What is an IP address?

An Internet Protocol (IP) address is a numerical identifier assigned to a device or network interface that communicates using the Internet Protocol. IP addresses help networks identify where data comes from and where it needs to go.

Computers, servers, phones, routers, cloud workloads, and other connected systems use IP addresses to communicate across networks. Much like a mailing address helps identify where a package should be delivered, an IP address helps network traffic reach the correct destination.

IP addresses are a fundamental part of how the internet and modern networks operate. They are also important to cybersecurity because security teams use IP addresses to understand network communication, identify suspicious activity, control access, and investigate potential threats.

Key Takeaways

• An IP address (Internet Protocol address) is a numerical identifier that allows devices, servers, and applications to communicate and exchange data across networks.
• The two main versions of IP addresses are IPv4 and IPv6. IP addresses can also be public or private, and static or dynamic, depending on how they are assigned and used.
• IP addresses play an important role in cybersecurity. Security teams use them to monitor network traffic, identify suspicious connections, investigate potential threats, and understand communication between workloads and applications.
• IP addresses alone cannot establish trust or prevent cyberattacks. Organizations need network visibility, Zero Trust security principles, and segmentation to restrict unauthorized communication, detect potential lateral movement, and contain breaches.

How does an IP address work?

When devices communicate across an IP network, information is divided into packets. These packets contain addressing information that helps network devices determine where the data should go.

Each packet typically includes a source IP address and a destination IP address:

• The source IP address identifies where the packet originated.
• The destination IP address identifies where the packet is going.

Routers and other networking infrastructure use this information to forward packets toward their destination.

For example, when you request a webpage, your device sends network traffic toward the server hosting that website. IP addressing allows the network to route the request to the server and return the requested information to the appropriate destination.

What does an IP address look like?

The format of an IP address depends on whether it uses Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6).

An IPv4 address consists of four decimal numbers separated by periods, such as 192.0.2.1.

Each section can contain a value from 0 to 255.

An IPv6 address is longer and uses hexadecimal values separated by colons, such as 2001:db8::1.

IPv6 was introduced in part because the number of devices connected to the internet eventually exceeded the practical supply of available IPv4 addresses.

What is the difference between IPv4 and IPv6?

IPv4 and IPv6 are two versions of the Internet Protocol used to identify devices and route network traffic.

IPv4 uses 32-bit addresses, providing approximately 4.3 billion possible addresses. The rapid growth of the internet and connected devices created a need for a much larger address space.

IPv6 uses 128-bit addresses, allowing for an enormously larger number of unique addresses.

The primary differences include:

• Address size: IPv4 uses 32-bit addresses, while IPv6 uses 128-bit addresses.
• Format: IPv4 uses decimal numbers separated by periods. IPv6 uses hexadecimal characters separated by colons.
• Address availability: IPv6 provides substantially more addresses than IPv4.
• Network configuration: IPv6 includes features designed to simplify certain aspects of network configuration and routing.

Many organizations currently operate environments that support both IPv4 and IPv6.

What is a public IP address?

A public IP address is an IP address that can be used to communicate across the public internet.

Internet service providers and cloud providers can assign public IP addresses to internet-facing systems and networks. Public addresses allow external devices and services to locate and communicate with those resources.

Because public IP addresses can be reachable from outside an organization's internal network, internet-facing systems need appropriate security controls to reduce exposure to unauthorized access and cyberattacks.

What is a private IP address?

A private IP address is used for communication within a private network and is not directly routable across the public internet.

Private IP addresses are commonly assigned to devices such as employee computers, servers, printers, and internal applications.

IPv4 reserves specific address ranges for private networks:

• 10.0.0.0 through 10.255.255.255
• 172.16.0.0 through 172.31.255.255
• 192.168.0.0 through 192.168.255.255

Organizations can reuse these private address ranges within their own networks because the addresses are not globally unique on the public internet.

