Quick answer
An IP address is a numeric label assigned to an IP interface within a routing context. Routers use destination addresses to select a route and deliver packets. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits. A single device can hold several addresses at once, while one public IPv4 address can represent a whole household through NAPT or many subscribers through CGNAT. An IP address is a routing identifier, not a permanent identity.
Calling an IP address a “home address on the Internet” works for about thirty seconds. Then DHCP, NAT, CGNAT, VPNs, anycast and IPv6 break the analogy. Addresses move, private ranges repeat in millions of networks, and the address a website sees may belong to an ISP translator rather than the device that opened the connection. The useful model is simpler: follow the packet, note which address exists at each boundary, and keep routing facts separate from identity.
01 / Basics
What an IP address actually is
Start with the interface. IP addresses are assigned to interfaces, not to a computer as one indivisible object. A dual-stack laptop can have an IPv4 LAN address, an IPv6 link-local address, one or more global IPv6 addresses, temporary IPv6 addresses, and loopback addresses at the same time. The operating system chooses an appropriate source address for each destination. “The IP of my device” is useful shorthand, but it is still shorthand.
The routing context matters just as much. 192.168.1.24 can exist in millions of homes because RFC 1918 space is deliberately reusable. VRFs and overlays can isolate overlapping address space for the same reason. Globally routable unicast addresses are expected to be usable without that ambiguity in the public routing context, but inside private routing tables the same numeric address can mean something else entirely.
Packet delivery is the job. A router examines the destination address, looks for the best matching route, and forwards the packet toward the next hop. Identity, reputation and geography are later layers built around that forwarding system. They inherit its realities: reassignment, translation, aggregation, mobility and shared infrastructure.
02 / Addressing
How an address identifies a network interface
Follow one ordinary home connection. The Wi-Fi interface may hold 192.168.1.24 from the home DHCP server. The router has a LAN address and a WAN-side assignment from the ISP. That WAN assignment is not always a globally routable address: under CGNAT it may come from 100.64.0.0/10, with another translation deeper in the provider network. A remote web server records the public source address presented after the final NAT or proxy hop.
An address does not contain a permanent “network half” and “host half” by itself. The prefix length defines the boundary for a particular route or subnet. In 192.168.1.0/24, the first 24 bits identify that prefix and the remaining bits vary inside it. Routers use longest-prefix matching against the destination address; on the final directly connected link, ARP in IPv4 or Neighbor Discovery in IPv6 resolves the next-hop link-layer address. That prefix model, formalized by CIDR, is what makes aggregation and Internet-scale routing possible.
03 / IPv4
How IPv4 works
IPv4, specified in RFC 791, uses 32-bit addresses: 232 possible bit patterns, or 4,294,967,296 values before special-use and reserved ranges are considered. Address scarcity made conservation operationally important and helped drive widespread NAPT, CGNAT, address transfers and leasing. The dotted-decimal form is only a human notation for that 32-bit value.
One example is worth decoding once:
203.0.113.7 = 11001011.00000000.01110001.00000111 203.0.113.0/24 -> first 24 bits identify the prefix traditional broadcast /24 -> 254 assignable host addresses; /31 and /32 are special cases
IPv4 scarcity explains a large part of today’s access-network design. Home NAPT lets many devices share one public address. CGNAT repeats that sharing at provider scale. Static IPv4 service costs more on many networks because a stable public address consumes scarce space. None of this changes what IPv4 is; it changes how operators stretch a small address space across a much larger Internet.
04 / IPv6
Why IPv6 exists and how it differs
IPv6, specified in RFC 8200, uses 128-bit addresses. The larger space removes the IPv4-style pressure to conserve every public address, but there is no single “standard consumer prefix” that every ISP must delegate. RFC 6177 explicitly rejects a one-size-fits-all end-site assignment. A /56, common on residential services, contains 256 /64 subnets; a /48 contains 65,536. The design goal is enough space for multiple subnets without forcing address conservation through NAPT.
| Topic | IPv4 | IPv6 |
|---|---|---|
| Address size | 32 bits | 128 bits |
| Typical LAN model | RFC 1918 + NAPT is common | Global/ULA addressing; /64 is the normal LAN subnet size |
| Host configuration | DHCP or manual | SLAAC, DHCPv6 or manual; methods can coexist |
| Customer allocation | Often one public IPv4 or CGNAT service | Delegated prefix size varies by ISP; /56 and /48 are common examples |
| Address conservation | NAPT widely used | NAPT is not required for conservation; stateful firewalling provides policy without translation |
| Transition | Native IPv4 or carried through transition mechanisms | Native IPv6, dual-stack, or IPv6-only with translation to IPv4 |
Figure 2 — IPv4 and IPv6 side by side. Prefix allocation, host configuration and translation policy differ more than the headline bit count suggests.
