IP CIDR Overlap Calculator

CIDR (Classless Inter-Domain Routing) notation writes an IPv4 network as an address followed by a slash and a prefix length, like 10.0.0.0/16. The number after the slash is the count of leading 1 bits in the subnet mask: a /16 means the first 16 bits identify the network and the remaining 16 bits identify hosts inside it. So /16 covers 2^16 = 65,536 addresses, /24 covers 2^8 = 256, and /32 is a single host. Replacing the old class A/B/C scheme with CIDR in 1993 let networks be allocated at any size that is a power of 2, instead of being forced into one of three fixed sizes.

CIDR networks are always aligned, power-of-two sized blocks: a /24 starts on a multiple of 256, a /20 on a multiple of 4,096, and so on. Given any two CIDR blocks, either they sit in completely separate parts of the address space (disjoint), they cover the exact same range (identical), or one is fully contained inside the other. There is no way for two aligned power-of-two blocks to share some addresses without one engulfing the other. If your input ever shows partial overlap, it almost always means one of the addresses is not aligned on its mask boundary, which the parser would normally snap to the network address first.

The shorter prefix is the larger block: 10.0.0.0/16 contains 10.0.1.0/24. Routing tables normally choose the longest matching prefix. Firewall behavior is product-specific and may use first match, last match, priorities, zones, or other policy logic, so overlap alone does not tell you which firewall rule wins.

Two blocks merge cleanly only when they are the same size, adjacent, and aligned on the next-higher mask boundary. For example, 10.0.0.0/24 and 10.0.1.0/24 are both /24, sit back to back, and together align perfectly on a /23 boundary, so they combine into 10.0.0.0/23. But 10.0.0.0/24 and 10.0.2.0/24 do not merge (there is a gap), and 10.0.0.0/24 plus 10.0.1.0/25 do not merge (different sizes). The technical term is supernetting or CIDR aggregation, and it is what BGP route summarization relies on to shrink internet routing tables.

Overlapping routes use longest-prefix matching, so a more specific route can send traffic to a different next hop. Firewalls apply their own ordering and policy semantics. Overlap between VPCs, VPNs, local networks, or container ranges can also make addresses ambiguous and require translation or renumbering. Check both routing and firewall documentation before changing policy.