IP range to CIDR

Firewalls, route tables and cloud security groups take CIDR blocks, and people think in ranges. "Allow 192.168.1.10 through 192.168.1.200" has to become a list of prefixes, and doing it by hand is error-prone in the direction that matters: it is easy to produce a block that covers more than you meant, which quietly opens access you did not intend.

The algorithm is greedy and it is exact. At each step it takes the largest block that both starts at the current address — a block must be aligned to its own size — and does not run past the end. Then it moves to the address after that block and repeats. The result is provably the minimum number of blocks, and their sizes always add up to exactly the number of addresses in the range.

That alignment constraint is why an apparently simple range can need many blocks. 192.168.1.1 to 192.168.1.6 is six addresses and takes four blocks, because 1 is odd and can only start a /32. Ranges that start and end on power-of-two boundaries collapse to a single block, which is a good argument for choosing them when you get to.