IP Address Fundamentals

The whole reef, mapped. Every core idea about IP addresses, gathered on one page.

What this page is

This page is the overview: every core idea in this section, in order, in one place. Read it top to bottom and you will have the whole picture, and stopping here is a perfectly good outcome. Each section also links to its own article, which goes considerably deeper with worked examples and the edge cases this page skips. If you are revising, read this page. Go to an article when a particular section did not land, or when you need the detail behind it.

1. What an IP address is

Full article →

An IP address identifies a device on a network, the way a street address identifies a building. Every request you send carries a return address, or the answer has nowhere to go. IP stands for Internet Protocol, the rules that define how those numbers are written and how traffic carrying them is moved along.

There is no master map of the internet. No single machine knows the route from your couch to a server in Virginia. Each device along the way knows only which neighbor gets the packet next in order to move it closer to its destination.

The hops a packet takes A packet leaves your device, passes through your router, your internet service provider, and several backbone networks, then arrives at the destination server. Each hop reads only the destination address and forwards it onward. Nobody plans the whole route. Each hop just knows the next one. You Router ISP Backbone networks Destination server private public many hops What every hop reads The destination address, and nothing else it does not need. Routers do not open the payload, and no single one of them knows the full path from end to end.
Routers read the destination address, consult a table of which direction that range lives in, and forward. The path is assembled hop by hop, which is why the internet routes around damage and why latency varies from minute to minute.

Addresses are handed down through a hierarchy rather than claimed first come, first served. IANA allocates very large blocks to five regional registries, those registries allocate smaller blocks to internet providers, and your provider assigns one address to your connection. Your own router then hands out private addresses inside your home. Every one of those handoffs is recorded, and that public record is what makes geolocation possible at all.

2. Public and private addresses

Full article →

You have two addresses, and confusing them is the most common mistake in this whole subject. Your device holds a private address on your own network. Your household shares a single public address out on the internet. Your router sits between them and rewrites addresses in both directions, a process called NAT.

How private addresses share one public address Three devices on a home network hold private 192.168.1.x addresses. The router performs network address translation, so every one of them reaches the internet using the single public address the ISP assigned. Your home network (private) Laptop 192.168.1.14 Phone 192.168.1.22 Smart TV 192.168.1.37 Router doing NAT one shared exit What the internet sees 203.0.113.42 This is the number IP Narwhal shows you. Every device above shares it. Private ranges are reserved and unroutable: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Look up your address on a phone and then on a laptop on the same Wi-Fi and you get the same answer, because you are reading the address of the exit rather than of the device.

The mechanism is worth seeing, because it sounds impossible until you do. If three devices share one address, how does a reply find the right one? The answer is ports: the router picks an unused source port for each conversation and records the pairing.

How a router keeps replies straight Three devices open connections at once. The router rewrites each one to the same public address but a different source port, and records the mapping in a translation table so it knows which device each reply belongs to. One public address, three conversations, no confusion Inside your network 192.168.1.14:51200 192.168.1.22:49812 192.168.1.37:60104 Router keeps a translation table and picks a unique source port for each conversation What the internet sees 203.0.113.42:40001 203.0.113.42:40002 203.0.113.42:40003 Why this matters when a reply comes back A reply arrives addressed to 203.0.113.42:40002 and nothing in it names your phone. The router looks the port up in its table, finds 192.168.1.22:49812, rewrites the destination, and forwards it inside. This is also why an unsolicited connection from outside has nowhere to go: there is no table entry for it, so the router drops it. That side effect is why NAT is often mistaken for a firewall.
A reply names a port, not a device. The router looks it up, finds the private address it belongs to, and forwards it inside. An unsolicited connection has no entry, so it is dropped, which is why NAT is often mistaken for a firewall.

Three ranges are reserved for private use and are not routable on the public internet. If the number you are looking at falls in one of them, it is not the number a game server, camera app, or vendor allowlist is asking for.

10.0.0.0    to 10.255.255.255    a single large block, 16.7 million addresses
172.16.0.0  to 172.31.255.255    sixteen contiguous blocks
192.168.0.0 to 192.168.255.255   the range most home routers use

3. IPv4, and how it ran out

Full article →

IPv4 was defined in 1981 and is still the dominant protocol on the internet. An address is a 32-bit number, split into four 8-bit octets written in decimal with dots between them.

