Non-Aligned Range: Multiple CIDR Blocks
Learn why some IP ranges produce multiple CIDR blocks. Understand CIDR alignment, power-of-2 sizing, and how to minimize the number of resulting blocks.
Detailed Explanation
Why Non-Aligned Ranges Produce Multiple CIDRs
CIDR blocks have two constraints: the size must be a power of 2, and the start address must be aligned to that size. When an IP range violates either constraint, it must be expressed as multiple CIDR blocks.
Example: 41-Address Range
Range: 192.168.1.10 - 192.168.1.50
This 41-address range produces 6 CIDR blocks:
| CIDR | Addresses | Range |
|---|---|---|
| 192.168.1.10/31 | 2 | .10-.11 |
| 192.168.1.12/30 | 4 | .12-.15 |
| 192.168.1.16/28 | 16 | .16-.31 |
| 192.168.1.32/28 | 16 | .32-.47 |
| 192.168.1.48/31 | 2 | .48-.49 |
| 192.168.1.50/32 | 1 | .50 |
| Total | 41 |
The Algorithm
The tool uses a greedy algorithm:
- Start at the first address
- Find the largest valid CIDR block starting at that address that doesn't exceed the end
- Add it to the result
- Move to the next address after that block
- Repeat until the entire range is covered
Alignment Rules
A /N block must start at an address divisible by 2^(32-N):
| Prefix | Block Size | Start Must Be Divisible By |
|---|---|---|
| /32 | 1 | 1 (any address) |
| /31 | 2 | 2 |
| /30 | 4 | 4 |
| /28 | 16 | 16 |
| /24 | 256 | 256 |
| /16 | 65,536 | 65,536 |
Minimizing CIDR Blocks
To get fewer CIDR blocks:
- Align your start address to a power-of-2 boundary
- Choose an end address that completes a power-of-2 block
- Round up the range if your use case allows slightly more IPs
For example, instead of 192.168.1.10-192.168.1.50 (6 blocks), use 192.168.1.0-192.168.1.63 (1 block: /26).
Real-World Impact
More CIDR blocks means more firewall rules. Some firewalls have rule limits, so minimizing blocks matters. If you control the range assignment, choose aligned boundaries from the start.
Use Case
A security engineer notices that a vendor-provided IP allowlist contains 200 CIDR entries. By examining the ranges and re-aligning them to proper boundaries where possible, they reduce the list to 120 entries, staying within their firewall's 150-rule limit.