Reserved and Special-Purpose IPv4 and IPv6 Ranges
A special-purpose IP address belongs to a block reserved for a particular job. Common examples include private networks, loopback communication, documentation, testing, multicast, and Internet protocols—the rules devices follow to exchange information. These addresses can be valid in the right context, but they do not all behave like ordinary public Internet addresses.
This guide includes every block listed in the following Internet Assigned Numbers Authority (IANA) registries when checked in August 2026: the special-purpose IPv4 and IPv6 registries. It also covers a few deprecated IPv6 address-space blocks and multicast because they commonly appear in packet captures and logs. The links in each table open IP Lens result pages for each CIDR block. Use the linked page to see how IP Lens labels the range, then read the flags and log note to understand why the result should be handled differently from ordinary public address space.
Which special-purpose ranges appear most often?
| Purpose | Common blocks | What it usually means |
|---|---|---|
| Private IPv4 | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | Local addressing behind a router or firewall, not a public client identity. |
| Carrier-Grade NAT sharing | 100.64.0.0/10 | Provider-internal shared space. Matching public traffic to a customer needs connection details and a precise time. |
| Loopback | 127.0.0.0/8, ::1/128 | The local host itself, not another device or remote Internet client. |
| Link-local | 169.254.0.0/16, fe80::/10 | Communication limited to one local network link. |
| IPv6 unique local | fc00::/7 | Private-like IPv6 addressing for local or limited connected sites. |
| Documentation | 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32, 3fff::/20 | Examples and tests, not normal public endpoints. |
| Multicast | 224.0.0.0/4, ff00::/8 | A group destination, not one unicast host or client identity. |
For exact RFC 1918 boundaries, examples, and common lookalikes, see Private IP Address Ranges: 10/8, 172.16/12 and 192.168/16.
How should I read the IANA flags?
Globally reachable follows the IANA flag for whether a datagram addressed to the block may be forwarded beyond a specified administrative domain. A Yes does not guarantee that a route exists or that a host will answer. A No does not make the address invalid inside its intended local or protocol-specific context.
Source valid follows the IANA flag for whether a packet traveling between two devices may legitimately carry an address from this block in its source field. That is not the same as saying the address is a normal public client IP. Private, shared, link-local, transition, and documentation blocks still need log-specific interpretation.
Destination valid says whether a packet traveling between two devices may legitimately carry an address from this block in its destination field. Forwardable says whether a router may forward a packet addressed to the block between its external interfaces. Reserved by protocol says whether the IP protocol itself requires implementations to handle the block specially. Source and destination validity do not imply permission to forward: link-local addresses can be valid on one network link without routers being allowed to forward packets addressed to them onto another link. Nor does either validity flag by itself make a block globally reachable.
N/A means IANA does not publish a Yes or No value for that row. A broad parent row reproduces its own IANA flags; separately listed, more-specific assignments can have different values. By scope on the added multicast row summarizes multicast behavior rather than an IANA special-purpose-registry flag. Always inspect the narrowest matching block.
Which special-purpose IPv4 blocks appear in logs?