With IPv6, address configuration is less tied to the idea of a DHCP lease. SLAAC lets a host form addresses from prefixes advertised by a router; DHCPv6 can coexist and provide addresses or other configuration. RFC 8981 temporary addresses rotate interface identifiers to reduce long-term tracking, although operating-system and application policy decides when they are preferred. Seeing several addresses on one interface is therefore normal: link-local, stable or semistable global addresses, and temporary addresses can all be present at once.
IPv6 does not need NAPT for address conservation. Boundary security is normally handled with stateful firewall policy, not by hiding hosts behind translation. Prefix translation such as NPTv6 exists for specific designs, but it is not the IPv6 equivalent of routine home NAPT. The transition between protocol families is mixed rather than uniform: dual-stack remains common, while other networks run IPv6-only access and reach IPv4 services through NAT64/464XLAT or use mechanisms such as DS-Lite.
05 / Public vs Private
Public, private, shared and special-use addresses
Not all address space has the same scope. Globally routable unicast space is intended to be unique in the public Internet routing context. RFC 1918 space is reusable inside private networks and is not intended to be routed across the public Internet. Other ranges have narrower purposes: provider shared space, loopback, link-local, documentation, and IPv6 Unique Local Addresses. Treating all of them as “public vs private” throws away useful information.
| Range | Name | What it means when you encounter it |
|---|---|---|
| 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | Private IPv4 (RFC 1918) | Not a valid globally routed public source. Usually internal, tunneled, translated, misconfigured, or spoofed at an Internet-facing boundary. |
| 100.64.0.0/10 | Shared Address Space (RFC 6598) | Provider-shared space intended for links between customer equipment and carrier-grade translation. A WAN address here is a strong CGNAT clue when the external public IPv4 differs. |
| 127.0.0.0/8, ::1 | Loopback | Local to the host. These addresses should not appear as ordinary routed external sources. |
| 169.254.0.0/16 | IPv4 link-local (RFC 3927) | Valid only on the local link. Common when normal IPv4 configuration is unavailable, including failed DHCP, but it can also be used deliberately. |
| fe80::/10 | IPv6 link-local | Normal IPv6 link-local scope. Used for Neighbor Discovery and router communication; seeing it does not imply DHCP failure. |
| fc00::/7 (commonly fd00::/8) | IPv6 Unique Local (RFC 4193) | Locally routed IPv6 space with a high probability of unique prefixes. Not expected to be routed on the global Internet. |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32 | Documentation | Reserved for examples and documentation. Production systems should not treat these as ordinary public subscriber space. |
The range that causes the most confusion is 100.64.0.0/10. If the router WAN address is inside that block and an external lookup shows a different public IPv4, carrier-grade translation is the likely explanation. A private RFC 1918 WAN address also proves there is upstream private addressing or NAT, but it does not distinguish CGNAT from a second home router, an ISP modem/router, or another private network layer.
06 / Assignment
Static vs dynamic IP addresses
“Dynamic” means the address or prefix is not guaranteed to remain yours indefinitely. In IPv4, DHCP commonly assigns addresses with a lease. IPv6 SLAAC works differently: the host forms an address from a router-advertised prefix and tracks preferred and valid lifetimes; DHCPv6 can also assign addresses or delegate prefixes. A static or fixed assignment is intended to remain stable, whether it is configured manually, reserved by policy, or routed to the customer.
Dynamic does not mean constantly changing. Residential public addresses can stay stable for long periods, and some providers use sticky assignments even though they are not contractually fixed. A static address is not a security feature. It mainly changes operational stability: self-hosted services are easier to find, allowlists are simpler to maintain, and activity is easier to correlate over time.
07 / NAT
How NAT changes what the Internet sees
Home “NAT” is usually NAPT or PAT: the router rewrites the source IPv4 address and, when necessary, the source port, then keeps state so return traffic reaches the right inside endpoint. Several devices therefore present the same public IPv4 to remote servers while their flows remain distinct by protocol and port mappings. Address conservation made this design ubiquitous on IPv4 access networks.
- 192.168.1.24 laptop
- 192.168.1.31 phone
- 192.168.1.50 TV
NAPT and a firewall are not the same control. A stateful translator normally cannot forward an unsolicited inbound flow unless a static mapping, port forward or existing state tells it where to go, but that behavior is not a substitute for an explicit security policy. State tables and port space are finite as well. Heavy connection churn, large P2P workloads or a fault in the edge device can exhaust translation resources and produce partial connectivity failures.
