How it works
A CIDR block is a power-of-two chunk of addresses that starts on a boundary of its own size: a /30 holds 4 addresses and must start on a multiple of 4, a /29 holds 8 and starts on a multiple of 8, and so on. Most ranges people are given — "10.0.0.5 to 10.0.0.20", or an inetnum from a RIPE whois lookup — don't line up with those boundaries.
The tool walks from the start address to the end. At each address it asks two questions: how big a block is this address aligned to? (count the zero bits at the end of the address) and how big a block still fits before the end? It takes the smaller of the two, writes it down, and jumps to the next address after that block. The result is always the minimum number of blocks.
Worked example: 10.0.0.5 to 10.0.0.20
That's 16 addresses. Only the last octet changes, so we can work in that octet alone (5 to 20).
- Start at .5 (binary 00000101). It ends in a 1, so it's only aligned to a block of 1: 10.0.0.5/32.
- Next is .6 (00000110). One trailing zero → aligned to a block of 2. Two addresses (.6, .7) fit before .20, so take 10.0.0.6/31.
- Next is .8 (00001000). Three trailing zeros → aligned to 8. Eight addresses (.8 to .15) fit, so take 10.0.0.8/29.
- Next is .16 (00010000). Aligned to 16, but only 5 addresses (.16 to .20) are left, so the biggest block that fits is 4: 10.0.0.16/30.
- Last is .20. Only one address left: 10.0.0.20/32.
Result: 10.0.0.5/32, 10.0.0.6/31, 10.0.0.8/29, 10.0.0.16/30, 10.0.0.20/32 — 5 blocks, 1 + 2 + 8 + 4 + 1 = 16 addresses, no gaps and nothing extra.
Where you need this
-
Cloud security groups and firewall objects
AWS security groups, Azure NSGs and most firewall address objects accept CIDR, not ranges. AWS also limits rules per security group (60 inbound by default), so getting the smallest list matters. Paste a vendor's range list into bulk mode to merge it before you add the rules.
-
ISP and RIR ranges
RIPE and other registries often publish allocations as start–end ranges (
inetnum: 192.0.2.0 - 192.0.2.255). Convert them before building BGP prefix lists or geo-blocking rules. -
DHCP pools and reserved blocks
A DHCP pool like .100 to .199 isn't a CIDR. If you need to exclude or allow exactly that pool in an ACL, convert it here: 192.168.1.100 to 192.168.1.199 becomes 5 blocks (.100/30, .104/29, .112/28, .128/26, .192/29).
Common mistakes
- Rounding to one big block. Writing 10.0.0.0/27 for "10.0.0.5 to 10.0.0.20" is easy but allows 16 extra addresses you never meant to trust. Use the exact list.
- Off-by-one at the end. Ranges are inclusive. "192.168.1.0 to 192.168.1.255" is a /24; "to 192.168.1.254" needs 8 blocks.
- Forgetting to merge first. Converting each line of an allow list separately leaves neighbours like 10.0.0.0/25 and 10.0.0.128/25 as two rules when one /24 would do. Bulk mode merges before converting.
- Mixing up host and network addresses. 10.0.0.7/30 is not a valid network: it rounds down to 10.0.0.4/30. Bulk mode accepts it but reads it as the whole /30, so double-check you meant that.
FAQ
Why can't my IP range be written as one CIDR block?
A CIDR block always holds a power of two addresses (1, 2, 4, 8 …) and must start on a multiple of its own size. A range like 10.0.0.5 to 10.0.0.20 has 16 addresses, but it doesn't start on a multiple of 16, so it has to be built from several smaller blocks.
Is the list of CIDR blocks the smallest possible?
Yes. At each step the tool takes the largest block that both starts exactly at the current address and does not pass the end of the range. This greedy method is proven to give the minimum number of blocks for a single range.
How many CIDR blocks can one IPv4 range need?
At most 62. The worst case is 0.0.0.1 to 255.255.255.254, which needs 31 blocks climbing up from the start and 31 coming down to the end. For IPv6 the worst case is 254 blocks.
What does bulk merge do with overlapping ranges?
It sorts every line, merges ranges that overlap or touch (for example 10.0.0.0/25 and 10.0.0.128/25), and only then converts them to CIDR. Duplicates disappear and neighbouring blocks are combined into larger ones where the maths allows it.
Does this work with IPv6?
Yes. Enter two IPv6 addresses (any valid shorthand such as 2001:db8::1) and you get IPv6 prefixes back. Bulk mode accepts IPv4 and IPv6 lines together and returns the IPv4 blocks first.
Is my data sent anywhere?
No. The conversion runs in your browser with JavaScript. Ranges you paste are never uploaded, which matters when you are working with internal firewall lists.