What is the difference between a public and private IP address?

A public IP address is globally routable and can be used to communicate across the internet. A private IP address is designed for use within an internal network.

Devices using private IPv4 addresses commonly access the internet through a router or firewall using Network Address Translation (NAT). NAT can translate private addresses into a public address when traffic leaves the internal network.

Private IP addressing helps organizations build internal networks without requiring a unique public IPv4 address for every connected device.

However, a private IP address should not be considered a security control by itself. Organizations still need appropriate access controls, segmentation, monitoring, and other protections for systems using private addresses.

What is a static IP address?

A static IP address remains consistent rather than changing automatically over time.

Static addresses are often used for resources that need to be reliably located at the same network address, such as servers, network infrastructure, or other systems that require predictable connectivity.

Static IP addresses can simplify some network configurations and access-control rules. However, they also require proper management to prevent configuration errors and unauthorized access.

What is a dynamic IP address?

A dynamic IP address can change over time and is typically assigned automatically.

Networks commonly use the Dynamic Host Configuration Protocol (DHCP) to assign IP addresses to devices when they connect. Instead of manually configuring an address for every device, DHCP can automatically provide an available address and other network configuration information.

Dynamic addressing simplifies IP address management, especially in environments where devices frequently connect and disconnect.

What is the difference between an IP address and a MAC address?

An IP address and a Media Access Control (MAC) address both help identify devices, but they operate differently.

An IP address is a logical network address used to route traffic between networks. It can change depending on where and how a device connects.

A MAC address is associated with a network interface and is primarily used for communication within a local network segment.

In simple terms, an IP address helps determine where network traffic needs to go across IP networks, while a MAC address helps devices communicate on a local network.

What is a subnet?

A subnet, or subnetwork, is a smaller logical division of an IP network.

Subnetting allows organizations to divide larger networks into smaller network ranges. This can improve network organization, routing efficiency, and address management.

For example, an organization might use different subnets for employees, servers, applications, or locations.

However, subnetting and network segmentation are not necessarily the same thing. Creating different IP subnets divides a network logically, but effective security segmentation also requires policies that control which systems are permitted to communicate across those boundaries.

What is an IP address used for in cybersecurity?

Security teams use IP addresses to understand and control network activity.

IP address information can help teams:

• Identify communication between devices and workloads
• Investigate suspicious network connections
• Create network access and firewall rules
• Identify potentially malicious sources or destinations
• Monitor internet-facing systems
• Analyze security logs and network traffic
• Understand application and workload dependencies
• Detect unexpected communication patterns

For example, a connection from a workload to an unfamiliar external IP address could warrant further investigation. Likewise, unexpected traffic between internal IP addresses may indicate unauthorized lateral movement.

However, an IP address alone does not always reliably identify a specific person, device, or threat. Addresses can be shared, reassigned, translated through NAT, routed through proxies or VPNs, and changed over time. Security teams should therefore evaluate IP information alongside additional context.

Can an IP address be a security risk?

An IP address itself is not inherently dangerous, but exposed or poorly protected systems associated with an IP address can create security risks.

Attackers routinely scan internet-accessible IP ranges to discover systems, open ports, exposed services, and potential vulnerabilities. Once attackers identify an accessible system, they may attempt to exploit vulnerabilities or compromised credentials to gain access.

Organizations can reduce these risks by limiting unnecessary exposure, closing unused ports, applying strong access controls, patching vulnerabilities, monitoring network traffic, and restricting communication between systems.

Can attackers hide or spoof an IP address?

Attackers can use several techniques to disguise the origin of network traffic.

For example, attackers may route traffic through proxies, VPNs, compromised systems, or other infrastructure to obscure their original IP address.

IP spoofing is another technique in which an attacker alters the source IP address contained in network packets. Spoofing can be used in certain denial-of-service attacks and other malicious activity.

