When implementing network controls at scale, we often need to define the entire public IPv4 space while excluding RFC1918 private addresses. The naive approach of simply subtracting three CIDR blocks from the total IPv4 space leads to inefficient routing tables. Here's the most optimized representation:

// Minimal CIDR set for public IPv4 (excluding RFC1918)
0.0.0.0/5
8.0.0.0/7
11.0.0.0/8
12.0.0.0/6
16.0.0.0/4
32.0.0.0/3
64.0.0.0/2
128.0.0.0/3
160.0.0.0/5
168.0.0.0/6
172.0.0.0/12
172.32.0.0/11
172.64.0.0/10
172.128.0.0/9
173.0.0.0/8
174.0.0.0/7
176.0.0.0/4
192.0.0.0/9
192.128.0.0/11
192.160.0.0/13
192.169.0.0/16
192.170.0.0/15
192.172.0.0/14
192.176.0.0/12
192.192.0.0/10
193.0.0.0/8
194.0.0.0/7
196.0.0.0/6
200.0.0.0/5
208.0.0.0/4
224.0.0.0/3

For OpenFlow controllers or SDN environments where flow table space is constrained, here's how to implement these ranges efficiently:

# Python example for OpenFlow rule generation
import ipaddress

PUBLIC_CIDRS = [
    "0.0.0.0/5", "8.0.0.0/7", "11.0.0.0/8", ..., "224.0.0.0/3"
]

def generate_flow_mods(controller_ip):
    flow_mods = []
    for cidr in PUBLIC_CIDRS:
        network = ipaddress.IPv4Network(cidr)
        flow_mods.append(f"""
            ofp_flow_mod(
                match=ofp_match(
                    nw_src=('{network.network_address}', '{network.netmask}'),
                    dl_type=0x800
                ),
                actions=[ofp_action_output(port=CONTROLLER_PORT)],
                priority=100
            )
        """)
    return flow_mods

The presented 31 CIDR blocks represent the most compact possible way to express:

• The entire public IPv4 space (0.0.0.0 - 223.255.255.255)
• While excluding all RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Without fragmenting smaller special-purpose blocks

In our production OpenFlow environment, switching from individual /24 rules to these consolidated CIDR blocks:

When working with OpenFlow networks, we often need to define flow-mods that distinguish between public internet traffic and private RFC1918 addresses. The challenge is to represent all public IPv4 space (0.0.0.0/1 to 223.255.255.255/32) while excluding the private ranges with minimal CIDR entries.

In OpenFlow implementations, especially with hardware limitations, flow table space is precious. Each additional flow entry consumes resources, and during network instability, we need to maintain critical flows while avoiding table overflow.

Here's the most efficient way to represent public IPv4 space excluding RFC1918:

0.0.0.0/5
8.0.0.0/7
11.0.0.0/8
12.0.0.0/6
16.0.0.0/4
32.0.0.0/3
64.0.0.0/3
96.0.0.0/4
112.0.0.0/5
120.0.0.0/6
124.0.0.0/7
126.0.0.0/8
128.0.0.0/3
160.0.0.0/5
168.0.0.0/6
172.0.0.0/12
172.32.0.0/11
172.64.0.0/10
172.128.0.0/9
173.0.0.0/8
174.0.0.0/7
176.0.0.0/4
192.0.0.0/9
192.128.0.0/11
192.160.0.0/13
192.169.0.0/16
192.170.0.0/15
192.172.0.0/14
192.176.0.0/12
192.192.0.0/10
193.0.0.0/8
194.0.0.0/7
196.0.0.0/6
200.0.0.0/5
208.0.0.0/4
224.0.0.0/3

Here's how to apply these ranges in an OpenFlow controller (using Python as example):

from ryu.ofproto import ofproto_v1_3

def add_public_internet_flows(datapath):
    ofproto = datapath.ofproto
    parser = datapath.ofproto_parser
    
    # List of public CIDR ranges (excluding RFC1918)
    public_ranges = [
        '0.0.0.0/5',
        '8.0.0.0/7',
        # ... include all ranges from above
        '224.0.0.0/3'
    ]
    
    for cidr in public_ranges:
        match = parser.OFPMatch(
            ipv4_src=cidr,
            eth_type=0x0800
        )
        actions = [parser.OFPActionOutput(ofproto.OFPP_NORMAL)]
        inst = [parser.OFPInstructionActions(
            ofproto.OFPIT_APPLY_ACTIONS, actions)]
        mod = parser.OFPFlowMod(
            datapath=datapath,
            priority=1000,
            match=match,
            instructions=inst
        )
        datapath.send_msg(mod)

Always verify your CIDR ranges with test cases:

import ipaddress

def test_public_ip(ip):
    public_ranges = [
        ipaddress.ip_network(cidr) for cidr in [
            '0.0.0.0/5',
            # ... all other ranges
        ]
    ]
    
    test_ip = ipaddress.ip_address(ip)
    for net in public_ranges:
        if test_ip in net:
            return True
    return False

# Should return True
print(test_public_ip('8.8.8.8'))  # Google DNS
print(test_public_ip('1.1.1.1'))  # Cloudflare DNS

# Should return False
print(test_public_ip('10.0.0.1'))
print(test_public_ip('192.168.1.1'))

When implementing this in production:

• Group related CIDR ranges where possible
• Consider hardware-specific flow table limitations
• Monitor flow table utilization during peak traffic
• Implement fallback mechanisms for table overflow