What are loopback, link-local and other special-purpose addresses?¶
title: "What are loopback, link-local and other special-purpose addresses?" status: "complete" source_document: "https://docs.google.com/document/d/18gOIySBpt1tXy0iPBkQwTaTA3OYHbAkAGd5g-aWi1uM/edit?usp=drivesdk"
What are loopback, link-local and other special-purpose addresses?¶
Not every IP address represents an ordinary public internet connection or subscriber.
Some address ranges are reserved for particular technical purposes. Recognising them helps prevent investigators from pursuing a provider enquiry that can't identify an external customer connection.
A loopback address refers back to the same device. In IPv4, addresses beginning 127. are reserved for loopback use, with 127.0.0.1 being the most familiar example. In IPv6, the loopback address is ::1.
Traffic sent to a loopback address is intended to remain within the local system. If a log records a loopback address, it may indicate communication between applications or services running on the same machine. It doesn't normally identify an external internet user.
A link-local address is used for communication on the local network link. IPv4 link-local addresses are found within 169.254.0.0/16. They are often assigned automatically when a device can't obtain an ordinary IPv4 configuration. IPv6 link-local addresses use the fe80::/10 range and are a normal part of IPv6 operation.
Link-local addresses aren't ordinarily routed across the wider internet. The same address can appear on many unrelated local networks, so it can't be treated as a globally unique subscriber address without the surrounding network context.
Private IPv4 addresses are also used within local networks. The principal ranges are:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
These addresses may identify a device or interface within a particular household, workplace or venue, but they are reused across countless unrelated networks. An external service will normally see a translated public address instead.
Other special-purpose ranges exist for documentation, testing, network configuration, multicast and communications between particular types of systems. An address from one of these ranges may therefore describe an internal process, reserved value or technical function rather than an active public endpoint.
Context remains essential. Establish which system recorded the address, which field contained it and whether it represented a source, destination, interface, gateway or placeholder. A special-purpose address in a log isn't necessarily an error, but its role must be understood before it is used in an attribution enquiry.
Loopback, link-local, private and other reserved addresses can provide useful information within the system or network where they were observed. They aren't ordinary public subscriber addresses and can't, by themselves, identify an external customer, device or person.