How IPv4 addresses work

Every IPv4 header carries two addresses, source and destination, each one 32-bit number written as four decimal octets, with a prefix length that splits it into network and host. After reading, you can convert an address to binary and to an integer by hand, apply a mask the way a host does to decide whether a destination is on its link, recognise the special-purpose blocks and their rules, and say who hands addresses out and when the free pool ran out.

View as Markdown

An IPv4 address is one 32-bit number, and every IPv4 header carries two, the Source Address and the Destination Address, as (RFC) 791 defines them (RFC 791, sections 2.3 and 3.1). Dots, classes and the slash of Classless Inter-domain Routing () are ways of reading that number, met in every interface, route and log. By the end you can convert an address to binary and to an integer, apply a mask as a host does, read the special-purpose blocks of the Internet Assigned Numbers Authority (), follow addresses through the Regional Internet Registries (RIRs), date the end of the free pool and see it all on a host.

Thirty-two bits, written as four numbers

RFC 791 is plain: "Addresses are fixed length of four octets (32 bits)" (RFC 791, section 2.3). Bit 0, the leftmost, is the most significant, and the most significant octet is sent first (appendix B). Dotted decimal writes each octet, one byte, as a number from 0 to 255, with dots between (RFC 3986, section 3.2.2), and the address is the integer the four bytes make:

192.0.2.10 = 11000000.00000000.00000010.00001010
           = 192*2^24 + 0*2^16 + 2*2^8 + 10
           = 3221225472 + 0 + 512 + 10
           = 3221225994 = 0xc000020a

A capture shows the same bytes in hexadecimal. The space holds 2³² = 4,294,967,296 addresses (RFC 4632, section 3.1); the examples use the documentation blocks 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737, section 3).

Network part, host part, and the mask

CIDR writes the split after a slash: the address, then "a decimal value between 0 and 32 that describes the number of significant bits" (RFC 4632, section 3.1). Those bits are the network prefix, "a contiguous set of bits at the more significant end of the address that defines a set of systems; host numbers select among those systems" (RFC 1812, section 2.2.5.2). A host uses the mask for one decision, which RFC 1122 makes mandatory: "If the IP destination address bits extracted by the address mask match the IP source address bits extracted by the same mask, then the destination is on the corresponding connected network, and the datagram is to be transmitted directly to the destination host." Otherwise, "If not, then the destination is accessible only through a gateway" (RFC 1122, section 3.3.1.1). Masking is a binary AND (Python 3.14 documentation, ipaddress), worked here for a host at 198.51.100.77/26:

address  198.51.100.77    11000110.00110011.01100100.01001101
mask     255.255.255.192  11111111.11111111.11111111.11000000   /26, host mask 0.0.0.63
AND      198.51.100.64    11000110.00110011.01100100.01000000   network address
host bits all ones        198.51.100.127                        broadcast address
2^6 = 64 addresses, 62 usable hosts: 198.51.100.65 to 198.51.100.126

to 198.51.100.100   01100100 AND 11000000 = 01000000 = 64    same network: send directly
to 198.51.100.130   10000010 AND 11000000 = 10000000 = 128   other network: use the gateway

Off-link traffic goes to the default gateway; CIDR notation explained and Subnetting basics build on this.

Classes, and why they ended

Before CIDR, the leading bits fixed the split; RFC 791 defined three classes in September 1981: "in class a, the high order bit is zero", class b starts with 10 and class c with 110 (RFC 791, section 2.3). RFC 1112 gave 1110 to class D, the multicast groups from 224.0.0.0 to 239.255.255.255, and reserved 1111 as class E (RFC 1112, section 4); class D lives on as multicast. Sizes follow RFC 4632, whose class A pattern erratum 3485 corrects to one leading 0 (RFC 4632, section 2; RFC 4632 errata):

leading bits  first octet  class  size
0             0 to 127     A      128 networks, 16,777,216 end systems each
10            128 to 191   B      16,384 networks, 65,536 end systems each (less reserved values)
110           192 to 223   C      2,097,152 networks, 254 end systems each
1110          224 to 239   D      multicast host groups
1111          240 to 255   E      reserved

In January 1992 an Internet Engineering Task Force () group named three problems: class B space running out, since no class suited a mid-sized organisation; routing tables outgrowing routers; and the 32-bit space heading for exhaustion (RFC 4632, section 2). CIDR, specified in RFC 1519 in September 1993 (RFC 1519, section 1), replaced the classes with prefixes of any power-of-two size (RFC 4632, sections 3 and 3.1), and now "they are used as generalized unicast network prefixes with only historical interest in their class" (RFC 1812, section 4.2.2.11).

