CIDR and Route Summarization in Real Networks
How CIDR blocks, longest-prefix match and route summaries work together, with practical checks for overlap and unintended reachability.
CIDR replaced classful thinking
Classless Inter-Domain Routing lets a prefix end on any bit boundary instead of forcing networks into the old Class A, B and C sizes. That flexibility is what makes modern allocation and route summarization practical. A /21, for example, represents 2,048 addresses and spans eight contiguous /24-sized blocks.
When reading a route table, the prefix length is as important as the address. 10.0.0.0/8, 10.10.0.0/16 and 10.10.20.0/24 are different routes even though their text shares the same opening octets.
Longest-prefix match decides forwarding
Routers generally choose the most specific matching route. If a table contains 10.0.0.0/8 and 10.44.8.0/21, traffic to 10.44.10.25 matches both, but the /21 wins because it has the longer prefix.
This is why a more-specific route can live inside a summary without creating a conflict by itself. The operational question is whether that hierarchy is intentional. A summary pointing one direction and a more-specific pointing another is a normal design pattern; two customer networks accidentally using the same private space is not.
What makes a valid summary
A useful summary covers a contiguous set of networks that share the same high-order bits. Four contiguous /24s aligned on the correct boundary can summarize to a /22. If the networks are not contiguous or do not begin on the required boundary, forcing a summary may include address space that belongs somewhere else.
Before advertising a summary, calculate its complete range and compare it with every included and adjacent allocation. The summary should not quietly claim networks that are routed to another site or customer unless the architecture explicitly handles that condition.
Null routes and summary safety
Many designs install a discard or null route for an aggregate so traffic to unused addresses inside the summary does not loop or follow an unrelated default route. The exact mechanism depends on the platform and routing design.
The summary should also be tied to real reachability. Advertising a large aggregate when all contributing networks are gone can blackhole traffic. Some platforms and policies can condition advertisement on component routes; others require explicit operational controls.
A review checklist
For any new aggregate, confirm the exact range, component routes, next-hop behavior, longest-prefix interactions, redistribution policy and failure behavior. In multi-vendor environments, verify how each platform originates or suppresses aggregates.
A CIDR overlap check is especially valuable during acquisitions, cloud interconnects and VPN work because duplicated RFC1918 space is common. Catching that before implementation is much cheaper than solving it during an outage bridge.