How CIDR notation describes a block
A prefix such as 2001:db8::/32 names an address and a prefix length. The length says how many leading bits are fixed. The remaining bits vary across the block, so a /32 in IPv6 holds 2 to the power 96 addresses and a /24 in IPv4 holds 256. Because the varying bits are all zero at the start of the block, every block begins on a multiple of its size.
That alignment rule is the whole reason a range and a CIDR list are different things. A range is any two addresses with everything between them. A block is a range whose start is aligned and whose length is a power of two. Converting from one to the other means decomposing the range into aligned pieces.
What the range panel does with your input
Both addresses are parsed as IPv4 or IPv6. Compressed notation, embedded IPv4 tails and zone suffixes are all accepted. Mixing versions returns an error, as does an end address before the start. The calculator then emits blocks until the range is covered, prints their number and the total address count, and lists them one per line in a text box with a Copy all button.
There is one cap: a range that would need more than 10,000 blocks is refused with an error. In practice that only happens with awkward inputs, such as a range starting at an odd address and ending just below a huge boundary. If you hit it, round the start down or the end up to the nearest sensible boundary and the list shrinks to a handful of prefixes.
- 2001:db8:: to 2001:db8::1:ffff is one block, 2001:db8::/111, covering 131,072 addresses.
- 192.0.2.0 to 192.0.2.255 is 192.0.2.0/24. 192.0.2.1 to 192.0.2.255 is eight blocks.
- A single address, with start equal to end, comes back as one /32 or /128.
Using the output in firewalls and cloud rules
Most packet filters and cloud security groups take a prefix per rule and reject ranges outright, so the list is what you paste into nftables sets, iptables -s arguments, security group sources and BGP prefix lists. Paste the whole list rather than one approximate block: an over-wide /20 used to cover a /22 plus a few addresses admits thousands of hosts you never meant to allow.
For allow-lists the exactness matters most. For block-lists, operators often prefer to round outward and accept some collateral. The calculator always gives the exact decomposition, so rounding is your decision: use the CIDR panel to check what a rounded prefix would really cover before committing it.
Sizing IPv6 prefixes
IPv6 allocations are large by design. A /64 is the standard size for one LAN segment, because stateless address autoconfiguration needs a 64-bit interface identifier. It holds 18,446,744,073,709,551,616 addresses. A /56 gives a site 256 such segments, a /48 gives 65,536, and the CIDR panel prints the /64 count for any prefix of /64 or shorter.
The Last (expanded) row for IPv6 prints the final address in full eight-group form, which is what reverse DNS delegations and some firewall syntaxes need. For the canonical short forms of individual addresses, IPv6 compression and IPv6 expansion handle whole lists. For a private prefix to carve subnets from, local IPv6 generator produces a random /48.