What Is the “Last Hop” in Networking?

When you run a traceroute to a website, you see a list of routers (hops) that your data passes through. The last hop is the final router before reaching the destination server. But sometimes, the last hop shows an IP address that doesn’t belong to any known organization – an unassigned IPv4 address. This article explores the mysteries of those unassigned addresses, what lives there, and why they matter.

Understanding unassigned IPv4 addresses requires knowledge of how the internet routes traffic, who controls IP space, and what happens when packets land on addresses that have never been allocated.

How Traceroute Works and What It Shows

Traceroute sends packets with increasing Time‑To‑Live (TTL) values. Each router decrements the TTL; when it reaches zero, that router sends back an ICMP “Time Exceeded” message. The source IP of that message reveals the router’s address. This builds a list of hops.

However, traceroute can only show routers that respond to ICMP probes. Many routers are configured to ignore or filter such probes. Consequently, you may see * * * (timeout) instead of an IP address. In some cases, the responding IP falls into an unassigned IPv4 address block – a range that IANA and RIRs have never allocated to any organization.

Public vs Private IP Addresses – The Basic Split

Before diving into unassigned IPv4 addresses, remember the basic division:

Unassigned addresses are neither public (not allocated) nor private (not reserved). They exist in the IPv4 space but have no owner – at least officially.

What Does “Unassigned IPv4 Address” Actually Mean?

An unassigned IPv4 address is an IP address that IANA (Internet Assigned Numbers Authority) has not yet delegated to any Regional Internet Registry (RIR). In turn, the RIR has not assigned it to an ISP, company, or government. These addresses are like vacant lots in the city of the internet – no buildings, no owners, but the roads still pass by.

Because no legitimate network announces these addresses via BGP, packets sent to an unassigned IPv4 address should theoretically never reach a destination. However, reality is messier. Misconfigured routers, leaky BGP announcements, and intentional monitoring systems can cause traffic to appear on these “dark” addresses.

Who Controls IPv4 Allocation Globally?

The allocation of IPv4 addresses is a hierarchical system:

  1. IANA (Internet Assigned Numbers Authority) manages the global pool of unallocated IPv4 addresses.
  2. IANA delegates large blocks to five Regional Internet Registries (RIRs):
    • ARIN (North America)
    • RIPE NCC (Europe, Middle East, Central Asia)
    • APNIC (Asia Pacific)
    • LACNIC (Latin America and Caribbean)
    • AFRINIC (Africa)
  3. RIRs assign smaller blocks to ISPs, corporations, and other organizations.

When IANA runs out of unallocated addresses, the RIRs have only their remaining pools. As of 2026, the last IANA IPv4 allocations were made in 2011. Today, RIRs have exhausted most of their free pools, leading to a secondary market for unassigned IPv4 addresses (actually previously assigned addresses that are now traded).

The Role of IANA and Regional Internet Registries

IANA’s role in unassigned IPv4 addresses is central. It maintains the master list of which address blocks are reserved, allocated, or unallocated. However, since the IPv4 free pool ran out, IANA no longer has large unassigned blocks. Most so‑called “unassigned” ranges today are either:

The distinction matters for traceroute: an address may be unassigned by IANA but still in use by a network that never registered it properly (e.g., government or military “dark” networks).

Why IPv4 Addresses Are Running Out – The Exhaustion Story

IPv4 uses 32‑bit addresses, providing about 4.3 billion unique addresses. The internet’s explosive growth in the 1990s and 2000s consumed these rapidly. The last major IANA allocations happened in 2011. Since then, each RIR has exhausted its free pool:

After exhaustion, new networks cannot get free unassigned IPv4 addresses from RIRs. They must buy addresses on the secondary market or adopt IPv6. This scarcity makes every IPv4 address valuable – even those that appear “unassigned” in IANA’s database.

IPv4 vs IPv6 Explained Simply

IPv6 was designed to solve the exhaustion problem. It uses 128‑bit addresses, providing 340 undecillion addresses – enough for every grain of sand on Earth. However, adoption is gradual. Most internet traffic still uses IPv4. This creates a hybrid world where unassigned IPv4 addresses continue to be relevant.

