An IP address is a numerical label assigned to every device on a network that uses the Internet Protocol, identifying it so that data packets can be routed to and from it.
How IP addresses work
Two versions are in use:
- IPv4 (RFC 791, 1981) uses 32-bit addresses written as four numbers, such as 192.0.2.10, giving about 4.3 billion possible addresses – a pool that has effectively run out.
- IPv6 (RFC 8200) uses 128-bit addresses written in hexadecimal, such as 2001:db8::1, providing an almost unlimited address space.
Address blocks are distributed by IANA to five regional internet registries and on to ISPs and organisations. Ranges reserved by RFC 1918, such as 10.0.0.0/8 and 192.168.0.0/16, are private: home and office devices use them internally and share one public address through network address translation (NAT). Addresses can be static or assigned dynamically via DHCP.
Why IP addresses matter for security
- Detection and blocking – firewalls, intrusion detection systems and threat intelligence feeds track malicious IP addresses as indicators of compromise and use reputation lists to block scanners and botnets.
- Attribution limits – attackers hide their real address behind a proxy server, VPN, Tor or compromised devices, so an IP address alone rarely proves who is behind an attack.
- Spoofing – forged source addresses are used in reflection and amplification DDoS attacks (see spoofing).
- Privacy – an IP address reveals an approximate location and internet provider. In 2016 the EU Court of Justice ruled that even dynamic IP addresses can be personal data, and they are treated as such under GDPR.
Best practices
- Do not expose management interfaces on public IP addresses; restrict them with allowlists or VPN access.
- Log source addresses and correlate them with other signals rather than relying on IP-based trust alone.
- Apply ingress and egress filtering (BCP 38) to stop spoofed traffic.
Synonyms:
internet protocol address
