IPv4 exhaustion explained starts with a simple fact: the internet has a hidden address shortage. Every device connected to the internet needs a unique number called an IP address. We have run out of new ones. This guide walks you through IPv4 exhaustion explained in plain language, covering what went wrong and how the internet still works today.
What Is IPv4?
IPv4 stands for Internet Protocol version 4. Engineers introduced this original addressing system in the early 1980s. Every IPv4 address looks like four numbers separated by dots – for example, 192.168.1.1. Think of it as a postal address for your computer, phone, or smart TV. Without it, data packets would not know where to go.
Why Do Devices Need IP Addresses?
When you visit a website or send an email, your device attaches its IP address to every data packet. The receiving server uses that address to send a reply. If every device had a unique public address, the system would need as many addresses as there are connected devices. Consequently, that is where the problem begins.
How Many IPv4 Addresses Exist?
An IPv4 address is 32 bits long. Therefore, it gives exactly four billion, two hundred ninety-four million, nine hundred sixty-seven thousand, two hundred ninety-six possible addresses – about 4.3 billion. To put that in perspective: there are fewer IPv4 addresses than people on Earth (nearly 8 billion). Roughly 600 million of those 4.3 billion are reserved for special purposes like loopback, multicast, and documentation. Thus, they cannot be used for normal internet communication. As a result, the usable pool is even smaller.
Why Did IPv4 Seem Unlimited in the 1980s?
When engineers designed IPv4 in the late 1970s, the internet was a tiny research network. It connected only a few hundred computers at universities and military labs. The creators never expected it to become a global standard used by billions of devices. One of its creators, Vint Cerf, later admitted: “Who the hell knew how much address space we needed?” At that time, 4.3 billion addresses felt like an infinite supply. However, the explosive growth of the internet changed everything.
What Does IPv4 Exhaustion Mean?
IPv4 exhaustion explained in one sentence: the central pool of free, unallocated IPv4 addresses has emptied completely. The Internet Assigned Numbers Authority (IANA) exhausted its central pool in 2011. As a result, no more new addresses are available from the top‑level authorities for general distribution. Exhaustion does not mean the internet will stop working tomorrow. After all, the 4.3 billion addresses already assigned continue to work. Nevertheless, growth and new devices have become much harder to accommodate. That is why IPv4 exhaustion explained requires understanding the forces that drove it.
Three Reasons We Ran Out of Addresses
Three major forces drove IPv4 exhaustion. Let us examine each one.
Reason 1: The Explosion of Connected Devices
In the 1980s, only mainframes and research computers needed IP addresses. Today, billions of smartphones, laptops, smartwatches, smart TVs, and game consoles compete for the same pool. In 2025 alone, roughly 19.8 billion active IoT devices – from smart meters to security cameras – all needed connectivity. For this reason, massive growth quickly consumed available addresses.
Reason 2: The Rise of Cloud Computing
Amazon Web Services (AWS), Microsoft Azure, and Google Cloud have built massive networks with millions of servers. Each server needs public IP addresses. For instance, AWS alone holds roughly 20 million purchased IPv4 addresses. Moreover, as datacenters expand, IP demand continues climbing.
Reason 3: Early Wasteful IP Allocations
In the early internet, engineers used a system called classful networking. They divided the IPv4 space into five classes. The table below shows how inefficient that system was.
| Class | Address Range | Hosts per Network | Problem |
|---|---|---|---|
| A | 1.0.0.0 – 126.0.0.0 | 16.7 million | Too large for most organizations |
| B | 128.0.0.0 – 191.255.0.0 | 65,534 | Often wasted thousands of addresses |
| C | 192.0.0.0 – 223.255.255.0 | 254 | Too small for medium companies |
| D | 224.0.0.0 – 239.255.255.255 | – | Multicast only |
| E | 240.0.0.0 – 255.255.255.255 | – | Reserved for experiments |
For example, if an organization needed 1,000 IP addresses, a Class C (254 addresses) was too small, but a Class B (65,534 addresses) wasted 64,000 addresses. Consequently, many large companies received Class B allocations when they needed far less. By the early 1990s, engineers realized this system was burning through the address space at an alarming rate.