When an IPv6‑only device communicates with an IPv4‑only server, translation mechanisms like NAT64/DNS64 come into play. Those translation points can also produce unexpected hops or appear as “last hop” mysteries.

Why Some IP Blocks Appear Empty – Dark IP Space

Vast swaths of the IPv4 address space appear empty. These are ranges that IANA reserved for future use or that RIRs hold but have not assigned. However, “empty” does not mean silent. Researchers have found that unassigned IPv4 addresses receive a surprising amount of traffic – up to thousands of packets per day per IP. This phenomenon is called internet background radiation.

The dark IP space includes:

What Are “Bogon” Addresses?

A bogon is an IP address that should not appear on the public internet because it is unassigned or reserved. Bogon filters are used by network operators to block traffic from such addresses. However, misconfigured routers sometimes send bogons into the wild. When your traceroute hits a bogon address, you have encountered an unassigned IPv4 address in the wild – a clear sign of a routing anomaly or a hidden network.

Bogons include:

Monitoring bogon traffic helps researchers detect route leaks and malicious activity.

Sinkholes and Blackhole Routing Explained

Sometimes, unassigned IPv4 addresses are deliberately used as sinkholes. A sinkhole is a route that directs malicious traffic (e.g., from malware or DDoS attacks) to a dead end, often for analysis. The sinkhole IP may be unassigned or a specially designated “black hole” address.

Blackhole routing (e.g., using 192.0.2.0/24 – the TEST‑NET block) is common. These addresses are unassigned for normal use but actively respond to traffic for monitoring purposes. So, a traceroute hitting an unassigned IP might actually land on a security researcher’s honeypot.

Military and Government Reserved IP Ranges

Several large IPv4 blocks are reserved for the U.S. Department of Defense (DoD) and other military organizations. For example, the entire 6.0.0.0/8 (formerly ARIN‑assigned to the DoD) and 11.0.0.0/8 (DoD) are mostly unannounced or used for internal networks. These addresses are technically “assigned” but not publicly routed. To the outside world, they appear as unassigned IPv4 addresses – dark space with no BGP announcements.

However, some military networks may leak routes accidentally, causing traceroute to show these addresses as last hops. Government agencies also use unannounced ranges for covert operations, satellite communication, and emergency networks.

ISP Internal Routing Infrastructure Hidden from View

Many ISPs have internal routers and switches that use private or unassigned IPv4 addresses for management. These addresses are not advertised to the global BGP table. When you traceroute, you may see these internal hops only if the ISP permits ICMP responses from those interfaces. In many cases, they are hidden, appearing as * * *. But occasionally, an ISP misconfiguration can expose an unassigned IPv4 address used for backbone routing.

CDN Edge Networks and Unused Allocations

Content Delivery Networks (CDNs) like Cloudflare, Akamai, and Fastly own huge IPv4 blocks. They often do not use every single address in their ranges. These unused IPs within allocated blocks are not “unassigned” globally – they are assigned to the CDN – but they may not respond to probes. From a traceroute perspective, you might see a CDN border router and then nothing beyond. That final hop is not truly unassigned but appears as a dead end.

Cloud Providers and Unadvertised Address Blocks

Cloud giants (AWS, Azure, Google Cloud) hold massive IPv4 inventories. They may keep some blocks in reserve for future growth. These blocks are assigned to the company but not advertised. If you traceroute to an address in such a block, you will hit the cloud provider’s border routers but then receive no further responses. The last hop might be an unassigned IPv4 address in the sense of being unused – but legally assigned.

Hidden Enterprise Backbone Systems

Large enterprises (banks, oil companies, retailers) build private WANs using IP addresses from their assigned public blocks. They often do not announce these internal routers to the public internet. Hence, probing such IPs yields no response. In some cases, due to route leaks or misconfiguration, internal backbone systems accidentally respond to traceroute probes from outside, revealing unassigned IPv4 addresses that are actually private infrastructure.

