CIDR Aggregator
Collapse a messy list of IPv4 networks into the smallest possible set of CIDR blocks - the summarisation a routing protocol or firewall object group should be carrying.
Result
Aggregated prefixes
| Aggregate | Mask | Range | Addresses |
|---|---|---|---|
| 10.5.4.0/22 | 255.255.252.0 | 10.5.4.0 - 10.5.7.255 | 1,024 |
| 10.5.8.0/24 | 255.255.255.0 | 10.5.8.0 - 10.5.8.255 | 256 |
| 192.168.0.0/22 | 255.255.252.0 | 192.168.0.0 - 192.168.3.255 | 1,024 |
10.5.4.0/22
10.5.8.0/24
192.168.0.0/22About CIDR Aggregator
Route summarisation collapses many specific prefixes into fewer, shorter ones. Fewer prefixes means smaller routing tables, faster convergence, shorter ACLs and prefix lists that a human can review. This tool does the bit arithmetic exactly: adjacent blocks merge only when they align on a real power-of-two boundary.
How aggregation works
Two prefixes can merge into their parent only when they are the two halves of that parent - same length, and the first one starting on an even multiple of its own size. 10.0.0.0/24 and 10.0.1.0/24 merge into 10.0.0.0/23; 10.0.1.0/24 and 10.0.2.0/24 do not merge at all, despite being adjacent, because 10.0.1.0 is not a valid /23 boundary.
The tool sorts the input, merges overlapping and touching ranges, then decomposes each resulting range into the fewest exact CIDR blocks that cover it.
Strict versus relaxed
In strict mode the output covers exactly the addresses you supplied - safe for firewall rules and prefix lists, where covering extra space silently widens a permit. Relaxed mode allows a shorter aggregate that includes addresses you did not list, which is usually what you want for an advertised summary route but should always be reviewed before it becomes a permit statement.
Common use cases
- Turning a subnet allocation spreadsheet into BGP aggregate or OSPF area-range statements.
- Shrinking a firewall address group that has grown one /24 at a time for five years.
- Checking whether a set of customer prefixes can be announced as a single block.
- Cleaning up a route-filter prefix list before an audit.
Edge cases and gotchas
- Aggregating in a firewall context can permit addresses you never intended - always compare the covered count with the input count.
- Advertising an aggregate you do not fully control creates a blackhole for the parts you do not host.
- Bare addresses are treated as /32 host routes.