IP & network

Your public IP, subnet and routing determine who can reach your connection and how it is addressed on the internet — the starting point for almost every other check on this site.

Tools (3)

All tools →

Guides (2)

All guides →

Glossary (32)

Full glossary →

Anycast — Anycast is a network addressing technique where the same IP address is announced from multiple physical locations, and internet routing (via BGP) delivers each client's traffic to the topologically nearest or best-performing instance rather than one fixed server. It's the mechanism behind most large-scale, low-latency public DNS resolvers and content delivery networks: a query sent to the same anycast address from different continents is actually answered by different physical servers, improving latency and giving automatic failover, since a failing site's routes simply stop being advertised and traffic shifts to the next-nearest instance. AdminKit's DNS lookup tool queries Cloudflare's public DNS-over-HTTPS resolver, a well-known anycast deployment, so the specific server that answers a given query depends on where the request originates rather than a single named machine.
ARP (Address Resolution Protocol) — Address Resolution Protocol (ARP), defined in RFC 826, maps a device's IPv4 address to its link-layer (MAC) address on a local network, since IP packets carry an IP address but the local network hardware needs a MAC address to actually deliver a frame. A device that needs to reach another IP address on the same subnet broadcasts an ARP request asking "who has this address," and the device that holds it replies directly with its MAC address; the asking device then caches that mapping in an ARP table for a short period to avoid repeating the broadcast for every packet. ARP has no built-in authentication, so any device on the same broadcast domain can reply to a request it was never asked, which is the basis of ARP spoofing. IPv6 does not use ARP at all, relying on Neighbor Discovery Protocol instead.
ARP spoofing — ARP spoofing (also called ARP poisoning) is an attack on a local IPv4 network where a device sends forged Address Resolution Protocol replies, claiming to own an IP address that actually belongs to another host, such as the router. Because ARP has no built-in authentication, other devices on the same subnet update their ARP tables to trust the forged mapping, which lets the attacker intercept, modify, or drop traffic meant for someone else -- a classic man-in-the-middle setup. It only works within a single broadcast domain (the attacker must already be on the same LAN or Wi-Fi network), which limits it to insider threats, compromised devices, or open/shared networks. Switches with dynamic ARP inspection, static ARP entries for critical hosts, and network segmentation are the standard mitigations; IPv6 networks use Neighbor Discovery Protocol instead, which has its own, different spoofing risks.
ASN — An ASN (Autonomous System Number) is a unique identifier assigned to a network -- an ISP, cloud provider, university, or large company -- that controls its own block of IP addresses and routing policy on the internet. ASNs are what BGP, the protocol that routes traffic between networks, uses to tell one operator's address space apart from another's. Looking up the ASN behind an IP address tells you who actually operates it: a residential ISP, a hosting provider, a mobile carrier, or a cloud platform, which is often more useful than the registered owner name alone when judging whether traffic from an address looks like a home connection, a server, or something else entirely.
BGP hijacking — BGP hijacking is when a network operator falsely announces, via the Border Gateway Protocol, that it owns a block of IP addresses it doesn't actually control. Because BGP was designed for an era of mutual trust between operators, other networks often accept the false announcement and start routing traffic for that address block through the hijacker, sometimes for minutes, sometimes for hours. The traffic can be silently dropped, inspected, or redirected to a lookalike service before being passed on, which makes hijacking useful for both outages and interception. Defenses include Resource Public Key Infrastructure (RPKI) route-origin validation and route filtering by transit providers, but adoption is still incomplete worldwide. Victims usually learn about an incident from routing-monitoring services or from their own traffic suddenly taking an unexpected path.
Bogon address — A bogon is an IP address that should never appear as a real source or destination on the public internet, because it falls in a range IANA has not yet allocated to any registry, or one reserved for special use such as RFC 1918 private space, loopback, or documentation examples (RFC 6890 catalogs the IANA special-purpose registry these reservations come from). Network operators and firewalls filter bogon traffic -- commonly against a reference list such as Team Cymru's -- on the assumption that a packet claiming to originate from one is either misconfigured or spoofed, since no legitimate host anywhere should hold that address. A "fullbogon" list extends this further to cover space that is allocated but not yet announced in global routing, which changes over time as IANA assigns new blocks, unlike the fixed special-purpose reservations.
