What "aggregation" means and why it's worth doing

Route summarization (also called supernetting or CIDR aggregation) takes a list of individual IPs or small CIDR blocks and finds the smallest set of larger blocks that covers exactly the same addresses. It matters for two practical reasons: firewall ACLs and router hardware both have limits on how many rules or routes they can hold efficiently, and a list of 40 individual /32 host entries is both harder to audit and closer to those limits than 3 well-chosen supernets covering the same hosts. It's the same principle behind why ISPs advertise one /16 to the internet instead of 256 individual /24s — fewer entries, same coverage, less table for every router in the path to hold.

How the aggregation actually works

Two steps. First, every input — a bare IP, a CIDR block — gets converted into a numeric address range (start and end). Adjacent or overlapping ranges get merged into single, larger ranges. Second, each merged range gets converted back into the minimal set of CIDR blocks that exactly covers it. That second step is the non-obvious part: a CIDR block is only valid if it starts on an address boundary aligned to its own size (a /24 must start at a multiple of 256, a /23 at a multiple of 512, and so on) — so an arbitrary range often can't be expressed as one block, and comes back as 2 or more CIDRs even after merging. This tool handles that alignment math for you; getting it wrong by hand is the single most common cause of an ACL rule that quietly covers more addresses than intended.

Worked example

Input: 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24. These four /24s are contiguous and together form exactly the range 192.168.0.0–192.168.3.255 — 1,024 addresses, which is a valid, alignment-correct /22. The aggregator merges all four inputs into the single block 192.168.0.0/22. Add a fifth, non-contiguous block like 192.168.5.0/24 and the result becomes two entries — the /22 plus the separate /24 — because there's a gap at 192.168.4.0/24 that isn't covered by any input, so the two groups can't be merged into one aligned block.

What doesn't aggregate cleanly

Misaligned ranges — four /24s starting at .1.0 instead of .0.0 don't form a valid /22, even though it's still "four contiguous /24s," because a /22 must start on a multiple of 4 in the third octet. The tool will emit more than one output block rather than a technically invalid supernet.
Gaps — any address not present in the input breaks the merge at that point, even a single missing host in an otherwise-contiguous run.
Odd-sized groups — 3 contiguous /24s can't become one clean supernet (that needs a power-of-2 count); the result stays as a /23 plus a /24, whichever combination exactly covers the input with the fewest blocks.