How NAT Helped Delay IPv4 Exhaustion
Network Address Translation (NAT) became the most important technology that kept the internet running after IPv4 depletion became inevitable. NAT allows an entire home or office network to share a single public IPv4 address. All devices inside the network use private IP addresses, and the router translates between the private addresses and the single public address when communicating with the outside world.
The three private address blocks (defined in RFC 1918) are:
| Private Block | Address Range | Number of Addresses |
|---|---|---|
| 24-bit block | 10.0.0.0 – 10.255.255.255 | 16.8 million |
| 20-bit block | 172.16.0.0 – 172.31.255.255 | 1.05 million |
| 16-bit block | 192.168.0.0 – 192.168.255.255 | 65,536 |
NAT achieved two things. First, it allowed billions of devices to share a small pool of public IPv4 addresses. Second, it gave organizations the ability to build internal networks without consuming scarce public addresses. However, NAT is only a workaround. It breaks end‑to‑end connectivity, making peer‑to‑peer applications like gaming, VoIP, and video conferencing harder to run. Moreover, it hides the exhaustion problem rather than solving it.
What Is CGNAT (Carrier‑Grade NAT)?
As home routers began sharing single public IPs, internet service providers (ISPs) faced the same problem: not enough public IPv4 addresses to give each customer a unique one. Therefore, the solution was Carrier‑Grade NAT (CGNAT or NAT444). CGNAT adds an extra layer of NAT inside the ISP’s network. Your home router does its normal NAT, translating your private device IPs into a private ISP‑assigned address. Then, deeper in the carrier’s network, another NAT device translates that private ISP address into one of a much smaller pool of public IPv4 addresses.
With CGNAT, a single public IPv4 address can serve hundreds or even thousands of subscribers. The name NAT444 comes from the fact that traffic passes through three different IP domains: your private network, the carrier’s private network, and the public internet. For example, Australian ISP Optus and many other carriers use CGNAT to assign customers addresses from the 10.0.0.0 private range instead of public ones. This allows them to serve millions of customers with far fewer public IPv4 addresses.
Who Manages IP Addresses Globally?
Two main bodies manage global IP address distribution. IANA (Internet Assigned Numbers Authority) oversees the central pool of IP addresses. IANA allocates large blocks of IPv4 addresses to the five Regional Internet Registries (RIRs).
The five RIRs manage allocation within their regions:
| RIR | Region Covered |
|---|---|
| ARIN | USA, Canada, parts of the Caribbean |
| RIPE NCC | Europe, Middle East, Central Asia |
| APNIC | Asia Pacific (Australia, India, Japan, China) |
| LACNIC | Latin America and Caribbean |
| AFRINIC | Africa |
When IANA could no longer allocate new blocks to RIRs, the top‑level exhaustion was confirmed. Subsequently, each RIR exhausted its own free pool on different dates.
IPv4 Exhaustion Timeline
Here is the complete timeline of IPv4 depletion.
| Date | Event |
|---|---|
| Late 1980s | Engineers first warn that IPv4 address space may be insufficient |
| 31 Jan 2011 | IANA (top‑level) exhausts its central pool of unallocated IPv4 addresses |
| 15 Apr 2011 | APNIC (Asia Pacific) exhausts its free pool |
| 14 Sep 2012 | RIPE NCC (Europe) exhausts its free pool |
| 10 Jun 2014 | LACNIC (Latin America) exhausts its free pool |
| 24 Sep 2015 | ARIN (North America) exhausts its free pool |
| 2025 – present | AFRINIC (Africa) remains the only RIR with a limited free pool; all others are depleted |
Why Does IPv4 Still Work Today?
IPv4 addresses continue to work normally because exhaustion only affects free unallocated addresses, not addresses already assigned to organizations. The pool of allocated addresses – over 4 billion – remains fully operational. As a result, even with IANA and RIR pools empty, IPv4 addresses still circulate through transfers and leases. Organizations that no longer need their IPv4 blocks can sell or lease them to others.
The IPv4 Buying, Selling, and Leasing Market
Once the free pools dried up, a secondary market for IPv4 addresses emerged. This market is now a billion‑dollar industry.