Broadcast address — A broadcast address is the special address at the top of an IPv4 subnet, with every host bit set to 1, that delivers one packet to every device on the subnet at once -- for a /24 network like 192.168.1.0/24, that's 192.168.1.255. RFC 919 and RFC 922 define this behavior, establishing subnet broadcasting as part of the original IP addressing scheme. Because the broadcast address is reserved for this purpose, it -- along with the all-zeros network address at the bottom of the range -- can't be assigned to an individual host, which is why a /24 subnet provides 254 usable host addresses rather than 256. IPv6 has no broadcast address at all; it replaced the concept with multicast, using scoped multicast groups instead of flooding an entire segment. AdminKit's subnet calculator computes a subnet's broadcast and network addresses automatically from any CIDR block.
CGNAT — CGNAT (Carrier-Grade NAT) is a technique ISPs use to share one public IPv4 address across many customers at the same time, instead of giving each household or mobile subscriber its own address. It exists because the global supply of IPv4 addresses ran out faster than IPv6 rolled out everywhere, and it is especially common on mobile networks. The tradeoff is that anything tied to "your IP" -- blacklist status, inbound port forwarding, geolocation -- is really tied to everyone sharing that address with you. RFC 6598 reserves the 100.64.0.0/10 block specifically so CGNAT traffic can be told apart from ordinary private addressing.
CIDR (Classless Inter-Domain Routing) — CIDR (RFC 4632) replaced the old class-based (A/B/C) system for allocating IP address blocks with a flexible prefix-length notation, written as an address followed by a slash and a bit count (for example 192.168.1.0/24), where the prefix marks how many leading bits identify the network. This lets a block be sized to the number of hosts actually needed instead of only the fixed class sizes, and lets routers summarize many smaller blocks into one advertised route, which is what kept the global routing table from growing unmanageably as the internet scaled. The same slash notation is also used for subnetting within a single organization's own network, not just for internet-wide routing. A /24 block provides 256 addresses and a /32 is a single host; the lower the prefix number, the larger the block it describes.
Dual-stack — Dual-stack is a network configuration where a device or network runs IPv4 and IPv6 at the same time, each with its own address, rather than only one. RFC 4213 defines this as the basic transition mechanism for IPv6 deployment: a dual-stack host can reach an IPv4-only destination over IPv4 and an IPv6-only destination over IPv6, using whichever protocol a given DNS lookup and route actually support. Most consumer ISPs and routers run dual-stack today rather than switching to IPv6-only, since plenty of destinations and internal services remain IPv4-only. The practical catch is that security has to be configured for both stacks separately -- a firewall rule written only for IPv4 silently leaves the same device's IPv6 address unprotected. AdminKit's DNS lookup tool reflects this by resolving both a domain's A (IPv4) and AAAA (IPv6) records side by side.
Dynamic IP — A dynamic IP address is a public address your ISP assigns to your connection temporarily and can change over time -- when your router reconnects, after a DHCP lease expires, or whenever the ISP reallocates its address pool. This is the default for most home and mobile connections, since it lets ISPs reuse a limited pool of addresses across customers who aren't all online at once. The alternative is a static IP, which stays fixed and is usually a paid add-on. A changing address matters for anything that depends on reaching the same address reliably over time -- remote access, self-hosting, dynamic DNS -- and for long-term monitoring, since a single point-in-time check can miss an address that has since changed.
EUI-64 — EUI-64 (Extended Unique Identifier, 64-bit) is a method for turning a network interface's 48-bit MAC address into a 64-bit IPv6 interface identifier: the MAC is split in half, the fixed value fffe is inserted in the middle, and one bit is flipped to mark it as globally unique. Stateless Address Autoconfiguration (SLAAC) can use this EUI-64 value as the last 64 bits of a device's IPv6 address, so the address embeds the same hardware identifier as the device's MAC. Because that identifier stays constant across networks and reveals the manufacturer via its OUI prefix, it lets a device be tracked across different networks over time -- the reason modern operating systems generate randomized, temporary interface identifiers (RFC 4941) by default instead of EUI-64 for most traffic.
Happy Eyeballs — Happy Eyeballs, specified in RFC 8305, is an algorithm a dual-stack client uses to connect to a destination that publishes both an IPv6 (AAAA) and an IPv4 (A) address, without waiting for a slow or broken path to time out before trying the other. The client starts an IPv6 connection attempt first and, if it hasn't succeeded within a short delay (RFC 8305 recommends around 250 milliseconds), starts an IPv4 attempt in parallel, keeping whichever connection completes first and abandoning the other. This replaced the original Happy Eyeballs described in RFC 6555, which RFC 8305 updates with refinements like sorting destination addresses and tuning the connection-attempt delay. Without it, a client that only tried IPv6 first and waited for a full timeout before falling back would make dual-stack connectivity noticeably slower whenever a network's IPv6 path was actually broken.
