IP Overlap Checker

IPv4 overlap is a planning error that hides inside notation. A spreadsheet row can say 10.44.0.0/16, another can say 10.44.80.0/20, and both can look valid until the ranges are converted into their first and last addresses. The smaller block is completely inside the larger one, so the same addresses have been claimed twice.

The risk appears most often before networks are connected. VPNs, VPC peering, route redistribution, firewall policy, tenant migrations, partner links, and mergers all assume that an address points to one intended place. When two inventories use the same addresses, routing may still pick a path, but it cannot decide which business system, branch, lab, or partner the address was supposed to represent.

CIDR notation is compact because a prefix length describes many addresses at once. That compactness is also why broad parent blocks, carved-out child subnets, single-host reservations, and start-end ranges can be hard to compare by eye. A /16 covers 65,536 addresses, a /24 covers 256, and a /32 covers one host.

Overlap checks are not reachability checks. They do not prove which router has the best path, whether a firewall permits traffic, or who owns a live host. They answer a narrower inventory question: do the declared IPv4 ranges collide under the scope being reviewed?

Special-use address space adds another source of confusion. Private, shared carrier-grade NAT, loopback, link-local, documentation, benchmark, multicast, reserved, and public ranges carry different expectations. The label can make unusual rows stand out, but it does not replace allocation records or live routing evidence.

A useful overlap review separates shared addresses from adjacent ranges, broad coverage from unique coverage, and host-bit mistakes from intentional network boundaries. Those distinctions prevent a clean-looking plan from hiding duplicate address counts or a parent range that swallows smaller allocations.

How to Use This Tool:

Start with the inventory text or file you already have, then narrow the scope only when the planned change calls for a cross-group audit.

1. Paste entries into IP inventory, drag a file onto the textarea, or use Browse for a text or CSV-style file under 512 KiB. A run accepts up to 600 non-blank rows.
2. Use one range per line. Accepted forms include CIDR blocks, single IPv4 hosts, start-end ranges, address plus dotted mask, CSV rows, and header rows such as label,cidr,group,note.
3. Keep labels and groups when you have them. Groups help separate on-prem, cloud, branch, partner, VPN, tenant, or environment ranges during cross-group review.
4. Choose Host-bit handling. Normalize mode converts host-bearing CIDRs such as 10.20.4.25/24 to the network boundary and records the correction. Strict mode rejects the row so the source inventory can be fixed.
5. Set Conflict scope. Use Audit all ranges for cleanup. Use Only flag overlaps between different groups when same-group reuse is expected but cross-group collisions would block peering, migration, or VPN work.
6. Open Advanced only when needed. Adjacent range notes marks touching ranges in the ledger, and Minimum shared addresses filters smaller intersections from conflict rows and summary counts.
7. Read the summary first, then use Overlap Findings, Inventory Ledger, Coverage Blocks, Overlap Pressure Map, and JSON when you need conflict rows, normalized ranges, unique coverage, chart triage, or a machine-readable record.

If the page shows Input needs review, correct the named line before relying on any overlap count. Invalid octets, invalid prefixes, leading-zero addresses, non-contiguous masks, and strict-mode host-bit rows stop the audit.

Interpreting Results:

Overlap Findings is the main conflict list. Exact duplicates and cross-group containment are usually the most urgent because they can make two places claim the same complete block. Partial cross-group overlap is also high risk because a route, firewall exception, or NAT rule may work for one part of a range and fail for another.

A No overlaps summary is only as broad as the selected settings. Cross-group mode ignores same-group collisions, and a raised Minimum shared addresses value can hide small intersections. Before attaching a clean result to a change record, check the scope note, Host-bit corrections, and the normalized CIDRs in Inventory Ledger.

Use Overlap Pressure Map to find ranges that create many conflicts or cover many addresses, then resolve the exact table rows. The chart helps triage; the row-level Action, Overlap CIDRs, and Range values are the audit evidence.

Technical Details:

IPv4 addresses are 32-bit integers usually written as four decimal octets. CIDR combines an address with a prefix length, where the prefix fixes the network bits and the remaining bits define the block size. Larger prefix numbers create smaller blocks: /24 covers 256 addresses, /31 covers 2, and /32 covers 1.

