IPv4 prefix set subtract

ipv4-prefix-set-subtract · version 1.0.0 · URLs & IP addresses · free, no key needed

Subtract one IPv4 prefix set from another into sorted minimal disjoint CIDRs.

Use when you need to: subtract one ipv4 prefix set from another · ipv4 prefix set difference · cidr blocks only in the left prefix set.

Decide before calling

Read the versioned contract and the supported scope below. Reuse ipv4-prefix-set-subtract@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use ipv4-prefix-set-subtract@1.0.0 for subtract one ipv4 prefix set from another. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• subtract one ipv4 prefix set from another
• ipv4 prefix set difference
• cidr blocks only in the left prefix set
• remove a prefix set from an ipv4 set
• punch holes in an ipv4 prefix set
• exclude these cidrs from the ipv4 set
• left minus right ipv4 prefixes

Not supported

• IPv6 prefix sets
• prefixes longer than /32
• returning the removed addresses as well as the remainder

Behavior

• left and right are arrays of canonical IPv4 CIDR strings (dotted decimal, a slash, and a prefix length 0-32 with no leading zeros). An omitted strict means true.
• When strict is true, any prefix with host bits set is invalid_input. When strict is false, those bits are cleared before the subtraction.
• prefixes is the shortest list of non-overlapping CIDRs, sorted by network address, whose addresses are exactly left minus right. Covering stops at /32: removing one address from a block emits host routes and aligned neighbors, never a length above 32.
• More than 64 prefixes on one side, or a prefix longer than 18 code points, is limit_exceeded before syntax checks. A cover longer than 16 prefixes is limit_exceeded.
• Empty arrays are empty sets. Subtracting a set from itself, or subtracting a superset, yields an empty cover.

Input

• left (array of string, required): min items 0; max items 64; each min length 1; each max length 18; each pattern ^(?:0|[1-9][0-9]{0,2})(?:\.(?:0|[1-9][0-9]{0,2})){3}/(?:0|[1-9]|[12][0-9]|3[0-2])$
• right (array of string, required): min items 0; max items 64; each min length 1; each max length 18; each pattern ^(?:0|[1-9][0-9]{0,2})(?:\.(?:0|[1-9][0-9]{0,2})){3}/(?:0|[1-9]|[12][0-9]|3[0-2])$
• strict (boolean, optional)

Output

• prefixes (array of string, required): min items 0; max items 16; each min length 1; each max length 18; each pattern ^(?:0|[1-9][0-9]{0,2})(?:\.(?:0|[1-9][0-9]{0,2})){3}/(?:0|[1-9]|[12][0-9]|3[0-2])$
• count (integer, required): min 0; max 16

Limits

• max prefixes per side: 64
• max prefix chars: 18
• max emitted prefixes: 16

Example

Request input:

{
  "left": [
    "10.0.0.0/30"
  ],
  "right": [
    "10.0.0.1/32"
  ]
}

Response:

{
  "result": {
    "prefixes": [
      "10.0.0.0/32",
      "10.0.0.2/31"
    ],
    "count": 2
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "ipv4-prefix-set-subtract",
  "version": "1.0.0",
  "input": {
    "left": [
      "10.0.0.0/30"
    ],
    "right": [
      "10.0.0.1/32"
    ]
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/ipv4-prefix-set-subtract/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"left":["10.0.0.0/30"],"right":["10.0.0.1/32"]}'

The machine-readable contract is at /v1/tools/ipv4-prefix-set-subtract/versions/1.0.0.

CLI

node cli.mjs run ipv4-prefix-set-subtract 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• IPv4 prefix set intersect: Intersect two IPv4 prefix sets into one sorted minimal list of disjoint CIDRs.
• IPv4 prefix set union: Union two IPv4 prefix sets into one sorted minimal list of disjoint CIDRs.
• IPv4 prefix set equal: Report whether two IPv4 prefix sets cover exactly the same addresses.
• IPv4 in CIDR: Test whether a canonical IPv4 address lies in a CIDR prefix whose host bits are zero.
• IPv4 range to cidrs: Convert an arbitrary IPv4 address range into the minimal list of CIDR blocks that exactly covers it.
• IPv6 in CIDR: Test whether an IPv6 address lies in a CIDR prefix whose host bits are zero.