IP address — An IP address is a numeric label assigned to every device on a network so other devices know where to send traffic. IPv4 addresses are four decimal numbers separated by dots (like 203.0.113.42), drawn from a pool of about 4.3 billion addresses that ran out years ago, which is why ISPs now lean on techniques like CGNAT to stretch what remains. IPv6 addresses are longer hexadecimal strings with a vastly larger address space, designed to give every device its own public address without sharing. Most internet services still see your IPv4 address, your IPv6 address, or both, depending on what your device and network support -- AdminKit's IP lookup shows exactly what the internet sees from your connection right now.
IP multicast — IP multicast (RFC 1112) is a way of sending one packet to a group of interested receivers at once, instead of either broadcasting to every device on a network or sending a separate unicast copy to each recipient individually. A sender transmits to a reserved multicast address (224.0.0.0/4 for IPv4, or a ff00::/8 address for IPv6), and only devices that have joined that group, typically via IGMP for IPv4, actually receive and process the packet. On a local network, several zero-configuration discovery protocols build on this: mDNS and SSDP both send queries and announcements to a multicast address so other devices on the same segment can find them without a central server, which is convenient on a trusted home LAN but also means any other device on that same segment receives the same broadcasts by design.
IPv4 address exhaustion — IPv4 address exhaustion is the depletion of the roughly 4.3 billion addresses IPv4's 32-bit address space provides, a limit the internet's growth reached faster than IPv6 -- which uses a 128-bit address space large enough that exhaustion isn't a practical concern -- was deployed to replace it. IANA allocated its last remaining IPv4 address blocks to the regional internet registries in 2011, and several registries have since run out of their own free pools too. Rather than switching networks to IPv6-only, most ISPs responded with mitigations that stretch the existing IPv4 supply: Carrier-Grade NAT (CGNAT) shares one public address across many customers, using the shared address block RFC 6598 reserves for exactly that purpose. AdminKit's CGNAT guide covers why that specific mitigation, adopted because of this exhaustion, causes shared blacklist status and broken port forwarding for affected customers.
IPv6 — IPv6 is the successor to IPv4, using 128-bit addresses written as groups of hexadecimal digits (like 2001:db8::1) instead of IPv4's 32-bit dotted-decimal format. Its address space is large enough -- roughly 340 undecillion addresses -- that every device can get its own globally routable public address without the address-sharing tricks like NAT or CGNAT that IPv4 scarcity forced. Adoption is uneven: many ISPs and home routers now assign IPv6 alongside IPv4 (dual-stack), but plenty of networks and devices still default to IPv4-only firewall rules, including ones never configured with IPv6 in mind, which is a common, overlooked gap in home-network security.
IPv6 prefix delegation — IPv6 prefix delegation is the mechanism, defined as a DHCPv6 option in RFC 8415, by which an ISP or upstream router hands a shorter IPv6 prefix -- commonly a /56 or /60 -- to a requesting router rather than assigning it a single address. The receiving router, typically a home or office gateway, then subnets that delegated prefix into individual /64 networks for each of its own LAN segments, advertising one to each via router advertisements so devices on that segment can self-assign addresses through SLAAC. This is the step that happens before SLAAC can run at all: a router has nothing to subdivide and advertise until prefix delegation hands it a block in the first place, and a delegation that changes on reconnection -- common with some residential ISPs -- can shift every downstream device's address along with it.
Link-local address — A link-local address is an IP address valid only on the local network segment it was configured on, never routed beyond it. In IPv6, every interface automatically generates one in the fe80::/10 block defined by RFC 4291, using it for essential local operations like neighbor discovery and SLAAC (RFC 4862) before any routable global address is even assigned. IPv4 has an equivalent mechanism, RFC 3927's 169.254.0.0/16 range, which a device assigns itself via APIPA when DHCP fails, as a fallback rather than a routine addressing scheme. Because link-local addresses aren't globally unique or routable, the same fe80:: address can appear on many different interfaces at once, which is why IPv6 tooling and URLs require a zone index (such as fe80::1%eth0) to say which interface it applies to. AdminKit's guide to IPv6 SLAAC and EUI-64 addressing covers how link-local addresses get generated and used during IPv6 autoconfiguration.
Loopback address — A loopback address is a reserved address a device uses to address itself: 127.0.0.0/8 for IPv4 (commonly 127.0.0.1), defined in RFC 1122, and ::1/128 for IPv6, defined in RFC 4291. Traffic sent to it is handled entirely inside the host's own network stack and never reaches a physical network interface, which is why it keeps working even with no network connection at all. Many services are deliberately configured to listen only on the loopback interface by default, accepting connections from processes on the same machine but refusing anything arriving from outside -- Redis's own "protected mode," for example, falls back to loopback-only access whenever no password is configured. Confirming whether a service is bound to loopback or to a public interface is the first question in diagnosing an unexpected database exposure.
