IP addresses

Addresses support delivery

An IP address identifies a network-layer endpoint or interface in the context of a network. IPv4 uses 32-bit addresses, commonly written as four decimal numbers. IPv6 uses 128-bit addresses with a different textual notation and addressing architecture. The address helps deliver packets; it is not an authentication credential.

A device can have multiple interfaces and addresses, and its addresses can change. A laptop might use different addresses on home Wi-Fi, an office network, and a VPN. A service may also be reachable through multiple addresses or infrastructure components.

Understand the prefix with the address

An address alone does not describe the local network boundary. Its prefix or subnet information helps a device decide whether a destination is on the local link or requires forwarding through a gateway. Subnetting and CIDR explains that boundary and its notation.

For example, in a small training network, two IPv4 addresses beginning with the same numbers may or may not be in the same subnet, depending on the configured prefix. Avoid using visual similarity as a substitute for checking the actual configuration.

Private addresses are reusable

RFC 1918 reserves particular IPv4 ranges for private networks. Different organizations can use the same private addresses internally. Seeing an address such as 192.168.1.20 therefore does not identify one globally unique computer. The network context matters.

Network address translation explains how a gateway can translate addresses and ports when traffic crosses a boundary. A remote service may see a shared outward-facing address instead of the original private address. IPv6 has its own address types and operational considerations; do not copy every IPv4 assumption into an IPv6 design.

A log needs time and context

Imagine a fictional analyst sees suspicious activity associated with a public IP address. Several learners may share that address through a gateway. The same address might later be assigned to a different connection. Treating the address as a person's identity would overstate the evidence.

The analyst may need the event time, source port, translation records, lease information, application account, and device evidence. Logs and telemetry explains the broader need for context. Even with additional records, describe what they actually support rather than assuming every network observation identifies a human.

Inspect your own configuration

In a lab or on your own device, identify the local address, prefix, gateway, and configured name-resolution service. Record the relationships rather than publishing unnecessary details about a private environment. Repeat the observation on a different network and compare what changes.

Then draw a request from the local interface to a public website. Mark where the source address might be translated and where a log would record each view. Domain Name System connects the site's name to address resolution, while Routing and switching explains how forwarding uses network and local-link information.