How IP addresses work

Every device that sends or receives data on the internet needs an IP address. The Internet Protocol (IP) moves data in self-contained packets, and every packet carries two addresses: where it comes from and where it should go. Routers along the way read the destination address and pass the packet one step closer, until it arrives.

The specification of the original Internet Protocol, RFC 791 from 1981, puts the idea in three short sentences: “A name indicates what we seek. An address indicates where it is. A route indicates how to get there.” This article is about the middle one: what an address is, how it is written and divided, and how it lets a packet find its way. Names are the subject of How DNS works.

IP itself makes no promises. It delivers each packet on its own, on a best effort basis: packets can be lost, duplicated or arrive out of order, and IP does not notice. Protocols on top of it, such as TCP, add reliability where an application needs it. Two versions of IP are in use today: IPv4, the original, and IPv6, its successor with a much larger address space. Most devices speak both.

What an address identifies

An IP address belongs to a network interface, not to a device. A laptop connected by both Wi-Fi and a cable has two interfaces and can have an address on each. A router, whose job is to connect networks, has at least one interface and one address in every network it connects.

Every address has two parts. The first part, the network prefix, identifies the network the interface is attached to. The rest, the host part, identifies the interface within that network. All interfaces on the same network share the same prefix. This split is what makes routing on a global scale possible: a router does not need to know every address in the world, only which direction leads to each network prefix.

IPv4 addresses

An IPv4 address is a 32-bit number. That allows 2³², or 4,294,967,296, different values, which seemed generous in 1981 and turned out to be far too few once the internet reached billions of devices.

Dotted-decimal notation

Thirty-two bits are hard to read, so IPv4 addresses are written as four bytes (also called octets), each as a decimal number from 0 to 255, separated by dots: 192.0.2.10. Each number stands for exactly eight bits of the address.

The binary form shows what a computer actually compares. 192 is 11000000, 0 is 00000000, 2 is 00000010 and 10 is 00001010, so the whole address is 11000000 00000000 00000010 00001010.

Prefixes and CIDR notation

Where the network prefix ends is not fixed. It is given by the prefix length, written after a slash: in 192.0.2.10/24, the first 24 bits are the prefix and the remaining 8 bits are the host part. A network is written with its host bits set to zero, as in 192.0.2.0/24, which covers the 256 addresses from 192.0.2.0 to 192.0.2.255.

The same information can be written as a subnet mask: 32 bits with a one for every prefix bit and a zero for every host bit. A /24 prefix is the mask 255.255.255.0; a /20 prefix is 255.255.240.0. Masks are still common in configuration screens, but the slash notation is shorter and says the same thing.

This flexible scheme is called Classless Inter-Domain Routing (CIDR). It replaced the original design, in which the first bits of an address decided its class and with it a fixed prefix length of 8, 16 or 24 bits. Classes wasted addresses (an organization that needed 300 addresses had to receive a block of 65,536) and made routing tables grow quickly. CIDR was introduced in 1993 and is specified today in RFC 4632. The old class names survive only as shorthand: people still say “a class C” when they mean a /24.

In an ordinary IPv4 network, two addresses are set aside. The first, with all host bits zero, names the network itself. The last, with all host bits one, is the network’s broadcast address: a packet sent there reaches every interface on the network. A /24 therefore has 254 addresses for devices, not 256. The exceptions are /31 networks for links between exactly two routers, where RFC 3021 allows both addresses to be used, and /32, which describes a single address.

Working out a network by hand

Because every prefix boundary is a bit position, network calculations are binary operations. To check whether 192.0.2.77 belongs to the network 192.0.2.64/26:

1. A /26 prefix leaves 6 host bits, so each network of this size holds 2⁶ = 64 addresses. In the last byte, the networks start at 0, 64, 128 and 192.
2. 77 lies between 64 and 127, so the address is in 192.0.2.64/26. In binary, the last byte 01001101 keeps its first two bits, 01, which is the network starting at 64.
3. The network spans 192.0.2.64 to 192.0.2.127. The first address names the network, the last is the broadcast address, and 192.0.2.65 to 192.0.2.126 are left for devices: 62 addresses.

The same steps work for any prefix: find the block size from the number of host bits, then find the block the address falls into.

Special address ranges

Some ranges have a fixed meaning and never appear as ordinary public addresses. The Internet Assigned Numbers Authority (IANA) keeps the official list, defined by RFC 6890.

A home network almost always uses one of the private ranges, most often a network such as 192.168.1.0/24. Millions of homes use exactly the same addresses, which works because none of them is visible on the internet. That is where NAT comes in.

NAT: sharing one public address

IANA, which hands out IPv4 address blocks to the five Regional Internet Registries (AFRINIC, APNIC, ARIN, LACNIC and the RIPE NCC), gave out its last free blocks in February 2011. Long before that, the shortage had led to a workaround that is now everywhere: Network Address Translation (NAT), described in RFC 3022.