Research Networks Using Unassigned IPv4 Ranges

Academic and research networks sometimes obtain special allocations from RIRs for experimental purposes. These blocks may be listed as “unassigned” in public databases but are actually in use by universities or national labs. For example, the 192.0.2.0/24 block is reserved for documentation and examples, but researchers may use it internally in labs. Hitting such an IP in traceroute suggests you are interacting with a research network’s testbed.

Honeypots and Cybersecurity Traps in Dark IP Space

Cybersecurity researchers deploy honeypots on unassigned IPv4 addresses to lure attackers. These systems simulate vulnerable services and record malicious activity. When a scanner or botnet probes the dark space, the honeypot responds, creating a last hop that was previously silent. Thus, an unassigned IP can suddenly “come alive” for monitoring purposes.

These honeypots are part of a larger practice called internet telescope or darknet monitoring.

Malware Scanning Behavior on Unused IPs

Malware often scans random IP addresses looking for vulnerable services. Because unassigned IPv4 addresses are numerous, malware will inevitably hit them. The traffic directed to these dark addresses is a form of internet background radiation. Researchers use this to detect new malware outbreaks, track botnet command‑and‑control servers, and identify scanning patterns.

Internet Background Radiation Explained

Internet background radiation is the constant, unsolicited traffic that reaches IP addresses not advertised in BGP. It includes:

Studies show that many unassigned IPv4 addresses receive dozens or hundreds of packets per day. Some /8 blocks receive millions of packets per day. This background radiation is a rich source of data for security researchers.

Why Abandoned IPs Still Receive Traffic

Even after a company returns an IP block to the RIR (or simply stops using it), traffic continues to arrive. There are several reasons:

Consequently, an unassigned IPv4 address may never be truly silent.

Misconfigured Devices Hitting Dead Addresses

Network devices sometimes send packets to dead addresses due to misconfigurations. For example, a router with an incorrect default route or a firewall with outdated NAT mappings. These errors contribute to background radiation and can make unassigned IPv4 addresses appear active in packet captures.

Legacy Routers and Forgotten Systems

Many legacy routers, switches, and servers from the 1990s are still running on old networks. They may have static IP addresses that were once assigned but later abandoned. If these devices are still connected (even partially), they can respond to probes. This creates a ghost network where unassigned IPv4 addresses become reachable due to forgotten hardware.

Can Unassigned IPs Still Respond?

Yes, unassigned IPv4 addresses can respond under certain conditions:

However, in a strictly correct internet, an unassigned IP should not respond – all packets should be dropped at the last router with no BGP route. In practice, the internet is far from perfect.

BGP Announcements and Route Leaks

The Border Gateway Protocol (BGP) is the routing protocol that tells the internet how to reach IP prefixes. If an unassigned IPv4 address block appears in BGP (due to a route leak or an accidental announcement), then routers will forward traffic toward that block. The result: packets can reach the intended (or unintended) destination, and traceroute may show a last hop that is technically unassigned.

Route leaks have caused major internet outages, including the 2008 Pakistan YouTube hijack and the 2021 Facebook outage (due to BGP issues).

Ghost Routes and Routing Anomalies

A ghost route is a route that persists in routing tables after it has been withdrawn. These leftovers can cause traffic to be forwarded incorrectly for minutes or even hours. During that window, an unassigned IPv4 address may become reachable. Ghost routes are often caused by router software bugs or configuration errors.

What Happens If You Ping an Unassigned IP?

The result depends on the network path:

Thus, pinging an unassigned IPv4 address often reveals infrastructure routers along the path, even if the final destination does not exist.

Why Traceroute Sometimes Stops Early

Traceroute stops early when intermediate routers stop responding. This can happen for several reasons:

Early termination can obscure the last hop, making you wonder if an unassigned IPv4 address is involved. In reality, the path continues but is hidden.