| Block | Purpose and log interpretation | IANA flags |
|---|---|---|
| 0.0.0.0/8 |
"This" Network In a log: Initialization or "this network" source space; invalid as an ordinary remote identity. |
|
| 0.0.0.0/32 |
"This Host on This Network" In a log: Placeholder address; not a remote client identity. |
|
| 10.0.0.0/8 |
Private Use (RFC 1918) In a log: Private network address; check real-client IP, proxy, and NAT handling. |
|
| 100.64.0.0/10 |
Shared Address Space - CGN (Carrier-Grade Network Address Translation) In a log: Provider-side sharing. Record the source port (a number that helps direct traffic to the right application at an IP address), protocol (such as TCP or UDP), and exact event time. |
|
| 127.0.0.0/8 |
Loopback In a log: Local host only; not a remote Internet client. |
|
| 169.254.0.0/16 |
Link-Local In a log: Local segment only; often an interface, proxy, or logging artifact. |
|
| 172.16.0.0/12 |
Private Use (RFC 1918) In a log: Private network address; check real-client IP, proxy, and NAT handling. |
|
| 192.0.0.0/24 |
IETF (Internet Engineering Task Force) Protocol Assignments In a log: IANA assigns No to this parent row; narrower assignments listed below have their own flags. |
|
| 192.0.0.0/29 |
IPv4 Service Continuity Prefix In a log: Protocol helper space; use only when a standards-defined mechanism is expected. |
|
| 192.0.0.8/32 |
IPv4 Dummy Address In a log: Dummy source address; not a reachable remote endpoint. |
|
| 192.0.0.9/32 |
Port Control Protocol (PCP) Anycast In a log: Standards anycast service; treat as protocol infrastructure. |
|
| 192.0.0.10/32 |
Traversal Using Relays around NAT (TURN) Anycast In a log: Relay discovery service; treat as protocol infrastructure. |
|
| 192.0.0.170/32, 192.0.0.171/32 |
NAT64/DNS64 Discovery In a log: Discovery-only addresses; not normal client identities. |
|
| 192.0.2.0/24 |
Documentation (TEST-NET-1) In a log: Example or test address; not normal visitor traffic. |
|
| 192.31.196.0/24 |
Autonomous System 112 (AS112) Service In a log: Anycast infrastructure for reverse DNS zones; not an end-user host. |
|
| 192.52.193.0/24 |
Automatic Multicast Tunneling (AMT) In a log: Multicast transition infrastructure; inspect the exact protocol context. |
|
| 192.88.99.0/24 |
Deprecated 6to4 Relay Anycast In a log: Legacy 6to4 context; do not infer current service behavior. |
|
| 192.88.99.2/32 |
6a44 Relay Anycast Address In a log: Transition relay address; protocol infrastructure rather than a client. |
|
| 192.168.0.0/16 |
Private Use (RFC 1918) In a log: Private network address; check real-client IP, proxy, and NAT handling. |
|
| 192.175.48.0/24 |
Direct Delegation Autonomous System 112 (AS112) Service In a log: Anycast infrastructure for reverse DNS zones; not an end-user host. |
|
| 198.18.0.0/15 |
Benchmarking In a log: Benchmark or lab traffic; not a normal public visitor. |
|
| 198.51.100.0/24 |
Documentation (TEST-NET-2) In a log: Example or test address; not normal visitor traffic. |
|
| 203.0.113.0/24 |
Documentation (TEST-NET-3) In a log: Example or test address; not normal visitor traffic. |
|
| 224.0.0.0/4 |
Multicast In a log: Destination multicast, not a unicast client identity. |
|
| 240.0.0.0/4 |
Reserved In a log: Reserved space; usually spoofed, test, or parser artifact. |
|
| 255.255.255.255/32 |
Limited Broadcast In a log: Local broadcast; not a remote client identity. |
|
Which special-purpose IPv6 blocks appear in logs?
| Block | Purpose and log interpretation | IANA flags |
|---|---|---|
| ::1/128 |
Loopback In a log: Local host only; not a remote Internet client. |
|
| ::/128 |
Unspecified Address In a log: Placeholder address; not a remote client identity. |
|
| ::ffff:0:0/96 |
IPv4-Mapped Address In a log: Internal representation of an IPv4 address; check logging pipeline. |
|
| 64:ff9b::/96 |
Network Address Translation 64 (NAT64) Well-Known Prefix In a log: Translation prefix; compare the IPv6 record with the corresponding translated IPv4 connection. |
|
| 64:ff9b:1::/48 |
Network Address Translation 64 (NAT64) Local-Use Prefix In a log: Translation prefix for local routing policy; not an ordinary client subnet. |
|
| 100::/64 |
Discard-Only Address Block In a log: Discard prefix; usually route-filtering or test context. |
|
| 100:0:0:1::/64 |
Dummy IPv6 Prefix In a log: Dummy source prefix; not a reachable remote endpoint. |
|
| 2001::/23 |
IETF (Internet Engineering Task Force) Protocol Assignments In a log: IANA assigns No to this parent row; narrower assignments listed below have their own flags. |
|
| 2001::/32 |
Teredo In a log: IPv6 transition context; treat as tunnel evidence, not a precise endpoint. |
|
| 2001:1::1/128 |
