IP and network calculations
Shorten a CIDR list without expanding its range
Tools to use
Allowlist entries accumulate over time. Similar-looking blocks invite consolidation, but shorter is not automatically equivalent. Filling a gap between blocks can add addresses that should not be included. Use CIDR aggregation to simplify representation while preserving the original address set.
Two aligned /25 blocks can become one /24
192.0.2.0/25
192.0.2.128/25The result is 192.0.2.0/24. The halves .0–.127 and .128–.255 fill that /24 without a gap, and their 128+128 addresses total 256. Equal counts alone do not prove equal sets; verify boundaries and the absence of missing portions too.
Adjacency alone is insufficient. The /26 blocks starting at .64 and .128 are adjacent and total 128 addresses, but straddle a /25 boundary, so remain separate. There is no single /25 for .64–.191. Both size and alignment matter.
A contained block adds no new addresses
192.0.2.0/24
192.0.2.128/25
192.0.2.0/24The result is one 192.0.2.0/24. Neither the repeated /24 nor its contained /25 adds addresses. Summing row counts gives 256+128+256, but the unique set still contains 256. Reducing lines is not necessarily reducing coverage.
If original rules carry different ports, descriptions, targets, or priorities, address containment alone does not authorize deleting a rule. The tool handles CIDR sets, not associated rule semantics. It cannot establish equivalence of an entire configuration file.
Do not fill a gap just to get one entry
192.0.2.0/26
192.0.2.128/26Both remain. Replacing them with /24 would add .64–.127 and .192–.255, doubling coverage from 128 to 256 addresses. A two-line result is not necessarily a failure; those entries can be necessary to preserve the exact set.
Keeping only the minimum and maximum also erases internal gaps. A broad covering range and the smallest exact CIDR set solve different problems. Confirm that exact preservation is the intended goal when simplifying an allowlist.
For endpoints, start with range-to-CIDR conversion
192.0.2.10
192.0.2.20192.0.2.10/31
192.0.2.12/30
192.0.2.16/30
192.0.2.20/32The counts 2+4+4+1 total eleven without crossing either endpoint. Here /31 describes two addresses as part of a set; it is not an instruction to configure a point-to-point link. Separate range representation from network assignment.
A reversed range or mixed address families is rejected. The tool decomposes aligned blocks rather than generating each address. A single CIDR input can also be converted back to its start and end for inspection.
Sorted output does not evaluate rule priority
Output is organized by address ranges, not by original rule precedence. Replacing a first-match configuration directly is a separate semantic change. If you removed comments, ports, or allow/deny distinctions to calculate, recognize that the result no longer contains that information.
Input and output are limited to 1,024 entries. Even an unchanged line count can confirm ordering or absence of redundancy. Process IPv4 and IPv6 separately. Reaggregating the output should be stable, but stability alone does not prove equivalence with the original intended policy.
Decide what must stay unchanged before shortening
Keep the original list and inspect boundaries, overlaps, and gaps before and after. If coverage should change, state additions and removals separately from formatting. SheepDev sends no configuration to routers or firewalls; use the output as review evidence within the target system's change process.
Preserve the set before shortening the list
Combining 192.0.2.0/26 and 192.0.2.128/26 into /24 adds .64–.127 and .192–.255 that were absent. One line is shorter but represents a larger set. This tool preserves exact coverage. A list that does not shrink may correctly retain a gap rather than fail to optimize. For an allowlist, unchanged permission coverage matters more than line count.
Removing duplicates or contained prefixes also assumes the list carries only address membership. Identical CIDRs can have different owners, expiry dates, comments or allow/deny actions. Extracting and aggregating their addresses does not merge those meanings. First simplify the address set, then separately assess whether that result preserves the original operational configuration.
For verification, both original-minus-result and result-minus-original should be empty. Equal total counts alone could hide replacement by different addresses. Compare intervals or prefixes instead of enumerating every host. Report that the aggregation preserves coverage, not merely how many lines it removed.