Addresses with fixed meanings

RFC 1122 writes addresses as network and host fields, -1 meaning all ones (RFC 1122, section 3.2.1.3):

{ 0, 0 }, 0.0.0.0, is this host on this network, and it "MUST NOT be sent, except as a source address as part of an initialization procedure by which the host learns its own IP address."
{ -1, -1 }, 255.255.255.255, is the limited broadcast: never a source, never forwarded off the link.
{ network, -1 } is the directed broadcast to a network, never a source either.
{ 127, <any> }, all of 127.0.0.0/8, is loopback: "Addresses of this form MUST NOT appear outside a host."

All-zeros and all-ones host fields are therefore taken, so a /24 has 254 hosts (RFC 1812, section 4.2.2.11), except that "In a point-to-point link with a 31-bit subnet mask, the two addresses above MUST be interpreted as host addresses" (RFC 3021, section 2.1).

IANA's registry records every special-purpose block (RFC 6890, section 1) in yes-or-no columns (source, destination, forwardable, globally reachable, reserved by protocol) and warns: "Address prefixes listed in the Special-Purpose Address Registry are not guaranteed routability in any particular local or global context" (IANA, IPv4 Special-Purpose Address Space). The main rows:

Block	Registry name	Defined in
0.0.0.0/8	This network	RFC 791
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16	Private-Use	RFC 1918
100.64.0.0/10	Shared Address Space	RFC 6598
127.0.0.0/8	Loopback	RFC 1122
169.254.0.0/16	Link Local	RFC 3927
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24	TEST--1 to TEST-NET-3	RFC 5737
240.0.0.0/4	Reserved	RFC 1112
255.255.255.255/32	Limited Broadcast	RFC 919

Between enterprises, "packets with private source or destination addresses should not be forwarded across such links" (RFC 1918, section 3), and a link-local packet "MUST NOT be sent to any router for forwarding" (RFC 3927, section 2.7). Private IPv4 address space and RFC 1918 and Private, Reserved, and Public IP Ranges go deeper.

Who hands addresses out

At the root, "The Internet Assigned Numbers Authority (IANA) is a role, not an organization" (RFC 7020, section 3). IANA allocates to RIRs in /8 blocks of 2²⁴ addresses; RIRs allocate or assign smaller blocks to Local Internet Registries (LIRs) or Internet Service Providers (ISPs), allocating meaning space for further delegation and assigning meaning space for a site that numbers its own hosts (RFC 4632, section 3.1). RFC 7020 names five RIRs (section 3); IANA's registry shows their /8s and no unallocated row among its 256 (IANA, IPv4 Address Space):

RIR	Region	/8s from IANA
AFRINIC	Africa	4
APNIC	parts of Asia and the Pacific region	45
ARIN	North America and parts of the Caribbean	36
(Latin American and Caribbean Internet Address Registry)	Latin America and parts of the Caribbean	9
RIPE NCC	Europe, parts of Asia and the Middle East	35

The day the free pool ran out

A global policy ratified on 6 March 2009 (ratification notice) promised each RIR one last /8 once IANA's pool reached a minimum (the policy). On 31 January 2011 IANA allocated 39/8 and 106/8 to APNIC, which triggered it; on 3 February 2011 the last five /8s went out, one per RIR, and IANA had no IPv4 addresses left to allocate (depletion announcement; ARIN, 3 February 2011; IANA, IPv4 Address Space). The RIRs followed:

15 April 2011: APNIC reached its final /8 (APNIC).
14 September 2012: the RIPE NCC began allocating from its last /8 (RIPE NCC).
10 June 2014: LACNIC, down to one /10, considered IPv4 exhausted in its region (exhaustion notice).
24 September 2015: ARIN issued the last addresses in its free pool (ARIN).
25 November 2019: the RIPE NCC announced "The RIPE NCC has run out of IPv4 Addresses" (RIPE NCC).
28 August 2020: LACNIC reported its last block reserved (LACNIC).
AFRINIC: soft-landing phase 2 since 13 January 2020, still current on 18 October 2026 (AFRINIC).