08 / CGNAT
Why many users can share one public IPv4
CGNAT adds a provider-side translation layer. A home router may translate RFC 1918 addresses to a WAN address in 100.64.0.0/10, and the carrier then translates that shared-space address to a public IPv4. Mobile IPv4 networks commonly use carrier-grade translation, and many fixed-access providers use it where public IPv4 capacity is constrained. It is not universal, and the exact topology differs by operator.
One public IPv4 can now represent many subscribers. Rate limits, reputation and abuse controls keyed only to that address can affect unrelated customers. Geolocation describes the public address or pool visible at the carrier edge, not the handset or household behind it. Reliable subscriber attribution requires the operator’s translation records, including the public address, translated port or port block, protocol, precise timestamp and the corresponding subscriber/session state.
09 / Routing
IP address vs prefix vs route vs ASN
Related tool: IP Lookup — inspect the public IP, covering prefix, origin ASN and routing context for any address.
Keep four terms separate. An IP address is assigned to an interface or service endpoint. A prefix groups a range of addresses, such as 203.0.113.0/24. A route says how to reach a prefix, usually by a next hop or outgoing interface. Routers choose among matching routes with longest-prefix match. Host routes exist too: /32 IPv4 and /128 IPv6 routes are common for loopbacks, services and traffic engineering. Internet-scale routing works because most reachability is aggregated rather than advertised one endpoint at a time.
An ASN identifies an autonomous system participating in interdomain routing; BGP advertisements attach origin and path information to prefixes. Other data lives at different granularities. RPKI authorization is prefix/origin-AS data, reputation may be per address or per range, and geolocation vendors may split a routed prefix into smaller mapped ranges. Two addresses in the same /24 therefore share some routing context without necessarily sharing the same reputation or location record.
10 / DNS
IP addresses vs domain names
DNS is broader than “name to IP,” but A and AAAA records are the part most users notice: they map a hostname to IPv4 or IPv6 addresses. PTR records provide reverse-DNS names for addresses when the address-space operator publishes them. A service can return different addresses by region, resolver location, EDNS Client Subnet policy, load-balancing policy or CDN design; anycast can then steer the same destination address to different physical sites.
Use names for application endpoints when the service publishes a hostname and expects the backing addresses to change. Hard-coding a CDN or SaaS address usually creates a maintenance problem later. Treat PTR data as a hint, not identity. Forward-confirmed reverse DNS checks whether the PTR name resolves back to the address; it is a useful consistency signal, not proof of who operates the host.
11 / Location
What an IP address reveals about location
An IP address carries no latitude, longitude or city. Geolocation providers attach location estimates to addresses or prefixes using external data such as registration records, BGP/ASN context, operator geofeeds, measurements, infrastructure naming, historical observations and proprietary datasets. The lookup itself does not read device GPS. Mobile, CGNAT, VPN and proxy paths matter because the visible public edge can sit far from the user.
The IP Geolocation pillar covers the full mechanism, vendor disagreement, RFC 8805 geofeeds and accuracy radius. If the concern is specifically a wrong city or region, Why Is My IP Address Showing the Wrong Location? walks through that diagnosis. For this guide, one rule is enough: treat location as a derived property of the visible address or prefix, never as a coordinate encoded in the packet.
12 / Privacy
What an IP address can and cannot reveal
A remote service learns the source address presented to it, the network or ASN behind that address, and whatever approximate geolocation or reputation data its providers attach to it. The address also works as a correlation signal while it remains stable, although NAT, CGNAT, reassignment and shared networks weaken any assumption that one address equals one person.
A public IP lookup does not reveal a name or home address. Linking a subscriber to an address at a specific time depends on records held by the access provider; under CGNAT, the public address alone is not enough. Access to those records follows the law and process of the relevant jurisdiction. IPv6 temporary addresses reduce tracking based on a stable interface identifier, but the delegated network prefix can remain stable, so they do not erase all IP-based correlation.
13 / Security
Does exposing your IP create a security risk?
An Internet-facing IP address is visible by design. Remote servers need a return path, and public IPv4 services are routinely discovered by automated scanning. Treat an exposed service as discoverable whether or not anyone has personally “found your IP.” The useful security question is what the address accepts: open services, management interfaces, weak authentication, outdated software and unnecessary port forwards.
