Private / Public IP Classifier – RFC Ranges | NetworkUstad

Not every valid IP address can appear on the public internet. Some ranges are reserved for home and office networks, some for a device talking to itself, some for devices that have not yet found a network, and some for carrier-grade address sharing. Knowing which class an address belongs to changes how you read a log: a private address in an external firewall log means something different from a public one, and a link-local address in a server report usually means a configuration problem. This classifier sorts an address into its RFC class and explains what that class is for, without checking reachability or ownership.

How to Use the Private / Public IP Classifier

1. Type or paste the address to classify.
2. Click Classify.
3. Read the class name and its short explanation.
4. Check the RFC range shown to see exactly why it matched.
5. If the address is public, note that it is routable but not necessarily assigned to anyone.
6. Use the result to interpret the log line or rule that produced the address.

Key Features

• Covers private, loopback, link-local, CGNAT, and public classes.
• Handles IPv4 ranges and common IPv6 special ranges.
• Names the matching RFC range for every verdict.
• Distinguishes CGNAT shared space from ordinary private space.
• Validates syntax first and reports malformed input clearly.
• Runs entirely in the browser; nothing leaves your device.

What the Result Means

Private means the address is for local networks and must never be routed on the public internet; seeing one from outside usually means address translation or a leak is involved. Loopback means the device itself. Link-local means the device assigned its own address because no DHCP server answered, which often signals a network fault. CGNAT means carrier-grade shared space: many customers hide behind it, so it identifies an ISP, not a single subscriber. Public means globally routable in principle, nothing more.

Worked Example

A support ticket reports that a user at 100.71.4.9 cannot be identified from a log. Classifying it gives CGNAT, which means the address belongs to an ISP shared pool, not to one household, so it cannot identify the user alone and the investigation needs a timestamp plus the ISP port data. Classifying 172.16.5.4 gives private, which means it came from inside a local network, while 203.0.113.45 gives public, which is a normal internet address. Each class changes the next step. A public verdict, by contrast, at least tells you the address could in principle be reached from the internet, though it says nothing about who holds it today or whether it is still assigned, so ownership needs a separate lookup.

Best Practices and Tips

• A private address in an inbound internet log deserves a second look at your NAT and firewall rules.
• Link-local addresses on servers usually mean DHCP failed; fix the network, not the application.
• Never publish private addresses in public documentation as if they were reachable examples.
• CGNAT addresses cannot identify an individual user; do not treat them as you would a dedicated public address.
• Combine this with validation: an invalid string has no class at all.

Common Mistakes to Avoid

• Treating a private address as if it were reachable from the internet.
• Confusing CGNAT space (100.64.0.0/10) with ordinary private space.
• Assuming a public address is currently assigned or belongs to a known owner.
• Reading a link-local address as a normal LAN address.

Frequently Asked Questions

What is CGNAT?

Carrier-grade NAT: an ISP shares one public address among many customers using the 100.64.0.0/10 range internally.

Is 192.168.1.1 private?

Yes. It sits inside 192.168.0.0/16, one of the three private IPv4 ranges.

What about ::1?

That is the IPv6 loopback address, the equivalent of 127.0.0.1.

Can a public address be unassigned?

Yes. Public only means the range is routable, not that anyone currently holds that exact address.

Related Tools

• IP Address Validator – Validate syntax before classifying
• IP in CIDR Range Checker – Test whether an address sits inside a CIDR range