Route summarisation advertises one prefix across a boundary in place of the many it covers, so routers beyond it hold one entry and never see the detail. (RFC) 1812 describes it as addressing domains: "Within such a domain, detailed information is available about constituent networks; outside it, only the common network prefix is advertised" (RFC 1812, section 2.2.5.2). You meet it on border routers (ABRs) and autonomous system (AS) boundary routers (ASBRs), on interfaces running the Enhanced Interior Gateway Routing Protocol (), and in static routes. By the end you can compute a summary in binary, configure and verify it in each place, explain the discard route that stops it looping, and recognise how it hides failures and bends paths. The side, between autonomous systems, is in Supernetting and route aggregation.

One route in place of many

In , "Area border routers then summarize the area contents (for distribution to the backbone) by advertising a single route for each address range" (RFC 2328, section 3.5), each range leaving the area as one link-state advertisement () and cutting routing traffic (section 3). The larger gain is containment: in EIGRP's terms, hiding detail "provides the ability to create effective failure domains within a single AS" (RFC 7868, section 3.1), because a summary appears with its first reachable component and "it is withdrawn only when all components become unreachable" (RFC 4632, section 5.4).

The summarising router's own table does not shrink, since it still forwards to every component (Junos, route aggregation), and longest match still rules (RFC 1812, section 2.2.5.2): a summary serves only destinations that no more specific route covers (Static routes, longest prefix match and administrative distance). It is the longest prefix all its components share: one bit longer misses one, one bit shorter claims addresses none of them holds.

The arithmetic: contiguous, aligned, a power of two

Under Classless Inter-domain Routing (), a prefix is a contiguous run of high-order bits (RFC 1812, section 2.2.5.2) naming a power-of-two block (RFC 4632, section 3.1) that starts where the remaining bits are zero. Prefixes summarise exactly only when they fill one such block, which is why RFC 4632 ties a site's aggregation to one contiguous power-of-two block rather than independent prefixes (section 4.1). The test: write the bits, find the longest run they share, and check that the bits after it take every value. Four /26s of the documentation block 198.51.100.0/24:

198.51.100.0/26    11000110.00110011.01100100.00000000
198.51.100.64/26   11000110.00110011.01100100.01000000
198.51.100.128/26  11000110.00110011.01100100.10000000
198.51.100.192/26  11000110.00110011.01100100.11000000

The first 24 bits match and the next two take all four values, so the set is exactly 198.51.100.0/24, 256 addresses, none spare. 198.51.100.64/26 and 198.51.100.128/26 are adjacent but differ in the first bit of the last octet, and a /25 starts only at .0 or .128, so their smallest single cover is the /24, with 128 addresses they never had. Without 198.51.100.128/26, the other three need 198.51.100.0/25 and 198.51.100.192/26, since a /24 would cover a 64-address hole. IPv6 behaves alike: 2001:db8::/64 to 2001:db8:0:3::/64 summarise to 2001:db8::/62 (IPv6 subnetting). Plan the blocks first (unequal subnets, a worked allocation).

Where summaries are made

Routers in one OSPF area share identical databases (RFC 2328, section 3), so summaries live at its boundaries (OSPF: the map, the math, and area 0).

OSPF area ranges, on the area border router

A range is an address, a mask and a status, Advertise or DoNotAdvertise. Each range sends at most one Type 3 summary-LSA out of the area, with the range's address and a "cost equal to the largest cost of any of the component networks"; DoNotAdvertise suppresses it and hides the components (RFC 2328, section 12.4.3). A range is active while the area holds an intra-area network inside it (section 11.1), and only then announced (FRRouting, OSPFv2). RFC 1583 had used the lowest cost (RFC 1583, section 3.5), which RFC 2178 found could cause a routing loop when an aggregated forwarding address is in use (RFC 2178, appendix G.7).

Cisco's reference gives area range the purpose "To consolidate and summarize routes at an area boundary", on ABRs only, but prints only its IPv6 form (Cisco, area range). Below are FRRouting's IPv4 and IPv6 syntax (FRRouting, OSPFv2, OSPFv3), Cisco's IPv6 form, the Junos statement, whose restrict hides the range (Junos, area-range), and an FRRouting line that makes the four /26s of area 0.0.0.1 one range:

area A.B.C.D range A.B.C.D/M [advertise [cost (0-16777215)]]
area A.B.C.D range X:X::X:X/M [<advertise|not-advertise|cost (0-16777215)>]
area area-id range ipv6-prefix / prefix-length [ advertise | not-advertise ] [ cost cost ]
area-range network/mask-length <exact> <override-metric metric> <restrict>;
area 0.0.0.1 range 198.51.100.0/24