ICMP Filtering Explained

Internet Control Message Protocol (ICMP) is used for error reporting and diagnostic tools like ping and traceroute. Many network administrators block ICMP to reduce attack surface or prevent network mapping. When ICMP is blocked, traceroute cannot receive “Time Exceeded” messages, resulting in * * * for those hops. This can make unassigned IPv4 addresses appear as silent gaps.

However, ICMP filtering itself can leak information. Some firewalls respond with a generic “administratively prohibited” message, revealing their IP.

Firewalls and Silent Packet Dropping

Most firewalls are configured to drop packets silently (no response) to avoid revealing information about internal networks. When a packet destined for an unassigned IPv4 address hits a firewall that has no forwarding rule, the firewall silently drops it. Thus, traceroute may show a last hop (the firewall’s external interface) and then nothing. That firewall’s IP may be a public address, but the next hop is completely dark.

How ISPs Hide Infrastructure Nodes

ISPs often use MPLS (Multiprotocol Label Switching) to route packets without exposing every router. MPLS tunnels create “invisible” hops – packets travel through a label‑switched path where TTL is not decremented at each internal router. As a result, traceroute shows fewer hops, and the last visible hop might be an aggregation router, not the actual final device.

When combined with unassigned IPv4 addresses used for router management interfaces, the picture becomes even murkier.

MPLS Networks and Invisible Hops

MPLS labels are used to forward packets quickly. Routers in an MPLS core often do not decrement the IP TTL on label‑switched packets. Consequently, traceroute cannot see those hops. The last visible hop before the MPLS tunnel may appear to be an unassigned IPv4 address (if the router’s interface is numbered from an unannounced block). After the tunnel, the destination router appears as a new hop – creating a gap.

Carrier-Grade NAT and Routing Mysteries

Carrier‑Grade NAT (CGNAT) allows ISPs to share one public IP among many customers using private address ranges (e.g., 100.64.0.0/10). This adds complexity to traceroute: the last hop inside the ISP’s network may be a CGNAT gateway that has an address from an unassigned IPv4 address block (like 100.64.0.0/10, which is reserved for CGNAT but not globally routed). Users often wonder why the final hop belongs to this “dark” range.

Tor Exit Nodes and Strange Traffic Paths

The Tor anonymity network routes traffic through multiple encrypted hops. The final node (exit node) connects to the destination website. If you traceroute through Tor (possible with specialized tools), you will see the exit node’s IP as the last hop. That IP may be from a Tor‑operated address block that is not widely advertised, appearing as an unassigned IPv4 address to casual observers.

How Hackers Scan the IPv4 Internet

Attackers regularly scan the entire IPv4 address space for open ports and vulnerabilities. They use tools like zmap or masscan, which can scan the whole internet in under an hour. During these scans, unassigned IPv4 addresses are hit frequently. Security researchers monitor these scans to detect emerging threats and to study scanning trends.

Shodan and Internet-Wide Scanning Explained

Shodan is a search engine for internet‑connected devices. It continuously scans all public IPv4 addresses (including many unassigned IPv4 addresses) and catalogs the services found. When Shodan encounters an unassigned address that responds (due to a honeypot or misconfiguration), it adds that device to its database. Thus, dark IP space is not truly dark from the perspective of industrial scanners.

What Researchers Found in Dark Address Space

Academic and security researchers have made surprising discoveries by monitoring unassigned IPv4 addresses:

The CAIDA internet telescope, for example, records gigabytes of traffic daily from dark IP space, revealing patterns of cyberattacks and global network events.

Spam and Botnet Traffic Targeting Unused IPs

Spammers and botnet operators often use random source IPs or target random destinations. When they target unassigned IPv4 addresses, the traffic goes into the dark. This is why monitoring dark space can help identify new botnet activity: a sudden spike in traffic to a previously quiet unassigned block may indicate a new scanning campaign.

Data Center “Parking” of IP Ranges

Large data centers and cloud providers sometimes “park” IPv4 blocks – they assign them to their internal routing but do not advertise them externally. This allows them to use the space for internal communication without consuming global BGP table space. From the outside, these appear as unassigned IPv4 addresses – unreachable but not truly vacant.