Price Evolution Over Time
- Around 2011: 5 to 10 per IP
- Around 2015: 5 to 10 per IP (stable)
- Around 2021: 40 to 50 per IP
- 2026 (current): 35 to 55 per IP, varying by region and block size
In early 2026, purchase prices for IPv4 addresses stabilized. Furthermore, a /24 block (256 addresses) typically sells for 6,000 to 15,000. Consequently, a single /16 block (65,536 addresses) that cost nothing in the 1990s is now worth over 1.5 million. The annual global transfer market volume reaches an estimated 1.2 billion.
How Companies Lease IPv4 Addresses
Leasing has become a popular alternative to outright purchase. Monthly leasing rates typically range from 0.38to0.75 per IP. For instance, the largest marketplace, IPXO, averages around $0.50 per IP per month.
The U.S. Department of Defense is also releasing roughly 200 million IPv4 addresses onto the market in large blocks. Major buyers like Amazon, Google, and other hyperscalers will likely acquire significant portions.
Private vs. Public IP Addresses
Public IP addresses are globally unique and routable on the internet. In contrast, private IP addresses (the RFC 1918 ranges shown earlier) are not globally unique. The same private addresses can appear simultaneously inside millions of different homes, offices, and datacenters. Ultimately, NAT devices bridge the two by translating private addresses into a shared public address.
Reserved IPv4 Ranges
Beyond the private space, IANA reserves several other address blocks for special purposes:
| Reserved Block | Purpose |
|---|---|
| 0.0.0.0/8 | Default route / wildcard |
| 127.0.0.0/8 | Loopback (localhost – 127.0.0.1 is self) |
| 169.254.0.0/16 | Link‑local (automatic private IP addressing) |
| 224.0.0.0/4 | Multicast (one‑to‑many transmission) |
| 240.0.0.0/4 | Reserved / experimental (Class E) |
| 255.255.255.255/32 | Limited broadcast |
These special‑purpose blocks never get assigned to regular internet hosts. As shown, they further reduce the 4.3 billion total pool.
Security Problems Caused by IPv4 Scarcity
IPv4 exhaustion has created new security risks. Let us look at the three most dangerous ones.
BGP Hijacking
The Border Gateway Protocol (BGP) is the internet’s routing system. Because IPv4 addresses have become scarce and valuable, attackers increasingly announce false routes for IP blocks they do not own. This technique, called BGP hijacking, diverts traffic meant for a legitimate destination to the attacker’s network.
When IPv4 scarcity pushes prices to $50 per address, a successfully hijacked /16 block (65,536 addresses) gives the attacker control of millions of dollars worth of routing space. BGP hijacking is not theoretical – incidents occur regularly. For example, a 2026 event in Venezuela linked a major network outage to BGP route manipulation.
IPv4 Transfer Market Abuse
Scarce, tradable IPv4 addresses have also attracted fraud. Transferred or leased IP blocks sometimes serve malicious campaigns after the sale closes. Attackers buy or lease clean IP blocks, then use them for spam, malware distribution, DDoS attacks, or botnet command‑and‑control. The previous owner’s good reputation may shield them initially.
IP Reputation Issues
Spam accounts for roughly 66% of reported IPv4 abuse cases. Malware follows at 14%, and DDoS attacks at 4%. When a legitimate organization leases its IP block to an abuser, the entire block’s reputation may suffer. Therefore, that makes it harder for the original owner to use those addresses later.
How Cloud Providers Handle IPv4 Shortages
Major cloud providers face immense pressure as public IPv4 addresses become both scarce and expensive.
Cloud Pricing for IPv4
Since February 2024, AWS has charged 0.005 per hour for every public IPv4 address. That applies whether the address attaches to an instance, load balancer, NAT gateway, or sits idle. The cost works out to roughly 3.65 per IP per month.
At scale, these costs add up fast:
| Number of Public IPs | Monthly Cost | Annual Cost |
|---|---|---|
| 100 IPs | $365 | $4,380 |
| 1,000 IPs | $3,650 | $43,800 |
| 5,000 IPs | $18,250 | $219,000 |
Azure and Google Cloud implemented similar charges at the same time.
Bring Your Own IP (BYOIP)
To help customers avoid these fees, AWS, Azure, and Google Cloud support BYOIP. Customers can bring their own IPv4 address blocks (purchased on the open market) into the cloud. However, BYOIP requires technical onboarding like route propagation and regional configuration. Historically, it has been complex to implement. Nevertheless, cloud providers also encourage IPv6 adoption to reduce dependence on scarce IPv4 addresses.
