IP address

An IP address is the identifier assigned to a device connected to a network, which is what makes it possible to route data to it and from it.

Addresses are the unit almost everything in network security is expressed in: firewall rules, access control lists, block lists, log entries and the majority of threat intelligence feeds.

Understanding what they do and do not guarantee is what stops a rule set from being confidently wrong.

What characterises them

Identifying devices. Every device on a network, whether a laptop, a phone or a server, is assigned an address so that it can be reached and can reach others.

IPv4 and IPv6. There are two versions in use. IPv4 uses 32-bit addresses and is still the majority of what is deployed, but the supply ran out, which is why IPv6, with 128-bit addresses, has been rolling out for years.

Routing. Addresses are what let packets travel from source to destination across networks that have no other knowledge of each other.

What they do not guarantee

They are not proof of origin. The source address of a packet is written by the sender. Nothing in the protocol verifies it, which is what makes spoofing possible and what makes reflection and amplification attacks work, particularly over UDP.

They are not an identity. Addresses are shared, translated, reassigned and reused. Behind one public address there may be a whole office; behind one office there may be many public addresses over the course of a day. Treating an address as a person is a mistake that shows up in both incident investigations and privacy assessments.

They are visible. The information associated with an address, including approximate location, raises privacy questions, and in the EU an address can be personal data depending on what else it can be combined with.

They are the first thing enumerated. Address ranges are what an attacker scans, which is the beginning of reconnaissance, and knowing your own ranges better than an outsider does is the counterpart to that.

A worked example

A web server has the address 192.168.1.100 on an internal network.

When somebody opens the site in a browser, a request is routed to that address, and the responses come back the same way.

The address is the label that makes the exchange possible. It says where, and it says nothing at all about who.

Why rules written only in addresses age badly

Two practical consequences follow, and both are ordinary rather than exotic.

The first is that a packet filter written purely in addresses and ports is blind to anything arriving on a port that is already permitted, which today is most things.

The second is that in a cloud or container environment addresses are ephemeral. A rule that trusts an address trusts whichever workload holds it now, and that is a different workload from the one it was written for. That is the practical argument for identity-based controls rather than network-location-based ones, and it is the whole premise of zero trust.

Where to read more

ARIN, IP addressing and subnetting for new users: a straightforward guide to how addresses are allocated and used.

RIPE NCC, IPv6 basics: the key differences from IPv4 and why the transition matters.