Every IPv4 packet carries a source address and a destination address. Those two values let an IP network identify where the packet came from and where it should go.

An IPv4 address such as 192.0.2.37 looks like four decimal numbers, but it is one 32-bit value. The bits are structured so that networks can work with groups of addresses rather than maintain an unrelated entry for every endpoint.

That 32-bit size is also IPv4's fundamental constraint. It creates about 4.3 billion possible values, and only part of that space is available for globally reachable unicast addresses. An address space that seemed enormous when IPv4 was designed became scarce as the Internet grew.

This chapter explains how IPv4 addresses are represented, what their different ranges mean, how addresses relate to interfaces, and why IPv4 exhaustion is not equivalent to “all addresses have been used.”

An IPv4 address is a network-layer identifier assigned to an interface. In ordinary unicast communication, it identifies a location to which the IP network can deliver packets.

The word interface matters. A laptop can have one IPv4 address on Wi-Fi, another on Ethernet, and additional addresses on virtual interfaces created by containers or VPN software. A server can hold several addresses on one interface. An address is therefore not a permanent serial number for an entire machine.

An IPv4 address also does not identify an application. Several applications can communicate through the same local address. Other protocol fields distinguish their traffic.

It is useful to think of an IPv4 address as a delivery locator:

The address helps deliver the packet. It does not prove who sent the packet, whether the sender is trustworthy, or whether an application is authorized to access a service.

IPv4 provides exactly 32 bits for an address:

Humans normally write those four octets as decimal numbers separated by dots. Each octet contains eight bits, so its value must be between 0 and 255.

Consider this address:

Its decimal, binary, and hexadecimal forms are:

The complete 32-bit value is:

In a packet capture, the same four address bytes can appear as:

Dotted decimal is only a display format. The network stack stores and processes the bits. It does not transmit dots or the characters 1, 9, and 2.

An octet cannot exceed 255 because eight bits cannot represent a larger unsigned value:

Consequently, 192.0.2.300 is not a valid IPv4 address. It is also safest to write decimal octets without leading zeroes. Historical parsers have interpreted values such as 010 as octal rather than decimal, causing different software to disagree about the intended address.

IPv4 addressing is hierarchical. A group of leading bits identifies an address block, while the remaining bits distinguish addresses within that block.

A prefix length states how many leading bits belong to the block. It appears after a slash:

The /24 means that the first 24 bits identify the containing address block. The final 8 bits select an address within that block.

All addresses from 192.0.2.0 through 192.0.2.255 share those first 24 bits. The block contains 256 total bit patterns:

In a conventional broadcast-capable /24, the value with every remaining bit set to 0—192.0.2.0—is the network address used to represent the block itself. The value with every remaining bit set to 1—192.0.2.255—is its directed broadcast address. The values between them occupy the positions normally assignable as unicast addresses. Because 192.0.2.0/24 is reserved for documentation, these values are illustrative rather than real public assignments.

These roles come from the bits after the prefix, not from a rule that the last decimal octet must be 0 or 255. Some specialized prefix lengths also use different address-assignment rules, so software should derive the result from the complete configuration rather than blindly subtract two addresses from every block.

The same prefix can also be expressed as the subnet mask 255.255.255.0. Prefix notation is usually clearer because /24 directly states the number of fixed leading bits.

The prefix is essential context. The address 10.20.30.40 alone does not reveal which bits a particular network treats as its local prefix. Modern systems do not reliably infer that boundary from the first octet.

Detailed address-block calculations have several edge cases, but one principle is enough here: a longer prefix fixes more bits and describes a smaller block; a shorter prefix fixes fewer bits and describes a larger block.

An IPv4 destination can describe one conventional receiver, every receiver in a local broadcast scope, or a group of interested receivers.

Unicast

Most application traffic uses unicast. A unicast destination represents one addressable interface within the relevant network.

A packet sent from 192.0.2.37 to 198.51.100.20 has one source and one unicast destination:

The network attempts to move the packet toward that destination. IPv4 itself offers best-effort delivery, so the presence of a valid address does not guarantee that the packet will arrive.

Broadcast

An IPv4 broadcast targets all participating interfaces in a local broadcast scope.

The limited broadcast address is:

A host can use it when it needs to reach the local IPv4 network but does not yet have enough configuration to identify a more specific destination. Routers do not forward limited broadcasts, so this address does not mean “every device on the Internet.”

