What is an IP address? Format, classes and how it works

What is an IP address? An IP (Internet Protocol) address is the number assigned to each network interface at the network layer, and it is what packets use to get from one device to another. The most widely used form, IPv4, is 32 bits long; for readability it is written as four decimal numbers from 0 to 255 separated by dots, such as 192.168.1.10. Every address has two parts: the network portion at the front says which network it is on, and the host portion at the back says which device on that network it is. The subnet mask decides where one ends and the other begins. An IP address does two jobs: it identifies the interface, and it tells routers where to deliver packets. IPv6 addresses are 128 bits and follow their own notation and rules; this article focuses on IPv4.

Dotted decimal: how 32 bits become 192.168.1.10

To a computer, an IPv4 address is a 32-bit binary number. Cut it into four 8-bit pieces called octets, convert each to a decimal number from 0 to 255, and you get dotted-decimal notation. The bits in each octet are worth 128, 64, 32, 16, 8, 4, 2 and 1 from left to right. Taking 192.168.1.10 as an example:

Octet	Decimal	As powers of 2	Binary
1st	192	128 + 64	11000000
2nd	168	128 + 32 + 8	10101000
3rd	1	1	00000001
4th	10	8 + 2	00001010

32 bits can represent 2^32 = 4,294,967,296 addresses, about 4.3 billion. Take away private, multicast, reserved and other special-purpose ranges and even fewer can be used on the internet. That is the root of IPv4 address scarcity and the reason IPv6 exists.

Some strings look like valid dotted decimal but are not, which matters when you keep address records or write scripts:

String	Valid?	Notes
192.168.1.10	Yes	Standard form
192.168.1.256	No	Each octet tops out at 255
192.168.010.1	Ambiguous	Many systems read a leading 0 as octal, so 010 becomes 8
192.168.1	Non-standard	Some programs expand it to 192.168.0.1
3232235786	Accepted by some programs	The 32-bit integer form, equal to 192.168.1.10

The third row is not theoretical. It reproduces on both Windows and Linux:

C:\> ping 192.168.010.1

Pinging 192.168.8.1 with 32 bytes of data:

$ ping 192.168.010.1
PING 192.168.010.1 (192.168.8.1) 56(84) bytes of data.

Python’s ipaddress module rejects leading zeros outright from version 3.9.5 onward, while older versions read 010 as decimal 10. The same string means different things to different tools, and even to different versions of the same tool, so always write addresses in records, configuration and tickets in the standard form without leading zeros.

Network and host portions: what the subnet mask does

An address on its own is not enough; you also need to know which bits are the network portion. That is the subnet mask’s job: bits set to 1 in the mask are network bits, bits set to 0 are host bits. A bitwise AND of the address and the mask gives the network address:

address   192.168.1.10    11000000.10101000.00000001.00001010
mask      255.255.255.0   11111111.11111111.11111111.00000000
AND       192.168.1.0     11000000.10101000.00000001.00000000   <- network address

Here the first 24 bits are the network portion, written as 192.168.1.10/24, and the last 8 bits, 10, are the host portion: host number 10 on that network. Two addresses in every subnet cannot be given to devices: the network address, with all host bits 0 (192.168.1.0), and the broadcast address, with all host bits 1 (192.168.1.255). That leaves 254 usable addresses in a /24.

The network portion decides how a host sends a packet. Suppose this host is 192.168.1.10/24 with a gateway of 192.168.1.1:

Destination	Same network?	How the host sends it
192.168.1.20	Yes, both network portions are 192.168.1	Uses ARP to find the MAC address of .20 and sends directly
192.168.2.20	No	Sends to the gateway 192.168.1.1, which forwards it
8.8.8.8	No	Also hands it to the gateway

On Linux you can ask the system which way it will go:

$ ip route get 192.168.1.20
192.168.1.20 dev eth0 src 192.168.1.10
$ ip route get 192.168.2.20
192.168.2.20 via 192.168.1.1 dev eth0 src 192.168.1.10

The first result has no “via”, meaning direct delivery; in the second, the address after “via” is the gateway. On Windows, the PowerShell equivalent is Find-NetRoute -RemoteIPAddress 192.168.2.20. When a new engineer reports “I can reach my own subnet but nothing else”, the gateway is usually missing or wrong; when two hosts on the same subnet cannot reach each other, compare the masks on both sides first.

IP address classes and private IP ranges

Early IPv4 split addresses into five classes by their leading bits, and the class fixed the length of the network portion:

Class	Leading bits	First octet	Default network bits	Use
A	0	0–127	8 (255.0.0.0)	Large networks; 0 and 127 are special
B	10	128–191	16 (255.255.0.0)	Medium networks
C	110	192–223	24 (255.255.255.0)	Small networks
D	1110	224–239	—	Multicast
E	1111	240–255	—	Reserved

Since 1993 the internet has used CIDR, and the length of the network portion no longer depends on the class: an address starting with 103 can be allocated as a /24 or smaller just like any other. Classes survive in only two places today: everyday speech, where people still call a /24 “a Class C”, and some operating systems that fill in a default mask based on the class when you type an address, which is often not the mask you need.

