The complete guide to IP addresses

The subject in a minute#

• An IP address identifies a network connection and says where it sits in the network. It belongs to a connection, not a person. What is an IP address.
• There are two versions. IPv4 has 32 bits and about 4.3 billion addresses and ran out. IPv6 has 128 bits and will not. Most connections use both. IPv4 vs IPv6.
• Every connection has a private address on its own network and shares a public one with the internet. Websites see only the public one. Public vs private.
• The translation between them is NAT. What NAT is.
• An address belongs to a block, written in CIDR notation such as 192.168.10.0/26. CIDR and subnetting.
• Blocks are announced to the internet by networks, each identified by an ASN. What an ASN is.
• Names map to addresses through DNS, and addresses map back to names through reverse DNS. DNS and reverse DNS.
• Location from an IP address is an estimate. How accurate it is.

How an address is built#

An IPv4 address is 32 bits, written as four 8-bit octets in decimal: 192.168.10.77. Every address has two parts, a network part and a host part, and the prefix length says where the split falls. In 192.168.10.77/26, the first 26 bits name the network and the last 6 name the host. The prefix length replaced the old fixed address classes, which is why you will see both terms in older material.

An IPv6 address is 128 bits, written as eight 16-bit groups in hexadecimal, and can be shortened by dropping leading zeros and collapsing one run of zero groups to ::. The same prefix idea applies, and almost every network gets a /64. The full rules, with a diagram, are in the IPv4 vs IPv6 guide.

The reserved ranges#

Not every address is available to the public internet. IANA keeps a registry of special-purpose blocks, and these are the ones you will actually run into in logs, configuration files and firewall rules. None of them identifies a host on the public internet.

Four ways an address can be delivered#

Unicast

One sender, one receiver. The normal case: your browser and a web server.

Broadcast

One sender, every device on the local network. IPv4 only. IPv6 has no broadcast.

Multicast

One sender, every device that has joined a group. Used for streaming, discovery and IPv6 neighbour discovery.

Anycast

The same address announced from many places, with traffic going to the nearest one. Public DNS resolvers and the DNS root servers work this way, which is why a lookup for an address like 8.8.8.8 shows one location for something that runs in hundreds.

Where addresses come from, and how they are routed#

IANA holds the pool and delegates blocks to five regional registries. The registries delegate to ISPs and organisations, which assign addresses to customers. Registry records are public, and they are where the owner of a block, its abuse contact and the date it was registered come from. The what is an IP address guide lists the five registries and their regions.

Ownership is only half the story. For traffic to reach a block, some network has to announce it to its neighbours using BGP, the Border Gateway Protocol, and each network doing so is identified by an autonomous system number. The owner and the announcer are often the same organisation, but not always, which is why a lookup lists both an ISP or organisation and an ASN. What an ASN is covers the difference.

How to read a lookup result#

Every field in a lookup answers a specific question, and they differ in how far you can trust them.

Scope

Public, private, loopback, carrier-grade NAT, and so on. Derived from the address alone, so it is always right.

ASN and route

The network announcing the address, and the block it announces it in. Read from routing data: reliable.

ISP and organisation

Who the registry says holds it. Reliable, but it names the block's holder, which can differ from the operator.

Reverse DNS

The hostname its owner published, if any. Often generic, sometimes absent. Reverse DNS.

Connection type

Residential, mobile, business or data centre. An inference from the network, and a good one.

Location and accuracy

City, region, country and a radius. An estimate: check the radius before believing the city. Why it is often wrong.

VPN, proxy, Tor, hosting flags

Heuristics and lists. A hit is informative. A miss proves nothing.

Try it on addresses everyone knows

The public DNS resolvers are good practice material, because they are stable, well documented and anycast. See what a report shows for Cloudflare's 1.1.1.1, Google Public DNS at 8.8.8.8, Quad9's 9.9.9.9 and OpenDNS at 208.67.222.222, or the IPv6 equivalents at 2606:4700:4700::1111 and 2001:4860:4860::8888.

Where to go next#

Fundamentals

• What is an IP address?
• How to find your IP address on any device
• A beginner's guide to networking

Addressing and routing

• Public vs private IP addresses
• IPv4 vs IPv6
• Static vs dynamic IP addresses
• What is NAT, and what is CGNAT?
• IPv4 address classes explained
• CIDR notation and subnetting, with the subnet calculator
• What is an ASN?

DNS, privacy and location

• What is DNS and how does a lookup work?
• Reverse DNS and PTR records
• How websites see your IP address
• Can your IP address reveal your exact location?