A home router typically has one public IPv4 address from the internet provider and gives private addresses to the devices at home. When a device opens a connection to the internet, the router replaces the private source address in each outgoing packet with its own public address. To tell the connections apart, it usually changes the source port as well and records the mapping in a table. Replies arrive at the public address and port, and the router uses the table to send them back to the right device, restoring its private address.

NAT saves addresses, but it has costs. A device behind NAT cannot be reached from outside unless the router is configured to forward a port to it, because an incoming packet that matches no table entry has nowhere to go. Applications such as video calls and online games need extra techniques to connect two devices that are both behind NAT. Many internet providers now add a second layer of translation in their own network, called carrier-grade NAT, which uses the 100.64.0.0/10 range. IPv6 removes the shortage that made all of this necessary. How NAT behaves and how devices still connect through it is explained in how NAT works.

Inside an IPv4 packet

Every IPv4 packet begins with a header that carries the addresses and the information routers need to forward it. Without options, the header is 20 bytes long.

The fields worth knowing:

• Version is 4. IHL (Internet Header Length) gives the header length in 32-bit words: 5 for the usual 20 bytes, up to 15 for 60 bytes with options.
• DSCP and ECN mark a packet’s priority class (RFC 2474) and let routers signal congestion without dropping packets (RFC 3168). Together they replaced the original type of service byte.
• Total length is the size of the whole packet, header included, in bytes. Sixteen bits allow up to 65,535 bytes, although networks usually carry far smaller packets.
• Identification, flags and fragment offset handle fragmentation. When a packet is too large for the next link, an IPv4 router may split it into fragments, which the destination puts back together. A sender can forbid this with the Don’t Fragment flag.
• Time to live (TTL) limits how long a packet can circulate. Every router decreases it by one, and a router that brings it to zero discards the packet. This stops packets from looping forever when routes are misconfigured. The recommended starting value is 64.
• Protocol names what the packet carries: 6 for TCP, 17 for UDP, 1 for ICMP.
• Header checksum detects damage to the header. Because every router changes the TTL, every router also recomputes the checksum.
• Source address and destination address stay the same from end to end, unless NAT rewrites them on the way.

IPv6

IPv6 was designed in the 1990s as the long-term answer to address exhaustion. It was first specified in RFC 1883 in 1995; the current specification is RFC 8200 from 2017. Its addresses are 128 bits long, which allows 2¹²⁸ values: about 3.4 × 10³⁸, or roughly 340 trillion trillion trillion. The point of that size is not to number every grain of sand. It is to make addresses so plentiful that networks can be planned for simplicity rather than thrift: every network gets more addresses than it can ever use, and NAT is no longer needed.

Writing IPv6 addresses

An IPv6 address is written as eight groups of four hexadecimal digits, separated by colons. Each group stands for 16 bits. Two rules shorten the result:

1. Leading zeros in a group can be dropped: 0db8 becomes db8 and 0012 becomes 12.
2. One run of consecutive all-zero groups can be replaced by ::. It can be used only once in an address, or the reader could not tell how many groups each :: stands for.

Since the same address can be written in several ways, RFC 5952 recommends one canonical form: lowercase letters, no leading zeros, and :: for the longest run of zero groups (the first one if there is a tie), but not for a single zero group. Following it makes addresses easy to search for and compare in logs.

Prefix notation works as in IPv4: 2001:db8:abcd:12::/64 is the network made of all addresses whose first 64 bits are 2001:db8:abcd:12. The range 2001:db8::/32, used in these examples, is reserved for documentation (RFC 3849).

The structure of an address

The common layout of an IPv6 address on a network splits it in half. The first 64 bits are the network prefix, and the last 64 bits are the interface identifier, which identifies the device within the network. The network prefix is usually divided further: an internet provider assigns a site a routing prefix, commonly a /48 or a /56 (RFC 6177), and the site numbers its own networks with the bits in between. A /48 leaves 16 bits for this subnet ID, enough for 65,536 networks, each a /64.

A /64 network holds 2⁶⁴ addresses, about 18 billion billion. Nobody fills it. The size exists so that devices can choose their own interface identifiers without coordinating, as the next section shows.

Kinds of IPv6 addresses

Unlike IPv4, IPv6 expects an interface to have several addresses at once, each with a different reach.

How a device gets an IPv6 address

The usual method is Stateless Address Autoconfiguration (SLAAC), defined in RFC 4862. Routers regularly announce the network prefix in router advertisements, and each device combines that prefix with an interface identifier it creates itself. A quick check that nobody else uses the same address, called duplicate address detection, completes the process. No server has to keep track of who has which address.