Private addresses are three blocks that RFC 1918 set aside, one from each of classes A, B and C. Any organization may reuse them internally, but they are not routed on the internet, so reaching the outside world requires NAT to translate them into a public address:

Private range	CIDR	Equivalent to	Addresses
10.0.0.0 – 10.255.255.255	10.0.0.0/8	One Class A network	16,777,216
172.16.0.0 – 172.31.255.255	172.16.0.0/12	16 Class B networks	1,048,576
192.168.0.0 – 192.168.255.255	192.168.0.0/16	256 Class C networks	65,536

A few more special addresses that come up constantly in operations:

Address	Meaning	Where you will see it
127.0.0.0/8	Loopback: this host	Testing local services
0.0.0.0	Unspecified; in a listening socket it means “every local address”	ss -tln showing 0.0.0.0:80 means port 80 is open on all interfaces
169.254.0.0/16	Link-local, self-assigned	An interface showing one of these failed to get an address from DHCP
100.64.0.0/10	Shared address space for carrier-grade NAT	Your broadband connection does not have a real public IP
255.255.255.255	Limited broadcast on the local network	DHCP clients looking for a server
224.0.0.0/4	Multicast	VRRP, OSPF and similar protocol traffic

IP address vs domain name vs MAC address

All three are “addresses”, but they work at different layers and each covers one part of the journey:

	Domain name	IP address	MAC address
Example	www.example.com	203.0.113.30	00:00:5e:00:53:30
Layer	Application (DNS)	Network	Data link
Purpose	A name people can remember	Addressing and routing across networks	Delivering a frame to a specific NIC on the local network
Who assigns it	You register it with a registrar and set its DNS records	An ISP or data center assigns it, or DHCP hands it out	Burned into the NIC at the factory; can be changed
Translated by	DNS, into an IP address	ARP, into a MAC address	—
Changes in transit?	—	Source and destination stay the same end to end, except through NAT	Rewritten at every router hop

Following one web request ties the three together, again from a host at 192.168.1.10/24:

1. The browser resolves www.example.com through DNS and gets an IP such as 203.0.113.30. dig +short www.example.com or nslookup www.example.com shows the result of this step.
2. The host compares network portions, sees that 203.0.113.30 is not in 192.168.1.0/24, and decides to send it to the gateway.
3. The host uses ARP to find the gateway’s MAC address, or takes it from its ARP cache.
4. The frame goes out with the gateway’s MAC as its destination MAC and 203.0.113.30 as its destination IP.
5. At every router, the layer 2 header is stripped and rebuilt with the next hop’s MAC address, while the destination in the IP header stays 203.0.113.30.
6. The last router uses ARP on the server’s network to find the server’s MAC and delivers the packet.

None of these is a strict one-to-one mapping: a domain can resolve to several IPs (load balancing, CDNs), one IP can serve many domains (virtual hosting), and a NIC usually has one MAC address but can carry several IP addresses.

How IP geolocation works

An IP address contains no geographic information. “IP location” is the result of looking the address up in a database, and those databases are built mainly from these sources:

Source	What it provides	Precision
Registration records (whois)	Which organization holds the block, and the country or region it is registered in	Usually country, sometimes region
Routing announcements (BGP)	Which network announces the block on the internet	The ISP or hosting provider
Network measurement	Latency and path measurements from many known locations, used to estimate position	Depends on how dense the probes are
Location samples from apps and partners	Known locations paired with the IP in use at the time	Depends on sample volume; goes stale when addresses are reassigned

That explains the usual errors. Mobile networks route traffic through a few large gateways, so the city shown may be a regional hub rather than where the user is. Cloud servers and CDN nodes show the data center’s location, not the user’s. Addresses registered in one place and used in another may be placed at the registration address. And traffic through a proxy or VPN shows the location of the exit node. To see who an address is registered to, use whois:

whois 203.0.113.30
# In APNIC and RIPE records, look at inetnum (the range), netname, descr (the holder) and country
# ARIN records use different field names: NetRange, NetName, OrgName and Country

How to find your IP address

What you want	Windows	macOS	Linux	Notes
Addresses on this machine’s interfaces	ipconfig	ipconfig getifaddr en0	ip -4 addr	At home or in an office these are usually private addresses
Mask and gateway	ipconfig	netstat -rn (the default line shows the gateway)	ip route (the address after “default via” is the gateway)	Linux shows the mask as a prefix length such as /24
Your public IP	curl.exe -4 ifconfig.me	curl -4 ifconfig.me	curl -4 ifconfig.me	The address the rest of the internet sees

On a phone, open the details of the current Wi-Fi network to see the device’s local address. If the local address and the public address differ, a router or your ISP is translating addresses along the way, which is normal for home broadband and office networks. Servers in a data center are usually configured with public IPs directly, so the two match.

The IP addresses one data center server uses

New data center engineers quickly find that a single colocated server involves more than one address:

Address	Example	Configured on	Reachable from
Production public IP	203.0.113.30/26	The server’s production NIC	The internet
Gateway	203.0.113.1	The VLAN interface on the layer 3 switch	Servers on the same subnet
IPMI management IP	10.20.0.15/24	The server’s BMC management port	The data center management network only
Internal IP	10.30.1.15/24	The server’s second NIC	The data center’s internal network
Switch management IP	10.10.0.2/24	The switch’s management interface	Operations staff only

These addresses belong to different blocks with different purposes, and getting one wrong means an outage: a production IP assigned twice causes a conflict, and an IPMI address placed in a public block exposes the management port to the internet. IP address management in Toplink DCIM records address blocks by CIDR and works out the first and last address and the netmask, with the gateway set to the first or last address in the block. Each block can be typed as public, IPMI, customer private, internal, temporary and so on, and each type is counted and assigned separately. When a server is provisioned it takes an address from an available block automatically; when it is decommissioned or cancelled, setting its addresses back to free reclaims them, so you can always look up which address is on which machine.