Because IP addresses can be manipulated or obscured, security teams should not rely on IP addresses alone to determine the identity or trustworthiness of a user or device.

How do IP addresses relate to Zero Trust security?

Traditional network security often treated network location as an indicator of trust. A system located inside the corporate network might have been considered safer than one connecting from outside it.

Segmentation takes a different approach.

Under a Zero Trust model, being connected from a particular IP address or internal network does not automatically make a user, device, application, or workload trustworthy. Access should instead be explicitly authorized based on identity, context, policy, and least-privilege principles.

Network controls can then restrict which systems are allowed to communicate, regardless of whether they use internal or external IP addresses.

IP addresses and lateral movement

IP addresses play an important role in understanding how attackers move through networks.

After compromising an initial system, attackers often attempt to discover and connect to other IP addresses within the environment. This process can help them find additional workloads, applications, databases, or other valuable resources.

This behavior is known as lateral movement.

Visibility into IP-based communication can help security teams understand which systems are connecting, identify unusual traffic, and determine where unnecessary communication pathways exist.

Segmentation can then restrict those pathways so that compromising one IP-connected system does not automatically give an attacker access to everything else around it.

How Illumio uses IP addresses to help contain breaches

Illumio helps organizations understand and control communication between workloads, applications, and environments.

Illumio provides visibility into how systems communicate across hybrid and multi-cloud environments. Network information, including IP-based communication, helps security teams visualize dependencies and identify connections that may create unnecessary risk.

Teams can then use Illumio Segmentation to enforce least-privilege communication and limit which resources can connect to one another.

If an attacker compromises a workload, these controls help restrict the network pathways available for lateral movement. Instead of relying on an IP address or network location as proof of trust, organizations can enforce policies that explicitly define which communication should be allowed.

This helps organizations reduce their attack surface and contain breaches before they spread to additional critical systems.

Turn IP Traffic Into Actionable Security Insights

Knowing which IP addresses are communicating is only the beginning. Security teams also need to understand which connections are normal, which create risk, and which could signal an active threat.

Illumio Insights helps teams visualize traffic across their environment, identify risky connections and potential lateral movement, and prioritize threats before they spread.

See how Illumio Insights can help you detect risk and stop threats from moving across your environment.

Explore Illumio Insights →

Frequently asked questions

What is an IP address in simple terms?

An IP address is a numerical address that helps identify a device or network interface and allows data to reach the correct destination across an IP network.

What does IP stand for?

IP stands for Internet Protocol. Internet Protocol defines rules for addressing and routing data between devices across interconnected networks.

What are the two types of IP addresses?

IP addresses can be categorized in several ways. The two current Internet Protocol versions are IPv4 and IPv6. Addresses can also be described as public or private and static or dynamic depending on how they are used and assigned.

What is IPv4?

IPv4, or Internet Protocol version 4, uses 32-bit IP addresses typically written as four decimal numbers separated by periods. An example is 192.0.2.1.

What is IPv6?

IPv6, or Internet Protocol version 6, uses 128-bit addresses and provides a much larger address space than IPv4. It was developed in part to address the limited number of available IPv4 addresses.

Is an IP address unique to one device?

Not always. Public IP addresses can be shared by multiple devices through technologies such as NAT, while dynamic IP addresses may be reassigned over time. An IP address therefore should not automatically be treated as a permanent identifier for a specific device or user.

Can someone identify you from your IP address?

An IP address can reveal information about a network connection, such as the internet service provider and an approximate geographic area, but it generally does not reveal a person's exact physical location or identity by itself.

What is the difference between an IP address and a subnet?

An IP address identifies an interface on an IP network. A subnet defines a range of IP addresses that belong to the same logical network segment.

Why are IP addresses important for cybersecurity?

IP addresses help security teams understand where network traffic originates and where it is going. Monitoring IP-based communication can help identify suspicious connections, investigate incidents, enforce security policies, and detect potential lateral movement.

‍