Who Gave You Your IP Address? How IANA, Regional Registries, and Internet Providers Hand Out Public Addresses

Ask the public directory called whois who holds 1.1.1.1, the address of Cloudflare's popular DNS (Domain Name System) resolver, the service that turns website names into the numeric addresses computers actually connect to, and the answer is the research arm of APNIC (the Asia Pacific Network Information Centre), based in Brisbane, Australia. Ask which network carries traffic for that address, and the answer is Cloudflare, a company headquartered in San Francisco. Then ping it, a quick test that times how long an address takes to answer, using our free ping tool, which runs from IPCraft's server in Ashburn, Virginia, and a reply comes back in about a millisecond, so the machine that answered sits close by in northern Virginia. All three answers are correct. Each describes a different link in a chain that starts with one organization holding the world's supply of addresses and ends at the router in your home, and once you can name the links, a lookup on any address tells you who is responsible for it, who carries its traffic, and where to report it when it misbehaves.

Every device that talks across the internet needs a public IP (Internet Protocol) address, the number other machines use to send it data, and each public address has to belong to exactly one organization at a time. If two networks claimed the same addresses, routers would deliver some of each network's traffic to the other, the way two houses sharing a street address would each receive half of the other's mail. IPv4 (Internet Protocol version 4), the familiar format of four numbers separated by dots, has room for 4,294,967,296 addresses, and about 600 million of those are reserved for special uses, including the private ranges, such as 192.168.0.0/16, that home routers use inside the house, which our guide to the reserved IP ranges lists. Everything else has to be handed out by someone, written down somewhere, and kept from overlapping, and the internet settled on a ladder of registries to do it.

For the internet's first few decades, the job of deciding who got which numbers fell largely to one person. Jon Postel, a computer scientist at the University of Southern California, kept track of assignments from the 1970s until his death in 1998, and the role became known as IANA (the Internet Assigned Numbers Authority). In those years, addresses went out in enormous blocks with little paperwork. A /8, in the slash notation that our visual guide to CIDR (Classless Inter-Domain Routing) explains, holds 16,777,216 addresses, and early recipients such as the Massachusetts Institute of Technology (MIT), Apple, Ford, and the United States Department of Defense each received at least one. These early grants are called legacy space, and many still belong to the organizations that first received them, although MIT sold about half of its block in 2017, after addresses had become valuable enough to fetch a real price.

IANA still sits at the top of the chain. It now operates as part of ICANN (the Internet Corporation for Assigned Names and Numbers), the nonprofit that also oversees the system of website names, and it keeps the master record of where every block of IPv4 space has gone, and the same for IPv6 (Internet Protocol version 6, the newer format with far longer addresses), along with the network ID numbers described later in this guide. IANA deals almost entirely with five RIRs (regional internet registries), giving each one very large blocks for its part of the world. Each RIR gives smaller blocks to its members, which the European and Asia-Pacific registries call LIRs (local internet registries) and which are mostly internet providers, and the providers assign addresses to their customers, which is where you come in.

How a public address reaches you

IANA          one global authority       gives each region enormous blocks
  RIR         five regional registries   give members smaller blocks
    LIR       mostly internet providers  assign addresses to customers
      you     a home or a business       one address, or a small block

The five RIRs divide the world by geography, and each one runs from a headquarters city inside its own region. An organization works with the registry for the region where its network operates, and the oldest of the five, the European registry, dates to 1992.

Each RIR is a nonprofit membership organization, and its rules come from its members and anyone else who wants to take part, through open mailing lists and public meetings held a few times a year. A provider that wants addresses joins its regional registry, pays an annual fee, and shows how it plans to use the space, and the registry records the result in a public database. In a few countries, including Japan, China, South Korea, India, and Brazil, an NIR (national internet registry) sits between the RIR and the providers and handles the same work, often in the local language. The RIRs also run the whois databases that answer lookups like the one for 1.1.1.1, and they control reverse DNS for their blocks, the lookups that turn an address back into a name, handing that control to each block's holder so a provider can name its own addresses. Our free reverse DNS tool shows the name attached to any public address.