A stateful firewall or NATed edge with no permitted inbound service presents far less attack surface than an address exposing RDP, SSH, a camera, a NAS or a game server. Targeted denial-of-service is a separate risk because an attacker can send traffic at the connection itself; VPNs, reverse proxies, CDNs and provider filtering can change or shield the visible origin in some designs. Protect the services and the edge policy. Keeping the numeric address secret is not a security strategy.
14 / Troubleshooting
How to inspect your own IP correctly
A short self-audit separates local addressing, upstream translation and the public address.
# 1. inspect local interfaces Linux: ip addr macOS: ifconfig Windows: ipconfig /all # 2. inspect the router / CPE WAN address # 100.64.0.0/10 + a different external public IPv4 -> strong CGNAT indicator # 3. check the address the Internet actually sees # use a public IP lookup for the browser-visible public IPv4 / IPv6 and network context # use a VPN / WebRTC leak test when the question is browser or tunnel leakage
Read the differences. A private IPv4 on the host and a public IPv4 on the Internet side means NAPT exists somewhere in the path, which is normal on most home IPv4 networks. A router WAN address in 100.64.0.0/10 plus a different external public IPv4 strongly points to CGNAT. A router WAN address in RFC 1918 space only proves another private/NAT layer upstream; double NAT can look the same. Working IPv4 and IPv6 from the same client indicates dual-stack reachability at that test point. An unexpected public ASN is a good reason to check for a VPN, proxy or corporate tunnel.
Test it: IP Lookup for the public IPv4 / IPv6 and network context, VPN Leak Test for tunnel leakage, or the WebRTC leak guide when the question is browser-level exposure.
Start with the network facts
Look up the public address, origin ASN, routing and geolocation estimate as separate layers before drawing a conclusion.
Open IP Lookup15 / Workflow
How a network engineer reads an IP address
When an unfamiliar address appears in logs, start with the cheap classification steps. First decide whether it is public, private, shared, link-local, loopback or documentation space. Then find the covering prefix and origin AS and classify the network: residential access, mobile, hosting, enterprise, CDN or something else. Only after that should enrichment carry weight: forward-confirmed rDNS, geolocation with its radius, RPKI state, reputation and the age of those records.
That sequence prevents the common category error of treating an address as a person. An IP address is one piece of network state inside a routing context. The IP Lookup tool takes the same workflow deeper into RDAP, BGP, RPKI and provider metadata.
16 / FAQ
Common questions
Is my IP address unique to me?
No. A public IPv4 address can represent several devices behind home NAPT and many subscribers behind CGNAT, and the ISP can reassign it later. IPv6 commonly gives interfaces separate global addresses, but those addresses still belong to a delegated network prefix, and temporary addresses do not make that prefix disappear. Anycast is another deliberate exception to the "one address, one machine" model: the same service address can be announced from multiple sites.
Does my IP change when I use a VPN?
The address assigned on your access connection does not change when a VPN starts. Remote sites see the VPN exit address because the tunnel carries your traffic to that exit first. Your ISP still sees your access connection and the VPN endpoint you communicate with, while the destination sees the VPN provider’s public source address.
Why is my IP different on my phone and my laptop at home?
On the home LAN, the phone and laptop use different local addresses. If both send IPv4 through the same home NAPT, remote sites normally see the same public IPv4. With IPv6 they usually use different global addresses from the same delegated prefix. Switch the phone to mobile data and both the routing path and the visible public address context change.
Can two devices have the same IP address?
Two ordinary hosts should not use the same unicast address on the same Layer-2 segment; ARP or Neighbor Discovery conflicts follow. The same private address can exist on countless separate networks because those routing contexts never meet. Controlled exceptions exist too: anycast and first-hop redundancy protocols deliberately let multiple nodes participate in delivery for a shared service or virtual address.
What’s the difference between an IP address and a MAC address?
A MAC address is a link-layer identifier used on the local segment. It is not necessarily a permanent hardware serial number, since virtualization and MAC randomization are common. Across a routed hop, the Ethernet source and destination MAC addresses are replaced for the next link. The IP packet keeps its Layer-3 source and destination addresses end to end unless a NAT, proxy or tunnel changes them.
Is IPv6 replacing IPv4?
IPv6 deployment keeps growing, but IPv4 is not disappearing on a fixed deadline. Networks use several coexistence models: dual-stack, IPv6-only access with translation to IPv4, and provider mechanisms that carry one family across the other. For application and network design, plan for both address families and test the actual path instead of assuming the access network uses one transition model.
17 / References
Technical references
- RFC 791
- Internet Protocol (IPv4)
- RFC 8200
- Internet Protocol, Version 6