IP address

An IPv4 address (RFC 791, 1981) is 32 bits, written as four decimal octets such as 192.0.2.10. Every address is split into a network prefix and a host part. The original classful scheme (classes A, B and C) wasted space and was replaced in 1993 by Classless Inter-Domain Routing (CIDR, now RFC 4632), where the prefix length is written explicitly: 192.0.2.0/24 covers 256 addresses, and routers forward by longest prefix match. Several blocks are reserved: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private networks (RFC 1918), 127.0.0.0/8 for loopback, 169.254.0.0/16 for link-local autoconfiguration, 100.64.0.0/10 for carrier-grade NAT (RFC 6598) and 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 for documentation (RFC 5737).

With only about 4.3 billion possible addresses, IPv4 ran out: IANA allocated its last free blocks to the regional registries in February 2011, and RIPE NCC made its final IPv4 allocations in November 2019. Network address and port translation (NAT/NAPT) keeps IPv4 working by letting many devices share one public address, with the router rewriting source ports. That is also why an address plus a timestamp often cannot identify a subscriber behind carrier-grade NAT unless the source port was logged as well.

IPv6 (RFC 8200) uses 128-bit addresses written as eight groups of hexadecimal digits, with runs of zeros compressed as :: (canonical form in RFC 5952), for example 2001:db8::1 from the documentation prefix 2001:db8::/32. A subnet is normally a /64, and hosts often configure themselves via SLAAC (RFC 4862), typically with temporary privacy addresses that change over time (RFC 8981). Every IPv6 interface also has a link-local fe80::/10 address and usually several global ones. A common blind spot is that operating systems enable IPv6 by default, so networks that filter and monitor only IPv4 may have unmanaged IPv6 paths, and rogue router advertisements can redirect traffic unless mitigated with RA Guard (RFC 6105).

Addresses are assigned statically, by DHCP (RFC 2131) or DHCPv6, and mapped to link-layer MAC addresses by ARP (RFC 826) in IPv4 and Neighbor Discovery in IPv6. As evidence of identity an address is weak: source addresses can be spoofed in one-way traffic such as UDP floods, although a completed TCP handshake shows that the sender could at least receive packets sent to that address. Attackers routinely use VPNs, cloud hosts and residential proxy networks, so blocklisting single addresses has limited effect, and geolocation databases are approximate. Legally, the Court of Justice of the EU held in Breyer (C-582/14, 2016) that a dynamic IP address can be personal data for a website operator that has legal means to identify the user, so IP logs fall under the GDPR.