Most RIR members are internet providers, hosting and cloud companies, universities, and large businesses. The RIPE NCC and APNIC call them LIRs, a name that describes the job, since each one keeps its own records of which customer has which addresses, while ARIN uses the plainer terms ISP (internet service provider) and end user. The registries also distinguish two kinds of handoff. An allocation goes to an organization that will pass addresses on to its customers, as a provider does, and an assignment goes to an organization that will use the addresses in its own network. Whois records show which kind each block is, as the example lookups later in this guide do, and a block that arrived as an allocation often shows smaller assignments inside it, one for each business customer that received a slice.

At the bottom of the chain sits your own internet connection. When your home router connects, your provider's equipment gives it one public IPv4 address using DHCP (Dynamic Host Configuration Protocol), the same automatic method your router then uses to give private addresses to your laptop and phone, which our guide to DHCP, static addresses, and reservations walks through. On most home plans that public address is dynamic, meaning it can change from time to time, often after a power cut or a router restart, and a fixed, or static, address costs extra or comes only with a business plan. Your router then uses NAT (Network Address Translation) to let every device in the house share that single address, as our NAT explainer describes. Many providers now go a step further with CGNAT (carrier-grade NAT), sharing one public address among many customers, and a router behind CGNAT receives an address from 100.64.0.0/10, a range set aside for exactly that purpose, which our guide to addressing for VPNs (virtual private networks) and overlay networks discusses.

Providers that support IPv6 also give your router an entire block of IPv6 addresses, usually a /56 or a /64, through a DHCP feature called prefix delegation. A single /64 holds about 18 quintillion addresses, so every device in the house can have a public address of its own with no sharing required, and our guide to IPv6 address planning explains why IPv6 hands out space so freely. Businesses that need fixed public addresses, for a mail server or a VPN gateway, usually lease a small static block from their provider, such as a /29. That block holds eight addresses, and after the first and last addresses and the provider's router take their share, five are left for the business, a count our free subnet calculator works out for any block size.

Addresses from a provider stay with that provider. Engineers call them PA (provider-aggregatable) space, because the provider announces its whole block to the rest of the internet as a single route, which keeps the internet's routing tables small, as our guide to supernetting and route summarization explains. Trouble comes when a business changes providers: it hands the old addresses back and moves every server, firewall rule, and partner's list of trusted addresses to new ones, the project our playbook for renumbering a network without downtime covers. Organizations that can't tolerate that disruption, such as hosting companies, banks, and large enterprises, get PI (provider-independent) space directly from their regional registry and keep it no matter which providers they use. PI space brings its own responsibilities, because the organization has to announce the block to the internet itself, and that requires a network ID number of its own.

The registries ran out of fresh IPv4 addresses years ago. On February 3, 2011, IANA gave its last five /8 blocks to the RIRs, one each, and the regional supplies drained after it: APNIC reached its final block in April 2011, the RIPE NCC reached its final block in September 2012 and ran out entirely in November 2019, and ARIN emptied its free pool in September 2015, with LACNIC and AFRINIC rationing their last blocks in the years that followed. A new organization today generally joins a waiting list for a small block or buys addresses from an organization with spares. The RIRs permit those sales, called transfers, as long as the buyer qualifies and the registry records the change, and brokers now run a steady market in which a single IPv4 address has sold for tens of dollars in recent years, putting a /24 of 256 addresses into the thousands. Those prices explain MIT's sale, and they explain why AWS (Amazon Web Services), the largest cloud provider, began charging customers for every public IPv4 address in February 2024, at half a cent an hour, about $3.65 a month each. NAT, CGNAT, and IPv6 were all designed in large part to work around this shortage.

