^^^^^^ ^^^^^^^^ ^^^
                First 27 bits match         ^^^^^
                                            Bits differ here

The first 27 bits are identical. Bit 28 differs (0 vs 1). Therefore the longest common prefix is 27 bits, and the covering CIDR is 192.168.1.0/27.

Understanding the Extra Addresses

The covering CIDR 192.168.1.0/27 spans addresses .0 through .31 -- that is 32 addresses total. Your two input IPs (.10 and .20) are only 2 of those 32. The remaining 30 addresses are "extra" addresses included by necessity because CIDR blocks must be binary-aligned.

The farther apart the two IPs are in binary representation, the shorter the common prefix and the larger the covering CIDR becomes, including exponentially more extra addresses.

How Prefix Length Relates to Distance

Practical Guidance for Covering CIDRs

Before using a covering CIDR in a firewall rule or security group, always check the extra address count. If you are trying to allow traffic between two servers at 10.0.1.5 and 10.0.1.6, the covering CIDR is 10.0.1.4/30 (4 addresses). That is a tight scope with only 2 extra addresses, and it is probably acceptable. But if your two servers are at 10.0.1.5 and 10.0.200.5, the covering CIDR is 10.0.0.0/16 (65,536 addresses) -- opening up your firewall to an entire /16 just to cover two hosts is rarely a good idea. In that case, two separate /32 rules are more appropriate.

The covering CIDR is most useful when the two IPs are already close together in the address space. If both addresses are in the same /24 subnet, the covering CIDR will be a /24 or smaller, which is a reasonable scope for most rules. As the addresses get farther apart, the covering CIDR grows rapidly and becomes less useful as a practical rule.

When troubleshooting connectivity, compare the covering CIDR to the actual subnet configuration. If two hosts should be on the same /24 subnet but their covering CIDR is larger than /24, at least one of them has been assigned an IP from outside the intended subnet, which would explain the connectivity failure.

Frequently Asked Questions

Can two IPs from different private ranges have a covering CIDR?

Yes, but the covering CIDR may be enormous. For example, 10.0.0.1 and 172.16.0.1 differ starting at the very first bits, resulting in a covering CIDR of 0.0.0.0/1 or similar, spanning billions of addresses. This is mathematically valid but not useful for practical network configuration.

Is the covering CIDR the same as the subnet the two IPs are on?

Not necessarily. The covering CIDR is the smallest CIDR that contains both addresses. If both IPs are on the same /24 subnet, the covering CIDR might be a /27 or /28 -- smaller than the actual subnet. The covering CIDR tells you the minimum required scope, not the actual configured subnet.

Does this work with IPv6 addresses?

Yes. The same binary prefix comparison works with 128-bit IPv6 addresses. The prefix length range is /0 to /128 instead of /0 to /32.

What if both IP addresses are identical?

If both IPs are the same, the covering CIDR is that address with a /32 prefix (for IPv4) or /128 (for IPv6), representing a single host.

Can I find the covering CIDR for more than two IPs?

Use the Smallest Covering CIDR (Many IPs/CIDRs) tool to process a batch list of any number of IP addresses and CIDR blocks.

Related Tools

• Smallest Covering CIDR (Two CIDRs) - Find the smallest CIDR that contains two CIDR blocks
• Smallest Covering CIDR (Many IPs/CIDRs) - Find the smallest CIDR containing a list of IPs or CIDRs
• IP in Subnet Checker - Check if an IP address belongs to a specific subnet
• CIDR to IP Range Converter - Convert CIDR notation to IP address range
• Subnet Contains Subnet Checker - Check if one CIDR block contains another