What Is an IP Address? IPv4 vs IPv6 Explained

An IP address is the number the internet uses to decide where a packet should go. Every device that speaks to another over the network has one, and every request that arrives at this site carries one. It is a routing locator rather than a name: it says where something is attached to the network at this moment, not who is behind it — a distinction that matters a great deal once you start using addresses to make security decisions.

There are two versions in service at the same time, IPv4 and IPv6, and most connections today can use either. Below is how to read both, which ranges never appear on the public internet, how addresses are handed out, and what a single address can honestly tell you.

How to read an IPv4 address

An IPv4 address is 32 bits, written as four decimal numbers from 0 to 255 separated by dots — the dotted quad:

Thirty-two bits allow exactly 4,294,967,296 combinations, and a good part of that space is reserved for purposes that never appear on the public internet. Addresses are not allocated one at a time but in blocks, written in CIDR notation: 192.0.2.0/24 means the first 24 bits are fixed and the remaining 8 identify hosts, so the block holds 256 addresses. The smaller the number after the slash, the larger the block — a /16 is 65,536 addresses, a /8 is more than 16 million.

That notation is worth getting comfortable with, because abuse data is usually discussed in blocks. When a provider leaks spam from a dozen addresses, the question is almost always whether the whole /24 is bad or only a handful of hosts inside it.

How to read an IPv6 address

An IPv6 address is 128 bits, written as eight groups of four hexadecimal digits separated by colons:

Nobody writes them out in full. Two rules shorten them: leading zeros in a group are dropped, and one run of all-zero groups is replaced by a double colon. The address above becomes:

The double colon may appear only once, otherwise the length of the gap would be ambiguous. Home and office networks are normally handed a /64 or larger — a single /64 already contains more addresses than the whole of IPv4, which is why IPv6 subnets are sized for convenience rather than scarcity.

Why the internet runs two versions at once

IPv4 did not run out suddenly. The central pool held by IANA was distributed to the five regional registries, and each then worked through its own stock at its own pace:

Three things kept IPv4 working anyway. Addresses became tradeable, so blocks move between organisations on a transfer market. Providers put large numbers of customers behind carrier-grade NAT, sharing one public address among many subscribers. And new growth — mobile networks above all — moved to IPv6, where there is no shortage to manage.

The practical consequence for anyone reading logs is that an IPv4 address today is a far weaker identifier than it was fifteen years ago. One address can stand for one server, or for an entire apartment block's worth of mobile subscribers.

Public, private, and the ranges in between

Several ranges are reserved and will never reach you from the public internet. If you see one in a log as a remote address, something is either misconfigured or forged:

This is also why the address shown by ip addr on your laptop is almost never the address a server sees. Your interface holds a private address; your router rewrites the source of every outgoing packet to its own public address. The quickest way to see the difference is to ask a server what it sees:

The terminal lookup guide covers that endpoint and its JSON, country and ASN variants in detail.

Static, dynamic, and the address you share with strangers

A static address is configured once and stays put. Servers use them, because a name that resolves to a moving target is no use to anybody. A dynamic address is leased from the provider's DHCP pool for a period, and when that lease expires — or the router reboots — a different address may be assigned. Most home connections work this way.

IPv6 adds a second kind of movement. A device can build its own address from the network's prefix (SLAAC), and privacy extensions make it generate fresh temporary addresses for outgoing connections on a regular schedule. A single machine can hold several IPv6 addresses at once: a stable one for inbound services and a rotating one for everything it initiates.

For abuse handling, the combination of dynamic allocation and CGNAT is the important part. An address that attacked you yesterday can belong to an entirely innocent customer today, and an address behind carrier-grade NAT may represent hundreds of subscribers who share it. It is the reason good blocklists age their entries out instead of keeping them forever, and the reason a report is far more useful when it carries a timestamp. The reputation score article explains how recency is weighted.

Who an address belongs to

Allocation runs in a chain. IANA delegates large blocks to the five regional registries; each registry allocates smaller blocks to local registries and operators in its region; those operators assign addresses to their own customers. Each step is recorded, and the records are public.

Two protocols read those records: the older WHOIS and its structured successor RDAP. Either will tell you the organisation holding the block, the exact range, the country on file and — the field that matters most in practice — the abuse contact address. Networks are also grouped into autonomous systems, each with an AS number, which is what routing actually works with. The WHOIS and RDAP guide walks through reading one of these records field by field.

What none of this gives you is a subscriber. The operator knows which customer held an address at a given moment; the public record stops at the operator.

What an IP address does not tell you

Three limits are worth stating plainly, because a lot of bad security decisions come from ignoring them.

It is not a precise location. Geolocation databases map addresses to places by inference, not measurement. The country is usually right; the city is frequently wrong, and for mobile and satellite networks it can be wrong by hundreds of kilometres. How accurate is IP geolocation goes through why.

It is not a person. Shared addresses, NAT, public Wi-Fi and corporate egress all mean many people behind one address. Treating an address as an identity produces both false accusations and false confidence.

It is not necessarily the user's own address. VPNs, proxies, Tor exits and compromised hosts all relay traffic on someone else's behalf. Whether an address belongs to infrastructure rather than an end user is itself a useful signal — see detecting VPN, proxy and Tor addresses.

Looking an address up

What a single address is worth checking for depends on the question you are asking. To find out who holds it and where to send a complaint, read its registry record. To decide whether to let it through, look at what it has been doing: appearances on open threat lists, DNSBL listings, and reports from other operators, weighted by how recent they are.

An IP-DB profile puts both in one page — the registry data, the abuse contact, the listings and the score behind them. There is also a bulk check for a list of addresses at once, an API for automation, a subnet calculator for working with CIDR blocks, and your own address with everything we can see about it.

Frequently asked questions

Why does my IP address keep changing?

On most home connections the address is leased from the provider's DHCP pool; when the lease expires or the router restarts, a different address from that pool can be handed out. IPv6 adds privacy extensions on top: your device regularly generates a fresh temporary address for outgoing connections. A fixed address is something you order separately from the provider, usually on a business plan.

Why is my local IP different from the one the internet sees?

ip addr or ipconfig shows the address assigned to your interface, usually from a private range such as 192.168.x.x. That address only means something inside your own network; on the way out, NAT rewrites the packet's source to your router's public address. That is what servers see, which is why curl ip-db.com/me disagrees with what your interface reports.

Does an IP address tell you who owns it?

It tells you which organisation it was allocated to, not who is using it right now. An RDAP or WHOIS query returns the operator that holds the network, the allocated range, and the abuse contact. Who sits behind it as a subscriber is known only to that operator, and is not handed out without legal process.

Have IPv4 addresses really run out?

The central pool has: IANA handed its last blocks to the regional registries in 2011, and the RIPE NCC gave out its final /22s in 2019. The internet still works because addresses now change hands on a transfer market, providers share one address among hundreds of customers with CGNAT, and new growth runs over IPv6.

Should I hide my IPv6 address?

Under IPv6 each device usually has a public address, so the incidental anonymity NAT provided disappears. Modern operating systems offset that with privacy extensions: outgoing connections use a temporary address that rotates. The real protection was never hiding the address anyway — it is a firewall that refuses inbound connections.

How do I tell whether an IP address is safe?

The address itself is neither safe nor dangerous; what counts is the history of the traffic coming from it. Checking it against open threat lists, DNSBL records and community reports shows whether attacks came from there recently. That is exactly what IP-DB profiles pull together.

Further reading: why an address ends up on a blocklist and how to get it removed is covered in the delisting guide, and reporting abuse in how to report an abusive IP.