Real‑World Examples from ISPs and Mobile Carriers
Mobile carriers were among the first to feel the squeeze. CGNAT techniques first appeared commercially in 2000 to support GPRS (2.5G) mobile data. Today, nearly every mobile carrier uses CGNAT to serve millions of subscribers from a small pool of public IPv4 addresses. Similarly, residential ISPs face the same challenge. Many operators rely heavily on CGNAT as a stopgap, especially for low‑usage subscribers. A single public IPv4 address can serve over 100 customers simultaneously.
The result: Millions of home and mobile internet users have never owned a unique public IPv4 address. In fact, they have always lived behind one or more layers of NAT, sharing addresses with thousands of strangers.
Simple Analogies for Beginners
To make IPv4 exhaustion explained easier to grasp, here are three analogies. Each one uses a different comparison.
Analogy 1: Apartment Building Parking Spaces
Imagine the IPv4 address space is a massive apartment building with 4.3 billion parking spaces. For years, new apartments kept being built, each taking parking spaces. In 2011, the last unassigned parking space was claimed. Now, the only way to get a parking space is to buy or rent one from an existing tenant.
Analogy 2: Post Office with Limited Lockers
Think of a post office with exactly 4.3 billion mail lockers. Every person or device that wants mail delivery needs their own locker. NAT is like a shared mailbox that serves an entire apartment building – a single locker that still manages to sort mail for every unit inside.
Analogy 3: Seats on Earth
Imagine you need to assign each person on Earth a unique seat number, but you only have 4.3 billion seats. That is fewer than one seat per person – and we have nearly 8 billion humans. We would need every person to share a seat with at least one other person. Ultimately, IPv4 exhaustion forces exactly that kind of sharing.
The Difference Between IPv4 and IPv6
IPv6 is the long‑term solution to the address shortage. Here is the direct comparison.
| Feature | IPv4 | IPv6 |
|---|---|---|
| Address length | 32 bits | 128 bits |
| Total number of addresses | ~4.3 billion | ~340 undecillion |
| Address format example | 192.0.2.1 | 2001:0db8:85a3:0000:0000:8a2e:0370:7334 |
| NAT required | Yes (almost always) | No |
| Security | Optional IPsec | Mandatory IPsec support |
| Configuration | Manual or DHCP | SLAAC (automatic) |
| Packet header | 20–60 bytes | 40 bytes, fixed |
| End‑to‑end connectivity | Broken by NAT | Restored |
To illustrate the scale: IPv6 provides 340 undecillion addresses – enough to assign multiple IP addresses to every atom on the Earth’s surface. Engineers often say IPv6 could assign an IP address to every grain of sand on every beach on the planet.
Why Was IPv6 Created?
Engineers created IPv6 specifically to solve IPv4 exhaustion. The Internet Engineering Task Force (IETF) recognized the coming shortage as early as the late 1980s and began designing IPv6 in the 1990s.
Beyond solving the address shortage, IPv6 includes:
- Mandatory IPsec support for better security.
- Simplified header format for faster router processing.
- Stateless autoconfiguration (SLAAC) so devices can assign themselves addresses without a DHCP server.
- No NAT required, restoring true end‑to‑end connectivity.
Why Is IPv6 Adoption So Slow?
Despite being designed over 25 years ago, IPv6 adoption has been frustratingly slow.
Global Adoption in 2026
Roughly 50% of global networks now support IPv6, up from 45% in 2025. However, the numbers vary wildly by region:
| Region / Entity | IPv6 Adoption Rate |
|---|---|
| France | ~85% (world leader) |
| United States | ~50% |
| North America | ~57.7% |
| Global average | ~45–50% |
| Some developing regions | Below 10% |
Causes of Slow Adoption
- NAT Worked “Well Enough”: For many years, NAT reduced urgency.
- Migration Costs: Upgrading routers, firewalls, load balancers, and applications can be expensive.
- Compatibility Concerns: IPv4‑only devices cannot talk directly to IPv6‑only devices without translation layers like NAT64 or 464XLAT.
