CIDR Overlaps and Aggregation: Finding Conflicts Before a Route Does
Blocks nest or are disjoint
Every valid CIDR block starts at a multiple of its own size, so two blocks can only be disjoint, identical, or one contains the other. There is no partial overlap between two properly aligned blocks. When the overlap checker reports "overlaps" for a pair, one of them was not aligned, which means it had host bits set and was normalised to its network address first.
| Pair | Relationship |
|---|---|
| 10.0.0.0/24 and 10.0.0.128/25 | The /24 contains the /25 |
| 10.0.0.0/24 and 10.0.0.0/24 | Identical |
| 10.0.0.0/24 and 10.0.1.0/24 | Disjoint, but adjacent |
Why it matters
- VPC peering and VPN: two networks that overlap cannot be routed to each other; one side has to be renumbered. Checking before you peer is far cheaper than after.
- Firewall and ACL lists: a contained entry is redundant, and an overlapping allow and deny pair makes the first-match order decisive.
Aggregation
Two adjacent blocks of the same size whose first block is aligned to the doubled size merge into one block of the next shorter prefix: 10.0.0.0/25 and 10.0.0.128/25 become 10.0.0.0/24. The checker merges ranges first (so contained and duplicate entries vanish) and then writes the fewest aligned blocks that cover exactly the same addresses. It never covers addresses you did not list: 10.0.0.0/24 and 10.0.2.0/24 stay two blocks, because 10.0.0.0/22 would also cover 10.0.1.0/24.
Bare addresses
An entry with no / counts as a /32.