How to convert an IP range to CIDR

Firewalls and route filters want prefixes. People think in ranges. Converting exactly matters more than converting neatly.

You have been given a range — 192.168.1.1 to 192.168.1.100 — and something wants CIDR notation. The conversion is mechanical, and the important property is that it is exact.

Step-by-step

1. Enter the first and last address.
2. Read the prefixes, which together cover exactly that range.

Why one range becomes several prefixes

A prefix must start on a multiple of its own size. A range starting at 192.168.1.1 cannot begin with anything larger than a /32, because .1 is not aligned to any bigger block.

The algorithm takes the largest block that both starts at the current address and does not run past the end, then moves on and repeats. The result is the fewest prefixes that fit exactly — nine of them for that example, which surprises people expecting one.

Exact matters more than tidy

Some tools return a single "nearest" prefix instead. For 192.168.1.1–100 that would be 192.168.1.0/25, which also covers .0 and .101 through .127 — 28 addresses you did not ask about.

In a spreadsheet that is a rounding convenience. In a firewall rule it silently permits traffic to or from addresses outside the range you were given, and in a route filter it advertises space that is not yours. The conversion here never does that.

Frequently asked questions

Why did my range produce nine prefixes?

Because its start and end do not fall on power-of-two boundaries. The prefixes step up in size from the start and back down toward the end, which is what covers the range exactly.

Can I get one prefix instead?

Only if the range happens to align to one. Otherwise a single prefix would cover addresses outside your range, which is a different thing from what you asked for.

Does this work for IPv6?

Yes, using the same algorithm. Awkward IPv6 boundaries can produce a large number of prefixes.