Anatomy of an IPv4 address The address 192.168.1.1 split into four octets. Each octet is eight bits, holding a value from 0 to 255, and the four together make 32 bits. 192.168.1.1, one octet at a time 192 168 1 1 . . . 11000000 10101000 00000001 00000001 8 bits 8 bits 8 bits 8 bits 32 bits in total 2 to the power of 32, which is 4,294,967,296 possible addresses Each octet holds 0 through 255, so 256.1.1.1 is not a valid address.
Each octet holds 0 through 255, because eight bits cannot count higher. That is why 192.168.300.1 is invalid on sight, which is a genuinely useful thing to be able to spot when reading a config file.

Thirty-two bits gives about 4.3 billion addresses. That felt limitless in 1981 and stopped being enough roughly twenty years later. IANA handed out the last unallocated blocks to the regional registries in 2011. Two techniques bought the time in between: NAT, which lets a whole household share one address, and CIDR, which allocates blocks in efficient sizes rather than in rigid classes. Both are life rafts rather than a permanent home.

4. IPv6, and why it took so long

Full article →

IPv6 uses 128-bit addresses, written as eight groups of four hexadecimal digits separated by colons. The jump from 32 bits to 128 does not make the pool four times bigger. It makes it about 79 octillion times bigger.

IPv4 and IPv6 address space compared IPv4 holds about 4.3 billion addresses. IPv6 holds about 340 undecillion, a number so much larger that the IPv4 pool is not visible at the same scale. IPv4 32 bits 4,294,967,296 addresses. At this scale that bar is 4 pixels wide. IPv6 128 bits 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses. To draw this bar to the same scale as the one above, it would need to stretch far past the moon. The teal sliver at its left edge is all of IPv4. Put another way IPv6 could give every grain of sand on Earth its own address and barely notice the dent.
The two bars are drawn to the same scale. The IPv4 pool is the four-pixel sliver, which is not a stylistic choice so much as an honest one.

Adoption has been slow for an unglamorous reason: the two protocols do not interoperate. An IPv6-only host cannot talk to an IPv4-only host without a translator in between, so nobody could switch until almost everybody had switched, and the incentive to go first was weak. The answer was dual stack, running both at once, which is what most networks do today and why our front page tests each protocol separately.

5. Why your address changes

Full article →

Most home connections receive a dynamic address on a lease from the provider, handed out by DHCP. The part people miss is that a lease is renewed long before it expires, and a renewal normally hands back the same address.

The life of a DHCP lease A lease is granted for a fixed time. Halfway through, the device asks to renew and usually keeps the same address. If it cannot reach the server it tries any server later, and if the lease fully expires the address returns to the pool. Your address is borrowed, not owned 0% Lease granted 50% Device asks the same server to renew. Usually keeps the address. 87.5% No answer, so it asks any server it can reach 100% Expired. Back to the pool. Usually you keep the same address A renewal at the halfway mark normally returns the address you already had, which is why a dynamic address can sit still for months. Until something interrupts the cycle A long power cut, a router reboot, or the provider reorganizing its pool all end the lease early, and the next one can be a different address.
This is why a dynamic address can sit unchanged for months and feel static. It changes when the renewal cycle is interrupted: a long power cut, a hardware swap, or the provider reorganizing its pool.

Mobile networks are the most volatile of all. Carriers rotate enormous shared pools, and an address can change while you are standing still. They also place customers behind carrier-grade NAT, where thousands of subscribers share one public address, and that is increasingly true on fixed-line connections too.

Carrier-grade NAT puts a second translation in the path With ordinary NAT your router holds a public address. Under carrier-grade NAT your router holds an address in the shared 100.64.0.0/10 range instead, and the provider performs a second translation before traffic reaches the internet. Ordinary NAT: one translation Your device 192.168.1.14 Your router 203.0.113.42 The internet Your router holds a real public address. Carrier-grade NAT: two translations, and the second one is not yours Your device 192.168.1.14 Your router 100.83.4.19 Provider's CGNAT shared by thousands The internet sees 198.51.100.7 How to tell, in ten seconds Open your router's status page and read its WAN address. If it starts with 100.64 through 100.127, that is the shared CGNAT range and it will not match the address shown on this site. Port forwarding cannot work through it, because the second translation is on equipment you do not control.
To check in ten seconds, compare your router's WAN address to the one on our front page. If the router shows something in 100.64 through 100.127, you are sharing an address and port forwarding cannot work.
If a vendor asked for your IP for an allowlist

A dynamic residential address will break that allowlist, often within days, and the failure will look like a mysterious permissions error rather than an address change. Ask about a static address, use a dynamic DNS hostname, or route through something with a fixed address instead.

