How IP Addresses Are Allocated

The short answer

Nobody buys an IP address from a shop. The Internet Assigned Numbers Authority (IANA) holds the global pool and hands large blocks to five regional internet registries (RIRs). Each RIR allocates smaller blocks to internet providers and organizations in its region, and providers assign pieces of those to their customers. Every step is recorded, and that record is what an IP WHOIS or RDAP lookup reads.

One block’s path from IANA to the network that uses it. The names and addresses are documentation examples from RFC 5737.

The five regional internet registries

The RIRs are non-profit membership organizations. Each sets its own policies through an open community process, keeps the registration database for its region, and runs the WHOIS and RDAP services that answer lookups. Together they form the Number Resource Organization (NRO).

Registry	Region	RDAP service	WHOIS server
ARIN	Canada, the United States and parts of the Caribbean	rdap.arin.net	whois.arin.net
RIPE NCC	Europe, the Middle East and parts of Central Asia	rdap.db.ripe.net	whois.ripe.net
APNIC	Asia Pacific	rdap.apnic.net	whois.apnic.net
LACNIC	Latin America and parts of the Caribbean	rdap.lacnic.net	whois.lacnic.net
AFRINIC	Africa and the Indian Ocean	rdap.afrinic.net	whois.afrinic.net

Some countries add a national internet registry (NIR) under their RIR, such as JPNIC in Japan under APNIC and NIC.br in Brazil under LACNIC. A lookup for addresses they manage may be referred on to them.

Allocations, assignments and the words registries use

An allocation is a block given to an organization, usually a provider, so that it can hand out parts of it. An assignment is a block given for use on one network, which is not handed out further. The registry record’s type tells you which one you are looking at, though each RIR spells it differently.

Meaning	ARIN	RIPE NCC and AFRINIC	APNIC
From the registry to a provider, to hand out	Direct Allocation	ALLOCATED PA	ALLOCATED PORTABLE
From the registry to an organization, for its own use	Direct Assignment	ASSIGNED PI	ASSIGNED PORTABLE
From a provider to another provider	Reallocation	SUB-ALLOCATED PA	ALLOCATED NON-PORTABLE
From a provider to a customer	Reassignment	ASSIGNED PA	ASSIGNED NON-PORTABLE

Provider aggregatable (PA) space belongs to the provider: a customer who changes provider normally renumbers and returns it. Provider independent (PI) or portable space belongs to the organization itself, which can announce it through any provider. Blocks registered before the RIRs existed are called legacy space and may sit under looser rules.

IPv4 run-out and transfers

IANA handed out the last of its free IPv4 pool on February 3, 2011, when each RIR received one final /8. The RIRs then ran down their own pools: APNIC reached its last /8 in April 2011, ARIN’s free pool was exhausted in September 2015, and the RIPE NCC made its final /22 allocations in November 2019. Since then most IPv4 space changes hands through transfers between organizations, which the RIRs record, including transfers from one region to another.

That is why the IANA block and the registry that answers can differ. IANA’s records may say a /8 went to ARIN, while part of it is now held at APNIC after an inter-registry transfer. A lookup that asks ARIN is then referred to APNIC. IPv6 has no such shortage: RIRs give providers a /32 or larger by default, which holds 4,294,967,296 /64 subnets.

What a lookup tells you, and what it doesn’t

It tells you which organization holds the block, its range and size, when it was registered and last changed, and how to reach its abuse, technical and network operations contacts.
It doesn’t tell you who is using one address right now. Providers must register larger reassignments, but small ones, such as a home connection’s address, are rarely published.
It isn’t geolocation. The country is the holder’s country of registration, not where the address is used. Global networks and anycast services use the same block on several continents.
It isn’t routing. The holder and the network that announces the block in BGP can differ, for example when a CDN or a DDoS protection service announces a customer’s block. See BGP Basics.

Looking an address up yourself

Ask the RIR that IANA’s bootstrap file names, or start at ARIN, which refers lookups for other regions onward:

$ whois -h whois.arin.net 8.8.8.8

$ curl --silent --location 'https://rdap.arin.net/registry/ip/8.8.8.8'

$ curl --silent 'https://data.iana.org/rdap/ipv4.json'

Command	What it does
whois -h whois.arin.net	Classic WHOIS over port 43, as free text
curl … rdap.arin.net/registry/ip/	The same record as RDAP JSON; --location follows a referral to another RIR
curl … data.iana.org/rdap/ipv4.json	IANA’s bootstrap file: which RDAP server answers for each block

For how WHOIS and RDAP differ, see WHOIS vs RDAP. Private ranges such as 10.0.0.0/8 and 192.168.0.0/16 are not registered to anyone; see NAT and Private IP Address Ranges.

How DNS Panopticon helps

IP WHOIS Lookup finds the right registry through IANA’s bootstrap files, follows referrals between RIRs, and draws the allocation path from IANA down to the network, with a bar showing where each block sits inside the one above it. It also lists the abuse contact and the AS that announces the address today.