Internet Archaeology and Abandoned Networks

Internet archaeology is the study of old, forgotten networks. Researchers dig through registries and historical routing data to find abandoned IP blocks. These blocks may still contain functional servers from the 1990s, still reachable through stale routes. Visiting such an unassigned IPv4 address is like exploring a digital ghost town.

Cold War Origins of IPv4 Allocations

The initial allocation of IPv4 addresses followed Cold War priorities. The U.S. Department of Defense received massive blocks (e.g., 6.0.0.0/8, 7.0.0.0/8, 11.0.0.0/8, 21.0.0.0/8, etc.). Many of these have never been fully utilized. Today, these blocks are technically assigned but largely unused. To the public internet, they appear as unassigned IPv4 addresses – a legacy of 1980s military planning.

Why the U.S. Government Owns Huge IPv4 Blocks

The U.S. DoD owns over 200 million IPv4 addresses (about 5% of the entire IPv4 space). This includes the 11.0.0.0/8 block (16.8 million addresses) and 30.0.0.0/8 (another 16.8 million). Many of these addresses are not publicly announced, making them functionally unassigned IPv4 addresses for most internet users. The DoD has started to sell or lease some of this space, but vast dark areas remain.

Can You Legally Use Abandoned IPs?

No. Using an IP address that is not assigned to you is a violation of internet regulations and can lead to routing conflicts, legal action, and accusations of IP hijacking. Even if an unassigned IPv4 address appears unused, you cannot simply claim it. The rights belong to the RIR or the original assignee.

However, researchers can monitor dark space passively (listening, not transmitting) without legal issues. Active probing (sending packets) is generally accepted as long as you respect rate limits and do not attempt to exploit services.

IP Hijacking Incidents and BGP Attacks

IP hijacking occurs when an attacker announces a BGP route for an IP block they do not own. This can cause traffic intended for the legitimate owner to be redirected to the attacker. Hijacking often targets unassigned IPv4 addresses because there is no legitimate owner to defend the route. High‑profile hijacks have been used for censorship, fraud, and espionage.

Monitoring dark space helps detect hijacking: if traffic starts flowing to a previously dark address, it may be a sign of a route leak or hijack.

Famous Internet Routing Disasters

Several major routing incidents have involved unassigned IPv4 addresses:

These events show how fragile the routing system is.

Accidental Leaks of Unassigned Address Blocks

Misconfigured routers can accidentally announce unassigned IPv4 address blocks. This is known as a route leak. The leaked routes can attract traffic, overloading the unintended network or creating temporary reachability for dark IPs. Network operators constantly monitor for such leaks.

Cybersecurity Implications of Dark Space

Dark space (unassigned IPv4 addresses) has significant security implications:

Organizations like Team Cymru and CAIDA maintain darknet monitors for these purposes.

How Researchers Monitor Unused IP Ranges

Researchers set up passive monitors on unassigned IPv4 addresses to capture incoming traffic. These monitors do not respond to probes; they simply log packets. By analyzing the source addresses, packet types, and timing, they can infer global scanning activity, track botnet propagation, and identify new vulnerabilities.

The technique is called darknet monitoring or network telescope.

Telescope Networks Explained

A telescope is a block of unused IP addresses that are routed to a monitoring system. Because no legitimate traffic should reach these addresses, any traffic arriving is unsolicited and likely malicious or accidental. Telescopes can be /24 blocks (256 addresses) or even full /8 blocks (16.8 million addresses). The larger the telescope, the more data.

The CAIDA Internet Telescope monitors a large portion of dark IPv4 space and publishes anonymized data for research.

Examples from CAIDA Internet Telescope Research

CAIDA (Center for Applied Internet Data Analysis) operates a network telescope on a formerly unused /8 block. Their findings include:

Their work has been instrumental in understanding the health of the internet.