External summaries, on the AS boundary router

Routes brought in by redistribution become AS-external-LSAs, one per route, the only LSAs flooded through the whole AS (RFC 2328, section 12.4.4). The ASBR summarises them (FRRouting, OSPFv3) with summary-address, which in FRRouting originates one external LSA for all those it matches (FRRouting, OSPFv2) and in Cisco covers redistributed routes (Cisco, Configuring OSPF). In a not-so-stubby area (NSSA), the border router may turn each Type-7 address range into a single Type-5 LSA (RFC 3101, section 2.2).

summary-address A.B.C.D/M [tag (1-4294967295)]
summary-address X:X::X:X/M [tag (1-4294967295)] [{metric (0-16777215) | metric-type (1-2)}]

EIGRP, on an interface

EIGRP summarises per interface (Cisco, ip summary-address eigrp) and differs from OSPF twice: "EIGRP summary routes are given an administrative-distance value of 5" (same page), and the summary takes "the minimum metric of the specific routes" (Cisco, EIGRP configuration guide). A distance of 255 stops the advertisement (command reference). The default of auto-summary, which summarises subnets to their network, depends on the release: it became disabled in 15.0(1)M and 12.2(33)SRE (Cisco, auto-summary).

ip summary-address eigrp as-number ip-address mask [admin-distance] [leak-map name]

Static summaries

Any router can summarise statically, since a router should let you define a static route to a network prefix (RFC 1812, section 7.4). The route points to Null0, blackhole or reject in FRRouting, and with a high distance it waits behind real routes as their fallback (FRRouting, STATIC).

ip route NETWORK (Null0|blackhole|reject) [tag TAG] [DISTANCE] [metric METRIC] [table TABLENO] [nexthop-vrf VRFNAME] [vrf VRFNAME]
ip route 198.51.100.0/24 Null0 255

The discard route, and the loop it prevents

RFC 4632 rules on addresses a summary covers but its router cannot reach: "A router that generates an aggregate route for multiple, more-specific routes must discard packets that match the aggregate route, but not any of the more-specific routes" (RFC 4632, section 5.1), or forwarding loops form (same section). In an illustrative case, router R advertises 198.51.100.0/24, has a default route to its upstream neighbour, and loses 198.51.100.128/26:

  1. A packet for 198.51.100.130 matches R's /24 at the neighbour and goes to R.
  2. R's longest match is now its default route, back to the neighbour.
  3. The packet bounces until its time to live () runs out.

A discard route for the /24 beats R's default, so R drops the packet, while the /26s it still reaches, longer matches still, keep working. Hence "a network must not follow the default to destinations that are part of one of its aggregated advertisements" (RFC 4632, section 5.2); defaults are covered in Routing tables and the default gateway.

OSPF inserts a discard entry for each active range, since such entries "are necessary to ensure that route summarization at area boundaries will not cause packet looping" (RFC 2328, section 11.1), and answers what ends on one with an Internet Control Message Protocol () destination unreachable to the source (section 11.1). "By default, OSPF installs discard routes to null0 for any area range (internal) or summary-address (external) prefixes that it advertises to other routers" (Cisco, OSPF discard routes), at distances 110 and 254 respectively (same page). Unreachable and reject routes send ICMP unreachable, while blackhole routes and a Junos discard next hop stay silent (ip-route(8), FRRouting, STATIC, Junos, route aggregation).

How summarisation fails

A range too narrow, or too wide

A range that is too narrow strands nothing: "By default, if a network is not contained in any explicitly configured address range, a Type 3 summary-LSA is generated with Link State ID equal to the network's address" (RFC 2328, section 12.4.3). Junos advertises NSSA external routes outside every prefix individually (Junos, area-range), and EIGRP suppresses only a summary's own components (Cisco, ip summary-address eigrp). The price is aggregation, not reachability.

A range that is too wide claims more than its components. Your own unused space is tolerable behind a discard route: Juniper's example summarises three /30s into a /28 covering a fourth, unused one (Junos, OSPF route control). Space routed elsewhere is not yours, for its holder "has sole responsibility for aggregation of those prefixes" (RFC 4632, section 5.4). Where the owner advertises a more specific route, longest match sends the traffic there, "punching a hole" in your aggregate (section 4.1); where it does not, the traffic dies on your discard route, and traceroute "will suggest that a problem exists within that network rather than in the network that is no longer advertising the more-specific prefix" (section 5.1). Between autonomous systems the same rule lets a more specific prefix hijack traffic, which providers counter with trust and route filters at their borders (section 12).