Early implementations derived the interface identifier from the network card’s hardware (MAC) address. That made a device recognizable wherever it went, because the second half of its address never changed. Modern systems instead create identifiers that look random (RFC 8064) and, for outgoing connections, add short-lived temporary addresses that change regularly (RFC 8981). Networks that need central control can use DHCPv6 instead, the IPv6 counterpart of the DHCP service that hands out addresses in IPv4 networks.

IPv4 devices usually get their address from a DHCP server (RFC 2131), often built into the home router: the device broadcasts a request, a server offers an address, the device requests it, and the server confirms the lease for a limited time. Both processes are explained step by step in how a device joins a network.

The IPv6 header

The IPv6 header is twice the size of a basic IPv4 header, 40 bytes, but simpler: it has a fixed length and only eight fields.

Several IPv4 features are gone or moved:

• No header checksum. Link layers and transport protocols already check for errors, so routers no longer recompute a checksum at every hop. In exchange, the UDP checksum, optional in IPv4, is mandatory in IPv6.
• No fragmentation by routers. A router that receives a packet too large for the next link drops it and reports the size it can carry, and the sender adjusts. Only the original sender may split a packet. Every IPv6 link must carry packets of at least 1,280 bytes.
• Options move to extension headers. The next header field says what follows the main header: either the payload, such as TCP (6) or UDP (17), or an optional extension header that in turn names the one after it.
• Hop limit is the new name for TTL, which describes what it really counts.
• The flow label lets a sender mark packets that belong to the same flow, so that routers that spread traffic over several paths can keep them on the same one (RFC 6437).

How a packet reaches its destination

Addresses become useful through routing: the decisions that carry a packet from its source to its destination, one network at a time.

Near or far

Before sending a packet, a device compares the destination with its own network prefix:

• Same network: the destination is directly reachable on the local link. The device only needs the destination’s link-layer (MAC) address, which it learns with the Address Resolution Protocol (ARP, RFC 826) in IPv4 or with Neighbor Discovery (RFC 4861) in IPv6. In both, the device asks the local network, in effect, “who has this IP address?”, and the owner answers with its MAC address.
• Another network: the device sends the packet to its default gateway, the router of its network, and lets the router decide where it goes next.

Hop by hop

Each router repeats the same small decision. It looks up the destination address in its forwarding table, picks the next router (or the final network), decreases the TTL or hop limit, and sends the packet on. No router knows the whole path; each one knows only the next step.

The diagram shows an important separation of duties. The IP header carries the end-to-end addresses, which do not change along the way (as long as no NAT is involved). For each link, the packet is wrapped in a link-layer frame, such as an Ethernet or Wi-Fi frame, addressed from the current device to the next one. Every router removes the old frame and wraps the packet in a new one for the next link.

The longest prefix wins

A router’s forwarding table lists prefixes and where to send packets for each. An address often matches several entries, and the rule is simple: the most specific route, the one with the longest matching prefix, wins.

A packet for 198.51.100.200 goes to router D. The entry 0.0.0.0/0 matches every address and serves as the default route: where packets go when nothing more specific is known. Between networks on the internet, routers learn these prefixes from each other through the Border Gateway Protocol (BGP), which is a topic of its own.

When something goes wrong: ICMP

IP reports problems with the Internet Control Message Protocol (ICMP, RFC 792; ICMPv6 for IPv6). A router that drops a packet because its TTL reached zero sends back a time exceeded message; a router that cannot reach a network sends destination unreachable. Two everyday tools are built on ICMP:

• ping sends an echo request and waits for the echo reply, which shows whether a device is reachable and how long the round trip takes.
• traceroute (tracert on Windows) sends packets whose TTL is first 1, then 2, then 3, and so on. Each router that brings a packet’s TTL to zero reports itself with a time exceeded message, so the replies reveal the routers along the path, one per step.

IPv4 and IPv6 side by side

Most operating systems run both protocols at once, which is called dual stack. When a name has both an IPv4 and an IPv6 address, the system’s default rules (RFC 6724) generally prefer IPv6. To avoid long waits when IPv6 is broken somewhere along the path, applications use Happy Eyeballs (RFC 8305): they try IPv6 first and, if it has not connected after a short delay (250 milliseconds is the recommended value), start an IPv4 attempt in parallel and use whichever connects first.

Key points

• An IP address identifies a network interface. Its prefix names the network; the rest names the interface within it.
• IPv4 addresses are 32 bits, written as four decimal bytes. IPv6 addresses are 128 bits, written as eight groups of hexadecimal digits, with :: for one run of zeros.
• CIDR prefixes such as /24 or /64 say where the network part ends. Routers forward each packet along the longest matching prefix.
• Private ranges and NAT stretched IPv4’s limited supply. IPv6 makes addresses plentiful enough that every device can have its own.
• IP addresses stay the same from end to end, while link-layer addresses change on every hop. The TTL or hop limit keeps lost packets from circling forever.