Port Control Protocol (PCP) Anycast In a log: Standards anycast service; treat as protocol infrastructure. |
|
| 2001:1::2/128 |
Traversal Using Relays around NAT (TURN) Anycast In a log: Relay discovery service; treat as protocol infrastructure. |
|
| 2001:1::3/128 |
DNS-SD Service Registration Protocol Anycast In a log: Service-registration registrar discovery; treat as protocol infrastructure. |
|
| 2001:2::/48 |
Benchmarking In a log: Benchmark or lab traffic; not a normal public visitor. |
|
| 2001:3::/32 |
Automatic Multicast Tunneling (AMT) In a log: Multicast transition infrastructure; inspect the exact protocol context. |
|
| 2001:4:112::/48 |
Autonomous System 112 (AS112) Service In a log: Anycast infrastructure for reverse DNS zones; not an end-user host. |
|
| 2001:10::/28 |
Deprecated Overlay Routable Cryptographic Hash Identifiers (ORCHID) In a log: Deprecated identifier space; not normal visitor traffic. |
|
| 2001:20::/28 |
Overlay Routable Cryptographic Hash Identifiers Version 2 (ORCHIDv2) In a log: Identifier space; treat as protocol context, not a normal public client. |
|
| 2001:30::/28 |
Drone Remote ID Protocol Entity Tags (DETs) In a log: Identifier-tag space; inspect the application context before treating it as a host. |
|
| 2001:db8::/32 |
Documentation (RFC 3849) In a log: Example or test address; not normal visitor traffic. |
|
| 2002::/16 |
6to4 In a log: IPv6 transition context; treat as tunnel evidence, not a precise endpoint. |
|
| 2620:4f:8000::/48 |
Direct Delegation Autonomous System 112 (AS112) Service In a log: Anycast infrastructure for reverse DNS zones; not an end-user host. |
|
| 3fff::/20 |
Documentation (RFC 9637) In a log: Example or test address; not normal visitor traffic. |
|
| 5f00::/16 |
Segment Routing over IPv6 (SRv6) Segment Identifiers In a log: Routing identifier space; treat as infrastructure context. |
|
| fc00::/7 |
Unique Local Address In a log: Private-like IPv6 address; usually internal, proxy, or logging artifact. |
|
| fe80::/10 |
Link-Local Unicast In a log: Local segment only; often an interface, proxy, or logging artifact. |
|
Which deprecated IPv6 blocks can appear in logs?
A few old IPv6 blocks are important when reading legacy logs even though they are not rows in the IANA special-purpose IPv6 registry. IANA lists them in the broader IPv6 Address Space registry because they describe older address architecture, not current special-purpose assignments.
| Block | Status | What it means in a log |
|---|---|---|
| ::/96 | Deprecated IPv4-Compatible IPv6 Prefix. Formerly the IPv4-compatible IPv6 prefix inside the broader ::/8 Reserved by IETF (Internet Engineering Task Force) block; deprecated by the IPv6 addressing architecture. | Usually old software, stale documentation, synthetic data, or a parser that preserved an obsolete IPv4-to-IPv6 representation. |
| fec0::/10 | Deprecated Site-Local Unicast. Reserved by the Internet Engineering Task Force (IETF); deprecated in September 2004 after formerly being the site-local unicast prefix. | Legacy internal addressing. Modern networks should use unique local addresses such as fc00::/7 instead. |
How does IPv6 multicast appear in logs?
Multicast. IPv6 multicast is not listed in the IANA special-purpose IPv6 registry either. The broader IPv6 Address Space registry assigns ff00::/8 to multicast and points to the separate IANA IPv6 Multicast Address Space registry for individual scopes and group assignments.
Multicast addresses identify a group, not one host. They are expected as destinations for neighbor discovery, routing protocols, service discovery, and application multicast. As a remote source in an Internet-facing log, an address in ff00::/8 usually means spoofed input, malformed log data, or a packet field being interpreted as a client address.
How should I read special-purpose addresses in logs?
Private, unique-local, loopback, and link-local addresses are normal inside internal networks but are not globally routable source addresses. If one appears as the remote client in an Internet-facing log, first check proxy headers, load balancer configuration, Network Address Translation (NAT), and whether the application recorded the real client IP.
The unspecified addresses 0.0.0.0 and :: are common in bind configs, APIs, and placeholder values, but they do not identify a remote Internet client. As a remote source, they usually mean missing client data, invalid input, or a logging mistake.
Documentation, benchmarking, multicast, reserved, transition, and limited broadcast blocks usually point to examples, lab traffic, parser tests, misconfiguration, or spoofed input rather than a normal public visitor. Treat them as context, not identity evidence.