An address block can also have a directed broadcast address in which every bit after the prefix is 1. For 192.0.2.0/24, that value is 192.0.2.255. Forwarding directed broadcasts across routers is commonly disabled because they can be abused to amplify traffic.

It is incorrect to assume that every address ending in .255 is a broadcast or that every address ending in .0 is unusable. Those roles depend on the prefix length. The dotted-decimal ending alone is not enough.

Multicast

Multicast sends one packet to a group rather than one conventional receiver. IPv4 reserves 224.0.0.0/4, covering 224.0.0.0 through 239.255.255.255, for multicast.

Receivers express interest in a multicast group, and the network can deliver group traffic where it is needed. A multicast address is a group identifier, not an address assigned to one ordinary unicast interface.

Broadcast and multicast both support one-to-many delivery, but their scopes and receiver-selection rules differ. Broadcast reaches everyone in its local broadcast scope; multicast targets members of a particular group.

Not every 32-bit value is an ordinary public unicast address. IPv4 reserves blocks for private networks, local communication, multicast, documentation, and protocol behavior.

These ranges explain several values that backend engineers regularly encounter.

The Unspecified Address

0.0.0.0 means that no specific IPv4 address is being identified in the current context. A host that has not obtained an address can use it as a source in limited configuration exchanges.

In a server API, binding to 0.0.0.0 usually means “listen on all local IPv4 interfaces.” It does not assign 0.0.0.0 to the server.

This distinction has security consequences. A development server bound to 127.0.0.1 is available only through the local loopback path. The same server bound to 0.0.0.0 can potentially accept traffic arriving on Ethernet, Wi-Fi, or virtual interfaces, subject to firewall and network policy.

The notation 0.0.0.0/0 has another context-specific meaning: a prefix of zero fixed bits matches every IPv4 destination. The bare address, wildcard bind, and zero-length prefix should not be treated as interchangeable concepts.

Loopback

The entire 127.0.0.0/8 block is reserved for loopback. 127.0.0.1 is the address most commonly used:

Traffic sent to loopback remains inside the local network stack. It is useful for testing a service without exposing it on a physical network.

Loopback is local to the current network environment. A container or virtual machine can have its own loopback interface, so 127.0.0.1 inside that environment refers back to that environment rather than automatically to the physical host.

Link-Local

The block 169.254.0.0/16 is reserved for IPv4 link-local addressing. An operating system may select a link-local address when ordinary address configuration is unavailable.

Link-local traffic is confined to the local link and is not intended for routed communication. Seeing a 169.254.x.x address unexpectedly often means that an interface is physically connected but did not receive its normal IPv4 configuration.

Documentation Addresses

The three documentation blocks exist so examples do not accidentally point at real public systems:

Addresses from these blocks appear throughout technical documentation and packet examples. They should not be assigned to real public services.

The private-use IPv4 ranges are:

Organizations can use these ranges internally without receiving a globally unique allocation. A home network, university, cloud network, and company office can all use 10.0.0.10 at the same time because each use occurs in a separate addressing scope.

Private addresses are not globally routed on the public Internet. A packet with a private destination is meaningful only when the participating network has a local or private path to that destination.

Address reuse is powerful, but it introduces ambiguity outside the local context. If a developer says that a database is at 10.20.4.8, the address alone does not identify which company's network, cloud environment, or VPN contains it.

A public IPv4 address comes from globally coordinated address space and can be advertised for Internet routing. Public does not mean reachable. A firewall can block it, no route may currently advertise it, or no service may be listening.

Private does not mean secure either. Private addressing provides no encryption, authentication, or authorization. An attacker already connected to the private network can still send packets to a private address unless separate controls prevent it.

The shared block 100.64.0.0/10 is not one of the three private-use blocks. Providers commonly use it in subscriber networks, so administrators should not treat it as a convenient additional private range for an ordinary enterprise LAN.

Finally, “not private” does not automatically mean “public.” Loopback, link-local, multicast, documentation, and other reserved ranges are also outside the three private blocks.

A simple diagram often shows one machine with one address. Real systems are more varied.

A laptop connected to Wi-Fi and a VPN can have addresses such as:

All three addresses belong to the same operating system, but each has a different delivery context. Sending from one interface instead of another can select a different source address and a different network path.