The RIPE NCC adds that neither a transfer market nor wider use of -grade network address translation () solves the shortage (RIPE NCC, 25 November 2019). NAT and CGNAT stretch the space; Understanding IPv6 Addressing and Running IPv6 and IPv4 together cover the way past it.

How addressing goes wrong

A wrong mask feeds the host's test bad input (RFC 1122, section 3.3.1.1):

198.51.100.77/24 to 198.51.100.130   both mask to 198.51.100.0     sent directly, but it is not on the link
198.51.100.77/27 to 198.51.100.100   .64 against .96, no match     a real neighbour is sent via the gateway

Two hosts sharing one address on a link cause problems for one or both, the case conflict detection exists for (RFC 5227, abstract). A 169.254 address is a symptom: link-local addressing serves links without stable, routable addresses (RFC 3927, abstract), so on a managed network the interface was never configured; ipconfig shows whether a value came from the Dynamic Host Configuration Protocol () or from Automatic Private IP Addressing (APIPA) (Microsoft Learn, ipconfig), and the lease lifecycle is next to check.

No header field proves a source address. "A router SHOULD NOT forward, except over a loopback interface, any packet that has a source address on network 127" (RFC 1812, section 5.3.7), and ingress filtering at network edges blunts denial-of-service attacks that spoof sources (RFC 2827, section 6). The Smurf attack joined forged echo requests to directed broadcasts, and the advisory of 5 January 1998 said to disable IP-directed broadcasts on all routers (CA-1998-01). In August 1999 RFC 2644 made blocking the default: "These options MUST default to blocking receipt and blocking forwarding of network-prefix-directed broadcasts" (RFC 2644, section 3).

Addresses also fail as text. 10.0.258, 0xA000102 and 012.0x102 are one address (RFC 6943, section 3.1.1), because inet_aton() accepts decimal, octal and hexadecimal parts (inet(3)) and inet_pton() only dotted decimal (inet_pton(3)). Hence: "literals should be converted to numeric form and filtered based on the numeric value, and not on a prefix or suffix of the string form" (RFC 3986, section 7.4). Python's ipaddress mishandled leading zeros before 3.9.5, which in some situations let attackers bypass address-based access control (CVE-2021-29921); they are now an error (Python 3.14 documentation, ipaddress). Such tricks feed server-side request forgery (), a fetch not checked against its expected destination (CWE-918); see what SSRF is and address obfuscation tricks.

How to see it

On Linux, ip address show lists each interface's addresses with their prefix lengths and scopes, host meaning valid only inside this host; -4 keeps IPv4 and -br prints a table (ip-address(8); ip(8)). Illustrative output:

$ ip -br address show
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.0.2.10/24 2001:db8::10/64
$ ip -4 address show dev lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever

On Windows, ipconfig shows each adapter's addresses, subnet mask and default gateway, and ipconfig /all the full configuration (Microsoft Learn, ipconfig). Python's ipaddress does the same arithmetic, counting both addresses of a /31 as hosts (Python 3.14 documentation, ipaddress); the Python playground runs it in the browser on CPython 3.14.2, after a one-time download you approve, and Python as a calculator goes further. A trimmed session:

>>> import ipaddress
>>> a = ipaddress.IPv4Address('192.0.2.10')
>>> int(a), '{:#b}'.format(a)
(3221225994, '0b11000000000000000000001000001010')
>>> net = ipaddress.IPv4Interface('198.51.100.77/26').network
>>> net, net.broadcast_address, net.num_addresses
(IPv4Network('198.51.100.64/26'), IPv4Address('198.51.100.127'), 64)
>>> list(ipaddress.IPv4Network('203.0.113.200/31').hosts())
[IPv4Address('203.0.113.200'), IPv4Address('203.0.113.201')]
>>> ipaddress.IPv4Address('192.0.2.010')
Traceback (most recent call last):
  ...
ipaddress.AddressValueError: Leading zeros are not permitted in '010' in '192.0.2.010'

On the wire, tcpdump -n -x net 192.0.2.0/24 prints matching packets in hex, with numeric addresses and without the link-level header (tcpdump(1); pcap-filter(7)). The source and destination follow the first 12 header bytes, four bytes each (RFC 791, section 3.1), as decoded below this illustrative dump:

12:00:00.000000 IP 192.0.2.10 > 198.51.100.77: ICMP echo request, id 7, seq 1, length 64
	0x0000:  4500 0054 1c46 4000 4001 31d8 c000 020a
	0x0010:  c633 644d ...

bytes 13 to 16   c0 00 02 0a   192.0.2.10      Source Address
bytes 17 to 20   c6 33 64 4d   198.51.100.77   Destination Address

The CIDR / Subnet Calculator turns A.B.C.D/prefix into the network and broadcast addresses, netmask, wildcard mask, usable range and counts; 198.51.100.77/26 gives the figures above. It does not say whether a block is private or special-use. The SSRF URL classifier classifies the host of a web link, decoding decimal, octal and hexadecimal forms without resolving or sending anything: http://3221225994/ is 192.0.2.10, a documentation range.

What to remember

An IPv4 address is one 32-bit number, written as four decimal octets, most significant first.
A host masks the destination and its own address: equal means send directly, different means use a gateway.
0.0.0.0 is a source only while a host learns its address, 127.0.0.0/8 never leaves the host, 169.254.0.0/16 is never forwarded.
IANA, a role, allocates /8s to five RIRs, which allocate to LIRs and ISPs or assign to end sites.
IANA's free pool ended on 3 February 2011; the RIPE NCC ran out in 2019.
Compare addresses as numbers, never strings, and trust no source address without ingress filtering.

This series, in order

This article opens the series IPv4 addressing and subnetting. With the 32 bits laid out, the series builds the skill in order: the prefix, dividing a network, unequal subnets and a full allocation worked end to end, overlaps and gaps, combining routes back up, then the ranges that are not public, the address translation that made one public address serve thousands, and the arithmetic of that sharing.

CIDR notation explained. What the slash in 192.168.1.0/24 means, and how a prefix length defines a block of addresses.
Subnetting basics. Dividing one network into smaller ones, and why borrowing host bits is the whole trick.
VLSM: splitting a block into unequal subnets. Carving one block into subnets of different sizes without waste, and the largest-first rule.
A VLSM allocation, worked end to end. A full allocation for a realistic network: sizing, sorting, assigning, and accounting for what is left.
Subnet overlaps and gaps. When prefixes overlap or contain one another, why longest-prefix match makes some overlaps deliberate, and finding the gaps.
Route summarization. One route in place of many, the aligned allocation it depends on, and the black hole of summarising space you do not own.
Supernetting and route aggregation. The alignment rule that decides whether two blocks merge, and exact aggregation against a covering supernet.
Private IPv4 address space and RFC 1918. The three RFC 1918 ranges, why they are not routed on the internet, and the other special blocks.
Private, Reserved, and Public IP Ranges. The full map an SSRF filter needs: private, loopback, link-local, carrier-grade , documentation, and public.
NAT Explained: Source, Destination, and Why the Internet Still Works. Source NAT lets thousands of hosts share one address, destination NAT publishes a service: how both rewrite packets in flight.
CGNAT: what breaks when a thousand subscribers share one address. The bridge to IPv6 that became permanent: what CGNAT changes for what customers can run and for who gets blamed.
Port blocks and port sets: the arithmetic of sharing one IPv4 address. How many subscribers fit on one address: port blocks, the deterministic mapping of RFC 7422 and the port sets of RFC 7597, worked number by number.