IPv6 follows the same chain with numbers too large to run short. It has 2 to the 128th power addresses, roughly 340 undecillion, which is 340 followed by thirty-six zeros. IANA gives each RIR a /12 at a time, a provider typically receives a /32 or larger, a business site gets a /48, and a home gets a /56 or a /64. A single provider's /32 holds 65,536 /48s, enough to give that many business sites a generous block apiece, which is why IPv6 registries hand out space so readily and why IPv6 addresses have essentially no resale value.

The same registries hand out a second kind of number. The internet is a patchwork of tens of thousands of independently run networks, called autonomous systems, belonging to internet providers, cloud companies, universities, and large businesses, and each one holds an ASN (autonomous system number), the ID it uses when it tells other networks which addresses it can deliver. Networks swap that information using BGP (Border Gateway Protocol), and every announcement carries the ASN of the network that made it, so Google's network shows up as AS15169, Cloudflare's as AS13335, and the network of Quad9, which runs another public DNS resolver, as AS19281. IANA gives the RIRs ASNs in batches, and the RIRs give them to members, usually to organizations that connect to two or more providers at once. Your home internet provider has one, and you almost certainly don't need one. The original format allowed only 65,536 ASNs, so since 2007 the registries have issued numbers in a longer format with room for about 4.3 billion, and a few ranges, such as 64512 through 65534, are reserved for private use inside a company's own network, much as 192.168.0.0/16 is for addresses. Our guide to reading traceroute output shows how to put an ASN to each router along a path.

The registry records who holds a block, BGP shows which network announces it, and the two usually match. 1.1.1.1 shows they can differ: APNIC's research group holds 1.1.1.0/24, and by agreement Cloudflare's AS13335 announces it, an arrangement the whois record spells out in its description field, “Routed globally by AS13335/Cloudflare.” BGP itself has no way to stop a network from announcing addresses it doesn't hold, whether by typo or on purpose, and such hijacks have knocked major websites offline and rerouted traffic through strangers' networks. The registries' answer is RPKI (Resource Public Key Infrastructure), a system of digital certificates that proves who holds each block and lets the holder publish which ASN may announce it. Many large networks now check those signed statements and discard announcements that contradict them.

Every link in that chain is public, and whois is the way to read it. Whois dates to 1982, which makes it one of the oldest services still running on the internet, and each RIR runs a whois server that answers questions about the blocks in its region. On macOS and Linux, the whois command asks those servers directly, and Windows has no built-in equivalent, so Windows users can run the same lookups with our free whois tool in a browser. Following 8.8.8.8, Google's public DNS resolver, down the chain takes two questions, and these are the answers IPCraft's server received, trimmed to the lines that matter.

Follow 8.8.8.8 from IANA to its holder

# Question 1: which regional registry handles this block?
whois -h whois.iana.org 8.8.8.8

inetnum:      8.0.0.0 - 8.255.255.255
organisation: Administered by ARIN
status:       LEGACY
changed:      1992-12

# Question 2: who holds the address?
whois -h whois.arin.net 8.8.8.8

CIDR:           8.8.8.0/24
NetName:        GOGL
NetType:        Direct Allocation
Organization:   Google LLC (GOGL)
RegDate:        2023-12-28
OrgAbuseEmail:  [email protected]

IANA's answer says the whole 8.0.0.0/8 block is legacy space, first recorded in December 1992, five years before ARIN existed, and that ARIN administers it today. ARIN's answer says Google holds 8.8.8.0/24, the 256 addresses from 8.8.8.0 to 8.8.8.255, as a direct allocation from the registry. The registration date records when ARIN created the current entry, which can trail real use by years, since Google launched its public DNS service at 8.8.8.8 in 2009. For most people, the most useful line comes last. If an address is attacking your server, flooding your website, or sending you spam, the abuse contact in its whois record is where to report it, and Google's full record adds comments pointing to its web forms for abuse and legal requests.