One interface can also have several IPv4 addresses. Servers use this for migrations, service separation, high availability, and compatibility with existing clients. Conversely, a service address can move from one machine to another during failover.

A conventional unicast address must be unique within the scope in which participants use it. If two active interfaces claim the same address on one local network, traffic can alternate between them or fail unpredictably. The same private address reused on two isolated networks is normal.

An address can be stable without being permanent. A manually configured server address may remain unchanged for years. A laptop's address can change when it joins another network, reconnects, or receives a new configuration. Applications should not assume that an IP address is an immutable machine or user identity.

The basic IPv4 header reserves four bytes for the source address and four bytes for the destination address.

The source normally identifies the interface from which the endpoint sent the packet. The destination drives the delivery decision.

A multihomed host must choose an appropriate source. Suppose a backend server has 10.20.4.17 on an internal interface and a different address on another interface. If it sends an internal request using the wrong source, the response might not have a valid return path even though the destination address was correct.

Source addresses should not be treated as authentication. Software can construct packets containing false source values, and intermediate systems can cause a receiver to observe a different source from the one originally assigned to a client. Secure systems authenticate peers with stronger credentials.

An address configuration normally includes more than the address itself. A host also needs the prefix length and often other local network settings.

An interface can be configured manually or automatically. Servers and network devices often use stable assignments. Client devices commonly obtain configuration when they join a network. Cloud platforms may assign an address when a virtual interface is created.

Automatic does not necessarily mean unpredictable. A network can consistently give one interface the same address, while a manually configured address can still be changed by an administrator.

Before using a unicast address on a local network, a host should avoid selecting one already in use. Duplicate addresses can cause packets for one endpoint to reach another, make connections fail intermittently, and create misleading neighbor-cache entries.

The allocation of public address blocks is coordinated at a larger scale. The Internet Assigned Numbers Authority maintains the global address registry and delegates address space to regional registries. Providers and organizations receive smaller allocations from that hierarchy. This coordination keeps globally used unicast addresses unique and allows networks to work with aggregated prefixes.

Early IPv4 divided unicast space into fixed address classes. The first bits of the address selected a network size:

This design was simple but inflexible. An organization needing more than a small Class C block might receive a Class B block containing 65,536 total addresses even if it needed only a few thousand. Much of the allocation could remain unused while being unavailable to everyone else.

Modern IPv4 uses explicit prefix lengths rather than inferring the boundary from a class. A /20, for example, is valid even though /20 was not one of the three classful unicast sizes.

Terms such as “Class A network” still appear in old documentation and informal conversation, especially when describing 10.0.0.0/8. They describe history, not the rule modern software should use to calculate an address block. The configured prefix length is authoritative.

With 32 bits, IPv4 has:

That total is smaller than it first appears.

Large blocks are reserved for private use, loopback, link-local communication, multicast, documentation, and protocol purposes. They cannot all serve as globally unique unicast addresses.

Early classful allocation also distributed some blocks much larger than their users required. Even after allocation became more efficient, an address cannot always be moved freely from one network to another without operational and routing consequences.

Demand grew from far more than personal computers. Phones, home routers, servers, cloud workloads, access networks, and embedded devices all needed connectivity. Providers also need spare capacity for growth and operations; they cannot safely allocate every last address with no reserve.

In 2011, the central IANA pool reached the point where its final five /8 blocks were distributed to the five regional registries. The registries then continued allocating from their existing pools under increasingly restrictive policies.

IPv4 exhaustion describes a shortage in the allocation system: there is no large central supply of never-allocated public IPv4 space available to satisfy continuing demand. Some addresses remain unused, reserved, held for growth, recovered, or transferred while the overall system remains scarce.

Several techniques have prolonged IPv4's useful life.

Flexible prefix allocation replaced fixed classes, allowing organizations to receive blocks closer to the size they require. This reduced waste but did not add new addresses.

Private address reuse lets millions of separate networks use the same three private ranges. Address translation at their boundaries can let many internal endpoints share a smaller public pool. This conserves public addresses but adds state and weakens the original end-to-end addressing model.

Recovery and transfers move public blocks from organizations that no longer need them to networks that do. This improves utilization, but it redistributes a fixed resource rather than increasing the total.

IPv6 deployment provides a much larger address space and is the long-term replacement for the 32-bit constraint. IPv4 remains widespread because networks, applications, operational processes, and devices cannot all migrate at once.

