Table of Contents
Introduction
IP addressing is the system that gives every device on a network a unique numerical label so that data can be sent to and from it. In Linux system administration, understanding IP addresses is essential, because you will often configure them, read them from tools, and troubleshoot connectivity problems.
This chapter focuses on what an IP address is, how it is structured, and what kinds of addresses you are likely to see and use on Linux systems. Broader topics such as routing and subnets are covered in their own chapters in this section, so this text will only introduce what is specific to the address itself.
IPv4 address structure
The most common type of IP address is IPv4. An IPv4 address is a 32 bit number. It is usually written in dotted decimal notation, which splits the 32 bits into 4 groups of 8 bits, called octets. Each octet is written as a decimal number from 0 to 255, separated by dots, for example 192.168.1.10.
In binary, you can think of an IPv4 address as
$$
\text{IPv4 address} = b_{31}b_{30}\dots b_1b_0
$$
where each $b_i$ is a bit that is either 0 or 1, and the whole sequence has 32 bits. The dotted decimal form is simply a convenient human representation of those bits.
Each host connected to an IPv4 network interface normally has at least one IPv4 address assigned. A Linux machine can have multiple IPv4 addresses, and sometimes an interface has several addresses at once. When you inspect network configuration on Linux, for example with ip addr, you will see IPv4 addresses in this dotted decimal form, along with their subnet information, which belongs to another chapter.
Network and host parts
Every IPv4 address is split logically into two parts. One part identifies the network, and the other identifies the host within that network. The exact split is controlled by the subnet mask or prefix length, which is part of subnetting and routing. Here, it is enough to recognize that the same dotted IP number can be interpreted differently depending on its associated prefix.
For example, the address 192.168.1.10 might have a prefix of /24 or /16. In both cases, the underlying 32 bit address is the same, but the boundary between the network bits and host bits moves. Linux tools will always show the address together with its prefix length so you know how it is used in the network.
The important idea is that the network portion is how routers see groups of addresses, and the host portion distinguishes individual devices inside that group.
Special IPv4 address types
Some IPv4 addresses are reserved for specific purposes and behave differently from ordinary addresses. When administering Linux systems, you will meet these regularly, especially the loopback and private ranges.
Loopback address
Every Linux system has a loopback interface, usually called lo. It uses IP addresses in the 127.0.0.0/8 range, most commonly 127.0.0.1. This is the loopback address, which always refers to the local machine itself.
When a Linux program connects to 127.0.0.1, the traffic never leaves the machine. This is used for local testing, inter process communication, and services that should only be reachable from the same host.
You can see the loopback address with a command such as:
ip addr show loThe loopback interface exists even if the machine has no physical network connection.
Private address ranges
Some IPv4 address blocks are reserved for private use and are not routable on the public internet. They are used by local networks, for example home routers or internal corporate networks.
The common private ranges are:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
Linux hosts in home or office networks usually have an address from one of these ranges, assigned by DHCP or configured manually. To access the internet, a router typically uses NAT to translate these private addresses to a public one.
If you see that your Linux machine has an address like 192.168.1.20 or 10.0.0.5, it is probably on a private LAN.
Link local addresses
IPv4 also has a link local range 169.254.0.0/16. These addresses are used when a host cannot obtain an address from a DHCP server but still wants a temporary address to talk to other machines on the same local segment.
Linux may automatically assign itself an address in this range if DHCP fails. Such an address only works within the directly connected network and cannot be routed.
Broadcast and network addresses
Inside each IPv4 subnet there are often two special addresses. The network address identifies the subnet itself and has all host bits set to 0. The broadcast address has all host bits set to 1 and is used to send a packet to all hosts in the subnet at once.
For example, in a /24 subnet with addresses from 192.168.1.0 to 192.168.1.255, 192.168.1.0 is the network address and 192.168.1.255 is the broadcast address. Regular Linux hosts usually use addresses between these two. How to calculate these addresses in detail belongs to the subnet chapter, but it is useful to know that they exist and that you may see the broadcast address in Linux configuration.
Unspecified address
The IPv4 unspecified address is 0.0.0.0. It does not refer to any particular host. In Linux, you may see it in two common contexts.
First, when a service is listening on all interfaces, it may be shown as bound to 0.0.0.0. That means it accepts connections arriving on any local IPv4 address.
Second, in routing configuration, 0.0.0.0/0 is used as a default route, which means "any IPv4 address." The routing chapter will build on this, but for now, it is important to recognize that 0.0.0.0 and 0.0.0.0/0 have special meanings and are not typical host addresses.
IPv6 address structure
IPv6 is the newer version of the IP protocol and uses 128 bit addresses. The format is very different from IPv4 and uses hexadecimal notation. On Linux systems today, it is common to have both IPv4 and IPv6 addresses.
An IPv6 address is written as eight groups of four hexadecimal digits, separated by colons, for example:
2001:0db8:85a3:0000:0000:8a2e:0370:7334
Each group represents 16 bits. In total, $8 \times 16 = 128$ bits. In binary form, an IPv6 address is
$$
\text{IPv6 address} = b_{127}b_{126}\dots b_1b_0
$$
Hexadecimal digits are used because they map neatly to binary and make long addresses more compact than a decimal representation would.
In practice, IPv6 addresses often contain long sequences of zeros, and there are rules to shorten them. These are important when reading Linux networking tools.
Shortening IPv6 addresses
There are two common rules to compress IPv6 addresses so that they are easier to write and read.
First, any leading zeros in each 16 bit group can be omitted. For example, 0db8 can be written as db8, and 0000 can be written as 0.