A summary that hides a failure

A summary stands while any component stands (RFC 4632, section 5.4), so a dead component's traffic still reaches the summariser and dies there. Cisco's EIGRP guide shows the trap with a default summary: Device-B advertises 0.0.0.0/0 to a downstream Device-C, and the summary's discard route overrides the default B learned from an upstream Device-A, so B loses its own way out (Cisco, EIGRP configuration guide). A floating summary, given an administrative distance at the interface (same page), is advertised without being installed (Cisco, ip summary-address eigrp). But when the link from A to B fails, B keeps advertising the default, and "In this scenario, Device-C still forwards traffic to Device-B, but Device-B drops the traffic" (configuration guide). Cisco therefore limits floating summaries to single-homed devices and areas with one exit point, since two or more exits can form a black hole route (same page).

Two area border routers, one range

Two cases follow from the OSPF rules rather than from any one sentence. An ABR whose range is active ignores another ABR's summary-LSA for the identical range (RFC 2328, section 16.2) and keeps its own discard entry (section 11.1). If the area partitions so that each of two ABRs reaches only part of the range, it follows that both keep advertising the summary and each drops traffic for the networks only the other reaches; hence "an address range must not be split across multiple components of the area partition" (section 3.7). Paths suffer too. Each ABR advertises the range at its largest component cost (section 12.4.3), so if one reaches two components at 10 and 40 and the other at 40 and 10, both advertise 40, which means remote routers send the whole range to one of them, even the component beside the other.

Seeing summaries on a router

A summary has no header of its own. In a capture, an OSPFv2 range is a Type 3 summary-LSA with the range's address as Link State ID and the largest component cost as metric (RFC 2328, section 12.4.3); an OSPFv3 range is an inter-area-prefix-LSA of LS (link state) type 0x2003, carrying PrefixLength, PrefixOptions and Address Prefix, with the maximum cost to any reachable component as metric (RFC 5340, sections 4.4.3.4 and A.4.5). FRRouting lists the summary-LSAs, the OSPF routes, the external summaries of OSPFv2 and OSPFv3, and the summary's own route (FRRouting, OSPFv2, OSPFv3, Zebra):

show ip ospf database summary
show ip ospf route
show ip ospf summary-address
show ipv6 ospf6 summary-address
show ip route 198.51.100.0/24

Cisco's show ip ospf database takes the same summary keyword (Cisco, show ip ospf database). Cisco's sample prints an OSPF discard route as Known via "ospf 1", distance 110, metric 0, type intra area with the next hop * directly connected, via Null0 (Cisco, OSPF discard routes). A static discard in FRRouting, as illustrative output in the layout of FRRouting's documented sample:

router> show ip route 198.51.100.0/24
Routing entry for 198.51.100.0/24
  Known via "static", distance 255, metric 0
    directly connected, Null0

On Linux, three commands assembled from the grammar of ip-route(8) give a silent discard for the summary, a listing of such routes, and the entry an address matches (ip-route(8)):

ip route add blackhole 198.51.100.0/24
ip route show type blackhole
ip route get fibmatch 198.51.100.130

Python's ipaddress module merges prefixes, refuses prefixes with host bits set, and finds holes with address_exclude() (Python, ipaddress), as this session in the Python playground shows:

>>> from ipaddress import ip_network, collapse_addresses
>>> four = [ip_network(f"198.51.100.{n}/26") for n in (0, 64, 128, 192)]
>>> list(collapse_addresses(four))
[IPv4Network('198.51.100.0/24')]
>>> list(collapse_addresses(four[1:3]))
[IPv4Network('198.51.100.64/26'), IPv4Network('198.51.100.128/26')]
>>> list(ip_network("198.51.100.0/24").address_exclude(four[2]))
[IPv4Network('198.51.100.0/25'), IPv4Network('198.51.100.192/26')]
>>> ip_network("198.51.100.64/25")
Traceback (most recent call last):
  ...
ValueError: 198.51.100.64/25 has host bits set

The CIDR / Subnet Calculator needs no code: Supernet mode shows a Minimal covering set and a Single supernet with its extra addresses (none, 128 and 64 for the three sets above), and Overlap / gap mode, with Scope (optional, enables gap detection) set to the planned summary, lists Gaps in scope, here 198.51.100.128/26.

What to remember

  • A summary replaces its components beyond a boundary: routers there hold one entry and see nothing while any component lives, but the summarising router keeps them all.
  • Prefixes summarise exactly only when they fill one aligned power-of-two block: write the bits, take the longest common prefix, and check the rest take every value.
  • OSPF summarises at boundaries, area ranges on ABRs at the largest component cost and external summaries on ASBRs and NSSA border routers; EIGRP summarises per interface, at administrative distance 5 and the smallest metric.
  • A network outside every range is still advertised alone, so a range that is too narrow costs aggregation, not reachability.
  • The summarising router must discard what matches the summary and no component, or a default route loops it until its TTL runs out.
  • A summary hides failures: traffic for a dead component, or for space routed elsewhere, dies at the summariser, and traceroute blames the wrong network.

Sources