Most whois programs, including the whois command on macOS and Linux, follow that referral on their own, so typing whois 8.8.8.8 goes straight to ARIN's answer. Our whois tool does the same and pulls out the block, network name, organization, and abuse contact. It also handles domain names, showing the registrar, creation and expiry dates, and name servers, and for an address it links straight to an ASN lookup and a reverse DNS lookup. A newer protocol, RDAP (Registration Data Access Protocol), returns the same registry data in a structured format over the web, and the registries have been moving to it; ARIN's full reply includes links to its RDAP pages for anyone who wants the machine-readable version.

An ASN lookup answers the other question: which network announces an address. Our free ASN lookup tool uses a mapping that Team Cymru, an internet security research company, publishes for anyone to use, and asking about three well-known public DNS resolvers from IPCraft's server returned these results.

The Country column shows where the block's holder registered it, which explains why 1.1.1.1 says Australia even though the machine that answered sat a millisecond away in Virginia. The Registry column names the RIR that keeps the record, the Date column shows when that registry recorded the block, and the Announced block column shows the range as it appears in BGP, which can be larger or smaller than the block in the whois record. The ASN and network name identify who actually carries the traffic, and for most addresses they match the whois holder. For 1.1.1.1 they don't, and only the two lookups together tell the whole story.

Neither lookup reveals where a machine physically sits. A whois record lists the holder's mailing address, which for a large network can be a headquarters thousands of kilometers from the equipment, and an address announced from hundreds of cities at once has no single location at all, as our guide to anycast explains. The IP geolocation services that guess a visitor's city build their guesses partly from these same records, which is one reason they so often place people in the wrong town. Lookups also stop at the provider. A whois search on a home internet address shows the provider that holds the block, sometimes with a city-level label, and only the provider's own records connect an address at a given moment to a particular subscriber. Providers release that connection only under legal process, such as a court order, so a lookup on a typical home address shows the provider's name and nothing about the people living there, although businesses with static blocks sometimes appear by name in their provider's whois entries.

Within those limits, the lookups answer practical questions quickly. When a single address hammers your login page, whois tells you which provider or company to contact, and the ASN tells you whether the traffic comes from a home connection, a hosting company, or a cloud provider. When a traceroute crosses an unfamiliar router, an ASN lookup names the network it belongs to. When someone offers to sell or lease you a block of addresses, the current whois record and the block's RPKI entries show whether the seller really holds it, and our blacklist checker shows whether its previous user left it on spam blocklists. And when reverse DNS for your own addresses won't update, the whois record shows whether the registry delegated it to you or to your provider, the kind of mismatch our guide to keeping DNS in sync with your IP inventory covers.

For a business, the chain belongs in its own records as well as the registry's. Every public block you hold came from somewhere, and the details that matter during an outage or a provider switch rarely live in one place: which provider or registry issued the block, whether it's PA or PI space, the contract and circuit ID (the provider's reference number for the connection) it depends on, the ASN that announces it, whether an RPKI authorization exists, and who handles abuse reports. In IPCraft, an IPAM (IP address management) system, record each public block as a subnet, untick Track IP usage on any block you carve into smaller pieces so it serves as a container, and add custom fields for the issuer, circuit ID, and announcing ASN. When the day comes to change providers, a search on the old block lists every address that has to move, and our concepts guide covers subnets, containers, and custom fields in more detail.

Back at 1.1.1.1, the three answers from the opening now fit together. IANA gave the whole 1.0.0.0/8 block to APNIC in January 2010. The address drew torrents of junk traffic, because people had used 1.1.1.1 as a placeholder in software and network settings for years, so APNIC assigned 1.1.1.0/24 to its research lab to study the flood, and in 2018 the lab partnered with Cloudflare, whose AS13335 announces the block from hundreds of cities. The copy nearest Ashburn answered the ping. Every public address you come across has a chain like that behind it, and a whois lookup and an ASN lookup will read it to you in seconds.