Non-Aligned Range: Multiple CIDR Blocks

Learn why some IP ranges produce multiple CIDR blocks. Understand CIDR alignment, power-of-2 sizing, and how to minimize the number of resulting blocks.

Practical

Detailed Explanation

Why Non-Aligned Ranges Produce Multiple CIDRs

CIDR blocks have two constraints: the size must be a power of 2, and the start address must be aligned to that size. When an IP range violates either constraint, it must be expressed as multiple CIDR blocks.

Example: 41-Address Range

Range: 192.168.1.10 - 192.168.1.50

This 41-address range produces 6 CIDR blocks:

CIDR Addresses Range
192.168.1.10/31 2 .10-.11
192.168.1.12/30 4 .12-.15
192.168.1.16/28 16 .16-.31
192.168.1.32/28 16 .32-.47
192.168.1.48/31 2 .48-.49
192.168.1.50/32 1 .50
Total 41

The Algorithm

The tool uses a greedy algorithm:

  1. Start at the first address
  2. Find the largest valid CIDR block starting at that address that doesn't exceed the end
  3. Add it to the result
  4. Move to the next address after that block
  5. Repeat until the entire range is covered

Alignment Rules

A /N block must start at an address divisible by 2^(32-N):

Prefix Block Size Start Must Be Divisible By
/32 1 1 (any address)
/31 2 2
/30 4 4
/28 16 16
/24 256 256
/16 65,536 65,536

Minimizing CIDR Blocks

To get fewer CIDR blocks:

  • Align your start address to a power-of-2 boundary
  • Choose an end address that completes a power-of-2 block
  • Round up the range if your use case allows slightly more IPs

For example, instead of 192.168.1.10-192.168.1.50 (6 blocks), use 192.168.1.0-192.168.1.63 (1 block: /26).

Real-World Impact

More CIDR blocks means more firewall rules. Some firewalls have rule limits, so minimizing blocks matters. If you control the range assignment, choose aligned boundaries from the start.

Use Case

A security engineer notices that a vendor-provided IP allowlist contains 200 CIDR entries. By examining the ranges and re-aligning them to proper boundaries where possible, they reduce the list to 120 entries, staying within their firewall's 150-rule limit.

Try It — IP Range to CIDR Converter

Open full tool