Second, a single run of one or more consecutive all zero groups can be replaced with ::. This can only be done once per address.
For example:
Original:
2001:0db8:0000:0000:0000:0000:1428:57ab
Drop leading zeros:
2001:db8:0:0:0:0:1428:57ab
Compress a sequence of zeros:
2001:db8::1428:57ab
When you run ip addr on Linux in a network that supports IPv6, you will usually see these compressed forms. You may also see both a full address and one that looks partially random, because Linux uses automatic address configuration methods that generate parts of the address.
In IPv6, :: by itself represents the address with all 128 bits set to 0. It is the IPv6 unspecified address and is not the same as any particular network prefix.
Common IPv6 address types
Just as with IPv4, some IPv6 addresses have special purposes. When working with Linux systems that use IPv6, you will see several of these.
Loopback address
The IPv6 loopback address is ::1. It is the IPv6 equivalent of 127.0.0.1 and always refers to the local machine.
Programs can bind to or connect to ::1 to test IPv6 functionality locally without using the network hardware.
Unspecified address
The IPv6 unspecified address is ::. It is all zeros and does not identify a specific interface. You may see it when an address is not yet assigned or in configuration to mean "any" address in a certain context.
Global unicast addresses
Most regular IPv6 addresses that work across the internet are global unicast addresses. They usually start with 2 or 3, for example 2001:db8::/32 is a documentation prefix. Linux interfaces that have public IPv6 connectivity will have an address in a global unicast range.
These addresses have a network part and an interface identifier part, similar in concept to the network and host parts in IPv4, though IPv6 uses a different structure. The routing chapter explores the implications, so here it is enough to know that global unicast addresses are routable over the internet.
Link local addresses
Every IPv6 capable interface on Linux automatically gets a link local address in the fe80::/10 range. These addresses only work on the directly connected network segment.
A typical link local address might look like fe80::1234:56ff:fe78:9abc. Linux uses these addresses for neighbor discovery and for some routing operations. They are always present as long as IPv6 is enabled on the interface.
When using link local addresses for communication, IPv6 requires a zone index to say which interface to use, because link local addresses can be reused on multiple interfaces. On Linux, you might see a link local address written with an interface suffix, such as fe80::1%eth0.
Unique local addresses
IPv6 has a concept similar to IPv4 private ranges, called unique local addresses. They live in the fc00::/7 range, commonly in the fd00::/8 part for locally generated addresses.
These addresses are not intended to be routed on the public internet. They are used for internal networks. On Linux, you might see them in enterprise environments or lab networks that use IPv6 internally.
Multicast addresses
IPv6 uses multicast heavily for its internal protocols. Multicast addresses start with ff. For example, ff02::1 refers to all nodes on the local link.
Linux networking tools and logs sometimes show IPv6 multicast addresses when they describe neighbor discovery or other protocol operations. Regular application traffic can also use IPv6 multicast, but that is less common in basic administration tasks.
IP versions and dual stack
Many Linux systems today use both IPv4 and IPv6 at the same time. This is called dual stack. Each network interface can have multiple addresses assigned, for example one or more IPv4 addresses and one or more IPv6 addresses.
When a Linux application connects to a host name, the system resolver may obtain both IPv4 (A records) and IPv6 (AAAA records) addresses. The choice of which one to use can depend on configuration and network conditions.
From an administrator point of view, it is important to recognize which protocol is actually used in a connection, because an address like 192.0.2.10 is IPv4 while 2001:db8::10 is IPv6. Firewall rules, routing, and troubleshooting steps often differ between them.
IP addressing and Linux tools
Although detailed usage of tools belongs in other chapters, it is helpful to connect the theory of IP addressing to what you will observe on a Linux system.
Commands such as ip addr show the addresses assigned to each interface. For each entry, you will see the protocol version, the address, and the prefix length. An example line for IPv4 might look like inet 192.168.1.10/24, and for IPv6 inet6 fe80::1234:56ff:fe78:9abc/64.
Other tools that display connections, such as ss, will list local and remote addresses for sockets in use. There you will see addresses like 0.0.0.0:22 which represents a service listening on all IPv4 addresses on port 22, or [::]:80 which listens on all IPv6 addresses on port 80.
Understanding the numeric format of those addresses, and recognizing special values such as loopback, unspecified, private, or link local, is a key part of reading these outputs and drawing conclusions during troubleshooting.
Address classes and modern practice
Historically, IPv4 used address classes, such as Class A, B, and C, which divided the address space into fixed networks of different sizes. For example, Class A networks started with 0.0.0.0 to 127.255.255.255, and so on.
Modern networking practices have replaced this classful system with Classless Inter Domain Routing, which uses flexible prefix lengths. Linux uses this modern approach. However, you may still encounter references to classes in documentation or legacy material. As a Linux administrator, you only need to interpret addresses in terms of their prefix length, not their class.
Summary
IP addressing assigns numerical labels to devices so that they can send and receive data in a network. IPv4 uses 32 bit dotted decimal addresses such as 192.168.1.10, while IPv6 uses 128 bit hexadecimal addresses such as 2001:db8::1.
Each address is split into a network part and a host or interface part, controlled by prefix length. Some addresses are reserved for special purposes, such as loopback, private, link local, broadcast, and unspecified addresses. Linux systems can use both IPv4 and IPv6 at the same time and assign multiple addresses to a single interface.
Understanding the structure and meaning of these addresses prepares you for the following chapters on subnets, routing, and the practical use of Linux networking tools.