Home › Guides › CIDR aggregation

How to aggregate prefixes without widening them

Route summarisation shortens a list. Doing it carelessly quietly includes addresses that were never yours.

Aggregation — also called summarisation — replaces several prefixes with fewer that cover the same addresses. It shortens routing tables, access lists and firewall objects.

Step-by-step

  1. Paste your prefixes, one per line.
  2. Read the aggregated set, and the note about what it covers.

When two prefixes may merge

Only when they are genuine siblings: the same length, adjacent, and together forming exactly the parent one bit shorter. 10.0.0.0/25 and 10.0.0.128/25 merge into 10.0.0.0/24, because those two are precisely the halves of that /24.

When they may not

10.0.1.0/24 and 10.0.2.0/24 look adjacent and must not merge. The smallest prefix covering both is 10.0.0.0/22, which also covers 10.0.0.0/24 and 10.0.3.0/24 — two networks that were not in your list.

If those belong to someone else, you have just written a firewall rule permitting their traffic, or advertised a route for space you do not own. This is not a theoretical concern; it is a well-known cause of routing incidents.

Contained prefixes are dropped

Listing both 10.0.0.0/8 and 10.1.0.0/16 is redundant, since the second is inside the first. The aggregator removes the contained one. If your input contained overlaps, the summary says so, and reports the union rather than leaving the difference unexplained.

When you do want a supernet that covers more than your exact list — which is sometimes the right operational choice — decide it deliberately and write down what extra space it takes in. It should never be something a tool did quietly on your behalf.

Frequently asked questions

Why will two adjacent prefixes not merge?

Because they are not halves of a common parent. Merging them needs a larger prefix that also covers other networks, which would widen whatever you use the result for.

What is the difference between aggregation and supernetting?

Aggregation here is exact — the result covers the same addresses. A supernet deliberately covers more, which is sometimes useful and should always be a conscious decision.

Does aggregation change what my routes reach?

Not when it is exact. That is why the tool refuses merges that would extend coverage beyond the input.

Open the aggregator →