MAC OUI — The OUI (Organizationally Unique Identifier) is the first three bytes (24 bits) of a network interface's MAC address, assigned by the IEEE Registration Authority to the manufacturer that requested it. Because every Ethernet or Wi-Fi interface ships with a vendor-assigned MAC address, looking up its OUI against the IEEE's public registry often reveals the maker of a device, useful for spotting an unexpected device type on a network even without a hostname. The OUI's second-least-significant bit also marks whether an address is "locally administered" rather than factory-assigned, which is how randomized or privacy-focused MAC addresses, such as those modern phones use per network, can be distinguished from a real vendor-issued address.
NAT — NAT (Network Address Translation) is the mechanism a router uses to let every device on a private network -- laptops, phones, smart TVs -- share a single public IP address when talking to the internet. The router keeps a translation table mapping each internal device's private address and port to a public port, rewriting packets in both directions so replies reach the right device. Without NAT, every device would need its own public IPv4 address, which the internet ran out of long ago. Home routers do one layer of NAT; some ISPs add a second layer on top, called CGNAT, which shares one public address across multiple customers' routers rather than just one household's devices.
NAT loopback — NAT loopback, also called NAT hairpinning, is a router feature that lets a device on a local network reach another device on the same network using its public IP address or domain name, instead of its internal address. Without it, a request from inside the network to the router's own public IP can simply fail or time out, because routers expect traffic to arrive from outside or leave from inside, not loop back on itself. This matters whenever a local user accesses a self-hosted service -- a security camera, NAS, or web app -- by its public address or DNS name while on the same Wi-Fi network as the server. Not every consumer router supports NAT loopback, which is a common cause of "works on mobile data but not on home Wi-Fi" reports; the usual workarounds are split-horizon DNS or using the device's local IP address instead.
NDP (Neighbor Discovery Protocol) — Neighbor Discovery Protocol (NDP), defined in RFC 4861, is IPv6's replacement for several separate IPv4 mechanisms -- ARP, ICMP router discovery, and ICMP redirects -- combined into one set of ICMPv6 message types. Neighbor Solicitation and Neighbor Advertisement resolve a neighbor's IPv6 address to its MAC address, the role ARP plays on IPv4 networks, while Router Solicitation and Router Advertisement let a host discover routers on its link and learn the address prefix it should use for SLAAC (RFC 4862) autoconfiguration. Because NDP messages are not authenticated by default, a host on the same local network can send forged Router or Neighbor Advertisements to redirect traffic or claim an address that is not its own, an IPv6 equivalent of ARP spoofing; SEND (Secure Neighbor Discovery, RFC 3971) exists to cryptographically protect these messages but sees limited real-world deployment.
Port forwarding — Port forwarding is a rule configured on a router or firewall that takes inbound traffic arriving on a specific port of the public IP address and forwards it to a chosen device and port on the local network. It is how a game server, security camera, or self-hosted web app behind a home or office router can accept connections initiated from the internet, since without it the router's NAT would simply drop unsolicited inbound packets. The tradeoff is that whatever is listening on the forwarded port becomes directly reachable by anyone on the internet, not just intended users, so an outdated or misconfigured service behind a forwarded port is a common way home and small-office devices end up exposed. Universal Plug and Play (UPnP) lets applications request forwarding rules automatically, which is convenient but removes the manual review step that catches unnecessary exposure.
Reverse proxy — A reverse proxy is a server that sits in front of one or more backend servers and forwards incoming client requests to them, returning the response as if it came from the proxy itself. Clients only ever see the reverse proxy's address, never the backend servers directly, which lets an operator load-balance traffic across multiple servers, terminate TLS in one place, cache responses, and hide internal network layout. This is the opposite of a forward proxy, which sits in front of clients and forwards their requests outward on their behalf. Reverse proxies commonly add or rewrite headers such as X-Forwarded-For and Via as a request passes through, which is why a site's response headers often reveal that a reverse proxy, CDN, or load balancer is in the path even when the real backend stays hidden.
RFC 1918 private address — RFC 1918 reserves three blocks of IPv4 address space -- 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 -- for use inside private networks, never to be routed on the public internet. Any organization or home network can reuse these same addresses internally without coordinating with anyone else, which is what makes NAT (network address translation) necessary at the boundary: a router rewrites a private source address to its one public address before traffic leaves the network, then reverses the mapping for replies. Seeing one of these ranges as a device's own address is normal and expected behind a home router or office firewall. Seeing one show up where a public-facing address is expected instead usually signals a misconfigured NAT, proxy, or double-NAT setup rather than a real internet-reachable host.