6. How geolocation guesses your city

Full pillar →

No part of an IP address encodes a location. There is no field inside 203.0.113.42 that says Pennsylvania. Every location you have been shown from an address is an inference built from other records.

Where a location guess comes from No part of an IP address encodes a place. A geolocation database combines registry records, routing announcements, latency measurement and user-submitted corrections into an estimate. Nothing in 203.0.113.42 says "Easton, Pennsylvania" The number is an identifier, not a coordinate. Everything below is inference. Registry Which company holds this block, and where it operates Routing Which networks announce it, and from where Measurement Round-trip times from many known points, triangulated Corrections Reports from users and providers who know better A geolocation database publishes one best guess per block Every website you visit buys or licenses one of these. Two sites can disagree about you on the same day.
Registry records give the country. Routing narrows it to a region. Latency measured from many known points triangulates further. Corrections fix specific wrong answers. Providers weigh these differently, so two sites can disagree about you on the same day.

Accuracy is not one number. It collapses as you zoom in, and the drop between region and city is where most people's expectations break.

How accurate IP geolocation is by level Country level accuracy is very high. Region is moderate. City is roughly a coin flip and worse on mobile, satellite and VPN connections. Street level is not something IP geolocation can do at all. Accuracy falls off a cliff as you zoom in Country very high Region moderate City a coin flip Street not possible Bars are illustrative rather than measured, and every provider publishes different figures. Worst on mobile carriers, satellite links, VPNs, and corporate networks that leave through one office. In those cases the answer describes the network's exit point, which can be hundreds of miles away.
It fails hardest in exactly the cases people notice: mobile carriers whose gateways sit hundreds of miles away, satellite links whose traffic lands in another state, VPNs, and corporate networks that leave through one office.

A wrong record can be corrected, and it is worth knowing that there is no central registry to correct. Each provider keeps its own database, so a report has to be filed with each one you care about and will not propagate. Expect weeks rather than days.

If the pin on our front page is wrong

That is expected often enough to be worth saying plainly. The estimate describes where your provider hands your traffic to the internet, which is not necessarily where you are sitting.

7. Quick reference tables

The numbers worth having in one place rather than hunting through six articles.

Reserved and special-purpose ranges

RangeNameWhat it means if you see it
10.0.0.0/8PrivateA local network address, often a larger or business network
172.16.0.0/12PrivateA local network address, common in corporate and container networks
192.168.0.0/16PrivateA local network address, the usual choice for home routers
100.64.0.0/10Carrier-grade NATYour provider is sharing one public address among many customers
127.0.0.0/8LoopbackThe device talking to itself, never leaves the machine
169.254.0.0/16Link-localUsually a failure signal: no DHCP server answered
::1IPv6 loopbackThe IPv6 equivalent of 127.0.0.1
fe80::/10IPv6 link-localValid only on the local link, not routable

IPv4 and IPv6 side by side

IPv4IPv6
Address size32 bits128 bits
Written asFour decimal octetsEight hexadecimal groups
Example203.0.113.422001:db8::8a2e:370:7334
Total addressesAbout 4.3 billionAbout 340 undecillion
Defined in19811998
NATNearly universalUsually unnecessary

8. Common questions

Which number do I give someone who asks for my IP?

The IPv4 line on our front page, the one that looks like 203.0.113.42. If they specifically asked for IPv6, give them the long one with colons.

Why does my computer show a different address than this site?

Your computer is showing its private address on your own network. This site shows the public address your whole household shares. Both are correct, and they answer different questions.

Can someone find my house from my IP address?

Not from the address alone. It generally reveals your provider and a rough area, frequently the wrong city. The record linking an address to a specific subscriber sits with the provider and normally requires legal process to obtain.

Does changing my IP address make me anonymous?

No. Cookies, browser fingerprints, and any account you log into all survive an address change. It is a much smaller move than it is usually made out to be.

Why do I have no IPv6 address?

Either your provider has not enabled it, your router is not configured for it, or something on your device or network is blocking it. It is common and mostly harmless, since the IPv4 internet still works everywhere.

Read any section in full