What Happens When an IP Block Becomes Active Again

When an organization acquires an unassigned IPv4 address block (either through RIR transfer or secondary market) and starts announcing it, the block becomes active. For a period, there may be a surge of traffic due to old scans and stale DNS entries. Researchers observe this as the block transitioning from dark to lit.

IPv4 Black Market and Address Trading

Because IPv4 addresses are scarce, a thriving secondary market exists. Companies buy and sell address blocks, often at prices exceeding $30‑50 per IP. The total value of all unassigned IPv4 addresses (the remaining free pools at RIRs) is small. Most trading involves previously allocated blocks. However, some unassigned IPv4 addresses held by RIRs as reserves could eventually be sold.

Billion-Dollar Value of IPv4 Scarcity

The total market value of all IPv4 addresses is estimated at $10‑15 billion. Large blocks (e.g., a /16 with 65,536 addresses) can sell for millions of dollars. This scarcity drives interest in dark space – some have tried to claim unassigned addresses to profit. Legitimate transfers require RIR approval.

Why Companies Still Buy IPv4 Instead of IPv6

Despite IPv6 being available for over two decades, many companies stick with IPv4 because:

Consequently, unassigned IPv4 addresses remain valuable, even those that are technically unallocated.

Could Hidden Services Exist on Dark IPv4 Space?

Theoretically, yes. If an organization sets up a private network using unassigned IPv4 addresses and uses a tunnel (VPN) to connect, those services would be hidden from the public. They would not respond to public traceroute probes. Thus, dark IPv4 space could host secret servers – though the lack of BGP announcements would make them unreachable from the normal internet.

Conspiracy theories sometimes claim that government or corporate black sites operate on such addresses.

Myths and Conspiracy Theories About Unused IPs

Over the years, various myths have emerged about unassigned IPv4 addresses:

While entertaining, most of these lack evidence. However, it is true that some unassigned blocks are used by intelligence agencies for covert operations – though details are classified.

“Dead Internet” Theory Connections

The Dead Internet Theory suggests that most online traffic is now generated by bots and AI, not humans. Monitoring dark space supports this in a small way: a significant portion of background radiation comes from automated scanners, malware, and content scrapers. However, the theory is widely disputed.

How Governments Monitor Unused Address Space

Governments, like private researchers, operate darknet telescopes. For example, the U.S. Department of Homeland Security has monitored bogon space for cybersecurity intelligence. Such monitoring helps detect cyber threats early, without interfering with normal traffic.

Can Abandoned IPs Reveal Cyberattacks Early?

Yes. A sudden increase in traffic to a previously quiet unassigned IPv4 address can signal the start of a DDoS attack or the release of new malware. By watching dark space, security teams can get hours or days of warning before the attack hits production networks.

Beginner Guide to Reading Traceroute Results

For newcomers, here is a quick guide:

Use traceroute -I (ICMP) or traceroute -T (TCP) to see different responses.

Tools to Explore IP Ranges Safely

If you want to explore unassigned IPv4 addresses safely (without causing harm), use:

Never actively scan large ranges unless you have permission; this may be considered an attack.

Ethical Considerations When Scanning IPs

Probing unassigned IPv4 addresses is generally considered harmless because no legitimate service should be there. However, ethical guidelines include:

Researchers should coordinate with RIRs and network operators when conducting large‑scale darknet monitoring.

Final Theory – What Truly Lives on Unassigned IPv4 Addresses?

So, after this deep dive, what truly lives on unassigned IPv4 addresses?

The last hop of a traceroute may never be fully known. The internet is a system of agreements and approximations. Unassigned IPv4 addresses are the empty lots, the abandoned buildings, and the secret basements of the digital world. They are silent, but not empty. They receive the stray packets of a noisy planet – a constant reminder that even in the most organized of systems, there will always be dark spaces waiting to be explored.

Whether you are a network engineer, a security researcher, or a curious user, understanding these mysteries enriches your view of how the internet truly operates. The next time you run a traceroute and see an unexpected address, you will know: it could be a bogon, a honeypot, or just a router taking a long nap. That is the magic of the last hop.