Subnet Contains Subnet? Checker

The Subnet Contains Subnet Checker determines whether one CIDR block fully encompasses another, identifying supernet-to-subnet containment relationships. Enter two CIDR blocks like 10.0.0.0/8 and 10.1.2.0/24 to instantly verify if one is a subset of the other -- the tool reports whether A contains B, B contains A, they are identical, or neither contains the other.

Understanding Subnet Containment

If you work with routers, firewalls, or any kind of IP address management system, you will regularly need to answer the question: does this network fit inside that network? Subnet containment is the formal way to describe that relationship. A supernet contains a subnet when every address in the smaller block also exists in the larger block. This concept underpins route summarization, firewall rule optimization, and hierarchical address planning.

The idea is intuitive once you think about it in terms of address ranges. A /24 block like 192.168.1.0/24 covers 256 addresses from .0 to .255. A /25 block like 192.168.1.0/25 covers only the first 128 of those addresses, from .0 to .127. Since every address in the /25 also appears in the /24, the /24 contains the /25. The reverse is never true -- the /24 has addresses (.128 through .255) that do not exist in the /25, so the /25 cannot contain the /24.

This relationship matters in practice because many network operations depend on it. When you configure a summary route on a router, you are asserting that a single supernet contains all the more-specific routes behind it. When you audit a firewall rule set, a broad allow rule for 10.0.0.0/8 makes any narrower allow rule for 10.1.0.0/16 redundant. And when you allocate address space in an IPAM tool, sub-allocations must sit within their parent block. Getting any of these wrong leads to routing black holes, security gaps, or address conflicts.

How to Check if One Subnet Contains Another

1. Enter the first CIDR block (e.g., 192.168.0.0/16) in the Subnet A field.
2. Enter the second CIDR block (e.g., 192.168.1.0/24) in the Subnet B field.
3. The tool instantly reports whether A contains B, B contains A, they are identical, or neither contains the other.

The check works by comparing the network address and host range of each subnet. Subnet A contains Subnet B when every address in B also falls within A -- meaning B's network address is at or after A's, and B's broadcast address is at or before A's.

Subnet Containment Examples

Why containment direction matters

A /24 contains two /25 subnets, but a /25 can never contain a /24. The larger prefix length (more specific route) always has fewer addresses:

• 192.168.1.0/24 = 256 addresses (192.168.1.0 -- 192.168.1.255)
• 192.168.1.0/25 = 128 addresses (192.168.1.0 -- 192.168.1.127)
• 192.168.1.128/25 = 128 addresses (192.168.1.128 -- 192.168.1.255)

Both /25 subnets are contained within the /24, but the /24 is not contained within either /25.

When to Use the Subnet Containment Checker

• Route summarization -- verify that all specific routes can be aggregated into a single supernet before applying summary routes on your router.
• Firewall rule auditing -- identify redundant rules where a broader CIDR already covers a more specific one (e.g., an allow rule for 10.0.0.0/8 makes a separate rule for 10.1.0.0/16 unnecessary).
• IPAM hierarchy validation -- confirm that suballocations sit properly within their parent allocation blocks.
• Cloud VPC design -- ensure subnet allocations for individual services fit within the VPC's overall CIDR range (e.g., verify 10.0.1.0/24 is within 10.0.0.0/16).
• ACL optimization -- collapse multiple specific permit/deny entries into broader network statements when containment is confirmed.

How Subnet Containment Works

Containment is determined by comparing the binary boundaries of two CIDR blocks. For Subnet A to contain Subnet B:

1. B's network address must be greater than or equal to A's network address.
2. B's broadcast address must be less than or equal to A's broadcast address.

In binary terms, the network portion of B must share the same leading bits as A, and B's prefix length must be equal to or longer than A's.

Worked example

Check if 10.0.0.0/8 contains 10.20.30.0/24:

10.0.0.0/8     -> range: 10.0.0.0 to 10.255.255.255
10.20.30.0/24  -> range: 10.20.30.0 to 10.20.30.255

10.20.30.0   >= 10.0.0.0       -> true
10.20.30.255 <= 10.255.255.255 -> true

Result: 10.0.0.0/8 contains 10.20.30.0/24

Containment vs. overlap

Containment is a specific form of overlap where one subnet's entire address range falls within the other's. Two subnets can overlap without either one containing the other when working with arbitrary IP ranges, but with properly aligned CIDR blocks, any overlap implies containment. If you need to detect whether two subnets share any addresses at all, use the Subnet Overlap Checker.

Containment Checks in Practice

The most common place you will use containment checks is during firewall and ACL audits. Over time, rule sets accumulate entries as engineers add specific permits or denies for new requirements without reviewing whether existing broader rules already cover the new range. A firewall with an allow rule for 10.0.0.0/8 does not need a separate allow rule for 10.1.0.0/16 or 10.1.1.0/24 -- both are already permitted by the /8 rule. Identifying and removing these redundant entries makes the rule set smaller, easier to audit, and faster for the firewall to process.

Another important use case is validating address plans before deployment. When you receive a /20 allocation from your ISP or regional registry, every subnet you create for VLANs, DMZs, or point-to-point links must fit within that /20. Running a containment check for each planned subnet against the parent allocation catches mistakes early -- before a misconfigured subnet causes routing problems in production. This is especially important in cloud environments where VPC CIDR ranges are immutable once created, and subnet allocations that fall outside the VPC range will be rejected by the provider.

A third scenario is route summarization on border routers. Before you replace a list of specific routes with a single summary route, you need to verify that the summary actually contains all the specific routes. If any specific route falls outside the summary, traffic to that network will be dropped when the specific route is withdrawn. Running each specific route through a containment check against the proposed summary route prevents this kind of outage.

Frequently Asked Questions

Can a subnet contain itself? Yes. If both CIDR blocks are identical (same network address and prefix length), the tool reports them as identical. Technically, every subnet contains itself since all addresses in A are also in A.

Does this work with IPv6 CIDR blocks? Yes. The containment logic is the same for IPv6. A fd00::/32 block contains fd00:abcd::/48 because the /48 is a more specific prefix within the /32 range.

What if the subnets partially overlap but neither contains the other? The tool will report that neither contains the other. For detailed overlap analysis including the shared address range, use the Subnet Overlap Checker. Note that with properly aligned CIDR blocks, partial overlap without containment is not possible -- overlap always implies one contains the other.

How is this different from checking if an IP is in a subnet? The Is IP in Subnet? Checker tests a single host address against a subnet. This tool tests an entire subnet against another subnet -- a fundamentally different operation that compares two ranges rather than a point against a range.

Can I check containment for a list of subnets at once? This tool compares two individual CIDR blocks. If you need to check whether multiple subnets are all contained within a parent block, run each pair through the checker individually. For bulk overlap analysis across two lists of CIDRs, use the Subnet Overlap Checker (List vs List).

Does the prefix length alone determine containment? No. A shorter prefix length (like /16) is a necessary condition for containing a longer prefix (like /24), but it is not sufficient. 192.168.1.0/24 is contained within 192.168.0.0/16, but 10.1.0.0/24 is not contained within 192.168.0.0/16 because the network addresses belong to different blocks entirely.

Related Tools

• Subnet Overlap Checker (Two CIDRs) - Check if two CIDR blocks share any common addresses
• Is IP in Subnet? Checker - Check if a single IP address belongs to a specific subnet
• CIDR Deduper - Remove duplicate and contained CIDR blocks from a list
• Subnet Boundary Visualizer - Visualize subnet boundaries and bit alignment
• IPv4 Subnet Calculator - Calculate network, broadcast, and host range from CIDR notation