Overlap testing becomes exact after every accepted input is converted to a closed numeric range with a start address, end address, and size. CIDR blocks, dotted-mask rows, start-end spans, wildcard-style rows, and single hosts all reduce to that same form. Two ranges intersect when the later start address is less than or equal to the earlier end address.

Host-bit handling affects whether input such as 10.20.4.25/24 is accepted. In canonical network notation, the host bits outside the prefix are zero, so that input describes the 10.20.4.0/24 network after normalization. Strict review rejects the row instead, which is useful when the source inventory must remain exact.

Formula Core:

For an IPv4 CIDR prefix /p, the address count is:

For two closed ranges A and B, the shared address count is:

The formula applies only when max(startA, startB) <= min(endA, endB). Comparing 10.44.0.0/16 with 10.44.80.0/20 produces 4,096 shared addresses because the /20 sits entirely inside the /16.

Accepted Input Rules:

Relationship and Severity Rules:

Usable host count follows the common subnet convention of subtracting network and broadcast addresses for CIDR blocks shorter than /31. A /31 or /32 keeps its full size because point-to-point and host-specific cases often use those prefixes without the older subtraction rule.

Address-space classification is contextual. Private RFC 1918 blocks, shared carrier-grade NAT space, loopback, link-local, benchmark, documentation, multicast, reserved, current-network, mixed special/public, and public ranges are identified so unusual entries stand out. The label helps review intent, but it does not replace IPAM records, route tables, firewall policy, or live testing.

Privacy Notes:

The overlap audit runs in the browser after the page loads. Pasted inventory and files opened with Browse are read locally for parsing, tables, chart data, and downloads rather than uploaded for server-side analysis.

• Do not paste secrets, credentials, or customer-sensitive notes unless your environment permits that review in a browser page.
• Downloaded CSV, DOCX, JSON, and chart files are ordinary local files; store them under the same controls as other network change evidence.
• The result is inventory math, not a scan of live hosts, route preference, firewall reachability, or ownership records.

Worked Examples:

A migration review that includes Prod LAN,10.44.0.0/16,core and VPN pool,10.44.80.0/20,remote should produce a Critical row in Overlap Findings. The relationship shows containment, Shared addresses shows 4,096, and the action points toward narrowing, excluding, translating, isolating, or readdressing one side before peering.

A cleanup pass with Branch LAN,10.20.4.25/24,branch depends on Host-bit handling. Normalize mode records 10.20.4.0/24 in Inventory Ledger and increments Host-bit corrections. Strict mode stops the run with an error that names the corrected network boundary.

Two neighboring ranges such as 10.10.0.0/24 and 10.10.1.0/24 should not appear as an overlap because they share no address. When Adjacent range notes is enabled, the ledger can still flag the relationship, and Coverage Blocks can show how the unique cover looks after adjacency is merged.

A troubleshooting row such as Lab,10.1.0.0 255.0.255.0,test fails because the mask is non-contiguous. Replace it with a valid prefix or contiguous dotted mask, then recheck Inventory Ledger to confirm the normalized CIDR and address count.

FAQ:

Glossary:

CIDR

Classless notation that writes an IPv4 range as an address plus prefix length, such as 10.44.0.0/16.

Host bits

The part of an IPv4 address outside the prefix. In canonical CIDR network notation, those bits are zero.

Closed range

A start and end address where both boundary addresses are included in the comparison.

Containment

An overlap relationship where one range fully includes another range.

Adjacent range

A range that touches another range at the next address but does not share an address.

Coverage block

A merged unique address span created after overlapping and adjacent source ranges are combined.

References:

• RFC 4632, Classless Inter-domain Routing, IETF, August 2006.
• RFC 1918, Address Allocation for Private Internets, RFC Editor, February 1996.
• RFC 3021, 31-Bit Prefixes on IPv4 Links, RFC Editor, December 2000.
• IANA IPv4 Special-Purpose Address Registry, IANA.