STUN/TURN — STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays around NAT) are protocols that help two devices behind NAT, such as a video call app on two different home networks, establish a working connection. A STUN server simply tells a device what its own public IP address and port look like from the outside, which is often enough for both sides to exchange that information and connect directly. When the NAT or firewall on either side is too restrictive for a direct path, a TURN server instead relays the traffic between the two devices, acting as a middleman at the cost of extra latency and bandwidth. Real-time communication standards like WebRTC use both together, trying a STUN-assisted direct connection first and falling back to a TURN relay only when needed. CGNAT, common on mobile networks, is one of the main reasons a TURN relay ends up being required.
Subnet — A subnet is a logical subdivision of an IP network, defined by a prefix length (written as a CIDR suffix like /24) that marks how many of the address's bits identify the network versus the individual host. Subnetting lets an organization split one large address block into smaller, independently routable or administrable segments -- separating a guest Wi-Fi network from internal servers, for example. The same math applies to deciding whether an address falls inside a reserved range, such as checking if a router's WAN address sits inside the 100.64.0.0/10 block ISPs use for CGNAT, or inside the private ranges defined by RFC 1918.
Supernetting (route aggregation) — Supernetting, also called route aggregation or route summarization, is the practice of combining several contiguous, same-size IP address blocks into one larger block that can be advertised as a single route. It's possible because of CIDR's prefix-length notation (RFC 4632, obsoleting the original CIDR documents RFC 1518 and RFC 1519): four contiguous /24 blocks that align on a /22 boundary can be announced as one /22 route instead of four separate /24 routes. Internet service providers rely on supernetting to keep the global BGP routing table from growing in proportion to every small allocation ever made; without it, routers would need to store and process far more routes. The tradeoff is that aggregation only works cleanly when the underlying blocks are contiguous and properly aligned, so allocations are usually planned around power-of-two boundaries. AdminKit's subnet calculator shows a block's boundaries, useful when checking whether adjacent blocks can be cleanly aggregated.
Teredo and 6to4 — Teredo (RFC 4380) and 6to4 (RFC 3056) are IPv6 transition mechanisms that tunnel IPv6 packets inside IPv4 traffic, letting a device reach the IPv6 internet even when its own network only provides IPv4 -- Teredo encapsulates packets in UDP specifically so the tunnel can traverse most NAT devices, while 6to4 wraps them directly in IPv4 protocol 41 and expects a public IPv4 address at the tunnel endpoint. Both predate today's widespread native dual-stack deployment and are now considered legacy: Microsoft disabled Teredo by default starting with Windows 10, and RFC 7526 formally deprecated 6to4's anycast relay infrastructure. The practical risk is that a tunnel operating inside otherwise-allowed UDP or protocol-41 traffic can give a device an IPv6 address a firewall configured only with IPv4 rules in mind was never written to cover.
ULA (Unique Local Address) — A Unique Local Address (ULA, RFC 4193) is an IPv6 address range reserved for private, local-network use, playing a role similar to RFC 1918 private ranges (like 192.168.0.0/16) in IPv4. ULAs fall within fc00::/7, with fd00::/8 the portion in practical use, and each site generates its own /48 prefix from a pseudo-random algorithm so two independently configured networks are very unlikely to collide if they're later merged or interconnected. Unlike a public IPv6 address, a ULA is not supposed to be routed on the open internet, making it useful for internal services, inter-device communication, or dual-stack networks that want stable local addressing independent of whatever public IPv6 prefix an ISP assigns, which can change over time.

Comparisons (2)

All comparisons →

Solutions (3)

All solutions →

Related clusters

DNS

DNS turns domain names into the IP addresses, mail servers and records your tools actually look up — most "it broke" reports trace back to one wrong or missing DNS record.

Security basics

TLS certificates, HTTP security headers and open ports are the fundamentals every internet-facing service should get right, independent of which protocol or cloud it runs on.

See all six clusters →

Frequently asked questions

What belongs in the IP & network cluster?

Your public IP, subnet and routing determine who can reach your connection and how it is addressed on the internet — the starting point for almost every other check on this site. This hub lists every AdminKit tool, guide, glossary term, comparison and solution tagged with this cluster.

How does IP & network relate to DNS and Security basics?

DNS — DNS turns domain names into the IP addresses, mail servers and records your tools actually look up — most "it broke" reports trace back to one wrong or missing DNS record. Security basics — TLS certificates, HTTP security headers and open ports are the fundamentals every internet-facing service should get right, independent of which protocol or cloud it runs on.