- No Financial Incentive: Many organizations see no immediate revenue benefit from IPv6 deployment. For instance, a 2026 survey in the Netherlands concluded there is “no pressing shortage of IPv4 addresses, and therefore no clear economic incentive to switch.”
Will IPv4 Ever Truly Die?
No. IPv4 will not fully disappear for decades, if ever. Too many legacy systems, appliances, embedded devices, and network configurations depend on IPv4. The two protocols will coexist through dual‑stack configurations – devices that speak both IPv4 and IPv6 – and translation technologies.
As IPv4 addresses become more expensive (over $50 per IP) and IPv6 adoption crosses 50% globally, the economic incentive to finally complete the transition grows. Still, the internet will remain a hybrid of both protocols for the foreseeable future.
Frequently Asked Questions (FAQ)
To help readers quickly find answers, the FAQ is divided into two parts.
Basic Questions About IPv4 Exhaustion
Q: How many IPv4 addresses exist exactly?
Exactly 4,294,967,296 addresses. Roughly 600 million are reserved, which reduces the usable pool.
Q: Will the internet stop working when IPv4 runs out?
No. The internet runs on allocated IPv4 addresses, not the free pool. Therefore, IPv4 exhaustion means no new free addresses, but existing addresses continue working.
Q: What is my real IP address?
Your “real” public IP address is usually the one assigned by your ISP. However, if you sit behind CGNAT, thousands of other customers share the same public IPv4 address. Your device’s private IP (starting with 10.x, 172.16‑31.x, or 192.168.x) is not your public address.
Q: How can I check if I am behind CGNAT?
Compare your router’s WAN IP address with your public IP (visit a site like WhatIsMyIP). If they differ, and the WAN IP falls into a private range, then you are behind CGNAT.
Q: Can I buy my own IPv4 address?
Yes. You can purchase IPv4 addresses on the secondary market through approved brokers. Expect to pay 35to55 per IP in 2026. Additionally, you must demonstrate justified need to the relevant regional internet registry.
Advanced Technical Questions
Q: What is 464XLAT?
464XLAT is a translation technology that allows IPv6‑only devices (like some modern smartphones) to reach IPv4‑only services on the public internet. It combines NAT64 (translation) with CLAT (client‑side translation).
Q: How does IPv6 improve security over IPv4?
IPv6 mandates IPsec support for encryption and authentication between peers. Moreover, IPv6 makes NAT unnecessary, which reduces the attack surface of NAT traversal. IPv6 also supports privacy extensions (temporary, randomized addresses) that make device tracking harder.
Q: Why do I still see “IPv4” everywhere if we have IPv6?
Most of the world runs dual‑stack networks – they support both IPv4 and IPv6 simultaneously. Backward compatibility ensures that IPv4‑only devices do not lose connectivity. Consequently, nearly every website you visit still has an IPv4 address and remains reachable over IPv4.
Q: How does the CISA GitHub data leak relate to IPv4?
The CISA GitHub data leak exposed plaintext credentials, including passwords and access tokens, in a public repository. While that leak did not directly cause IPv4 exhaustion, it highlighted how poor credential management can compromise the systems that manage IP addresses, cloud infrastructure, and network devices. For the full story and lessons on securing your credentials, see our detailed coverage of the CISA GitHub data leak.
Conclusion
IPv4 exhaustion explained ultimately comes down to one simple truth: the internet grew faster than anyone expected. The 4.3 billion addresses that once seemed infinite have all been allocated. As a result, every new connected device must now share a public IPv4 address through NAT, CGNAT, or increasingly through IPv6.
IPv6 adoption has finally crossed 50% globally, but the transition remains slow. Meanwhile, IPv4 addresses will not disappear; they will simply become an expensive, traded commodity on a billion‑dollar secondary market.
Organizations that need scalable, future‑proof networks should plan for dual‑stack deployment now. Those that delay will face rising costs for IPv4 leases and purchases, security risks from address scarcity (BGP hijacking, transfer‑market abuse), and eventual performance issues as IPv6‑only networks become the majority.
IPv4 served the internet incredibly well for over 40 years. Nevertheless, the time to move beyond it – or at least to coexist with its successor – has arrived. The internet of the next decade will run on both IPv4 and IPv6 in parallel. Whether your organization prepares for that hybrid world or scrambles for increasingly scarce IPv4 addresses is a choice you make today.