Subnet Overlap Checker — Detect Whether Two CIDR Blocks Overlap (Free)
Enter two IPv4 CIDR blocks (e.g. 192.168.1.0/24) and instantly find out whether they are identical, one contains the other, or they don't overlap at all. Useful for catching conflicts when designing firewall rules or VPC subnets.
Types of Subnet Overlap Relationships
A reference table of every possible relationship between two CIDR blocks.
| Relationship | Example | Description |
|---|---|---|
| Identical | 192.168.1.0/24 = 192.168.1.0/24 | Both CIDR blocks refer to exactly the same address range — they are the same subnet. |
| A contains B | 192.168.0.0/16 ⊃ 192.168.1.0/24 | CIDR A's address range fully contains CIDR B's range. B is a subnet carved out of A. |
| B contains A | 192.168.1.0/24 ⊂ 192.168.0.0/16 | CIDR B's address range fully contains CIDR A's range. A is a subnet carved out of B. |
| Partial overlap | — | This state never actually occurs. Because CIDR blocks are always aligned to power-of-two boundaries, if two blocks overlap at all, one must always be identical to or fully contain the other (see the FAQ below for details). |
| No overlap | 192.168.1.0/24 と 192.168.2.0/24 | The two CIDR blocks' address ranges don't overlap at all. They can be used side by side without conflict. |
To find the network and broadcast address from a single IP and subnet mask, see the subnet calculator , or to convert between an IP range and CIDR notation, see the IP range ⇔ CIDR converter .
Tips
- Handy for checking firewall ACL rules or VPC subnet designs to make sure you haven't accidentally defined the same address range twice.
- A "contains" relationship is a normal, expected pattern when you carve a smaller subnet (like a /24) out of a larger allocation (like a /16) — it's not necessarily a problem.
- When setting up VPC peering or a VPN connection in the cloud, overlapping CIDR blocks on either side make routing ambiguous and cause connection errors. Always check for overlap before connecting.
- The "A range" and "B range" in the result are automatically rounded to the network and broadcast address of the matching block, even if the IP you typed wasn't the exact network address for that prefix length.
FAQ
Side Note — Why CIDR Blocks Can Never "Partially" Overlap
Compare any two CIDR blocks and only three outcomes are possible: identical, one contains the other, or no overlap at all — a genuine "partial" overlap is mathematically impossible. This follows directly from the constraint that a CIDR block must always be a power-of-two size, positioned only at an address that's a multiple of that size (its alignment boundary).
An intuitive way to see this is to picture the set of all CIDR blocks as a binary tree. Start with /0 as the root, and every time the prefix length increases by one, a node splits into two children (the first half and the second half of its range). Under that structure, any two blocks are either the exact same node, one is an ancestor of the other, or they sit on completely separate branches — there's no way for two branches to cross halfway through.
This property is exactly what makes route summarization in routing tables well-defined. If partial overlap were possible, "which route should this packet prefer" would become genuinely ambiguous — but CIDR's design rules out that scenario by construction. In practice, most real-world routing breakage traces back to someone carving up IP ranges by hand without respecting this alignment rule, causing boundaries to drift unintentionally.