These measures explain why IPv4 still works despite exhaustion. Scarcity appears as address-sharing infrastructure, transfer costs, provider restrictions, and operational complexity rather than as a day on which every IPv4 connection suddenly stops.

On Linux, display IPv4 addresses with:

One entry might contain:

This line reports:

Linux scope global does not claim that 10.20.4.17 is a public Internet address. In this output, global distinguishes the address from host-only or link-only scope within the operating system. The address still belongs to the private 10.0.0.0/8 block.

On macOS, inspect IPv4 lines with:

On Windows, use:

Look at the address and prefix or subnet mask together. Recording only 10.20.4.17 omits information needed to interpret the local address block.

To view IPv4 packets on Linux or macOS, capture on the active interface:

Replace en0 with the correct interface name. A line can resemble:

The four-octet values are the IPv4 source and destination. tcpdump appends transport port numbers in this display, so .51542 and .443 are not fifth IPv4 octets.

Packet captures are most useful when interpreted at a known capture point. A capture on a loopback interface, physical interface, virtual interface, or network boundary can show traffic from a different addressing context.

An unexpected address often narrows a network problem quickly.

The service works at 127.0.0.1 but not from another machine. It may be listening only on loopback. Binding it to an appropriate interface address or wildcard can make it reachable, but firewall and access policy still apply.

An interface unexpectedly has 169.254.x.x. Local connectivity may exist, but ordinary address configuration probably failed. Remote networks will not route that link-local source.

Two hosts intermittently answer for one address. A duplicate IPv4 assignment can cause neighbor mappings and traffic delivery to alternate between interfaces.

A private address works from the office but not from home. The address has meaning only where a route to the correct private network exists. Its reuse elsewhere can even send traffic to the wrong local destination.

A public-looking address is unreachable. Confirm that the value is not documentation, multicast, or another reserved range. Even a valid public allocation still requires an advertised path, a reachable interface, and a service that accepts the traffic.

A tool shows 0.0.0.0:8080. In a listening-socket display, this normally means the process accepts connections on all local IPv4 addresses at port 8080; clients do not connect to the server by using 0.0.0.0 as its destination.

These observations complement packet tracing by exposing cases where the address itself has the wrong scope or meaning.

IPv4 has about 4.3 billion total values, not 4.3 billion public host addresses. Special-purpose ranges and operational constraints reduce the globally usable pool.

An address ending in .0 is not automatically a network address. The role of the bits depends on the prefix length.

An address ending in .255 is not automatically a broadcast address. Broadcast calculation also requires the prefix.

172.x.x.x is not always private. Only 172.16.0.0 through 172.31.255.255 belongs to 172.16.0.0/12.

0.0.0.0 is context dependent. It can mean unspecified, all local interfaces in a bind operation, or every destination when paired with /0.

A private address is not a security control. Private ranges provide reusable addressing, not encryption or authenticated access.

A public address is not guaranteed to be reachable. Allocation, routing, filtering, and application availability are separate conditions.

Classful addressing is historical. Modern networks use explicit prefix lengths instead of deriving the network boundary from Class A, B, or C.

Exhaustion does not mean every allocated address is active. It means the remaining freely available public supply cannot satisfy demand as if IPv4 were an abundant resource.

An IP address is not a permanent machine or user identity. Addresses belong to interface configurations, can change, can move, and can be represented falsely in packet source fields.

IPv4 uses 32-bit addresses for network-layer delivery. Dotted-decimal notation displays four bytes from 0 to 255, while a prefix length identifies the shared leading bits of an address block. An address and its prefix must therefore be interpreted together.

Unicast addresses a receiver, broadcast targets a local scope, and multicast targets a group. Private, loopback, link-local, shared, documentation, multicast, and broadcast ranges are not ordinary public unicast space. Values such as 0.0.0.0, 127.0.0.1, and 169.254.0.0/16 often reveal configuration state. Addresses identify interfaces in a network context, not permanent machine, user, or application identities.

IPv4 has 4,294,967,296 possible values, but reservations, allocation history, fragmentation, and demand make public space scarce. Flexible allocation, private reuse, address sharing, recovery, and transfers extend its life without removing the 32-bit limit.

Correct configuration and diagnosis begin with understanding an IPv4 address's exact scope and meaning.