How IP Address Validation and Classification Works
An IP address validator checks whether a string is a syntactically correct IPv4 or IPv6 address and then classifies it into the category that determines how it behaves on a network: public, private, loopback, link-local, carrier-grade NAT, multicast, broadcast, or documentation. Validation alone catches typos, but classification is what tells you whether an address is routable on the public internet, reserved for internal use, or a special-purpose range that should never appear where you found it. Network administrators auditing firewall logs, developers writing input validation, and support engineers triaging connectivity tickets all rely on accurate classification, because a single misread range leads to wrong conclusions about where traffic is coming from.
For IPv4, the tool parses the four octets strictly — each must be 0 to 255, and leading zeros are rejected because they are ambiguous octal notation. It then checks the address against the reserved ranges in priority order: 127.0.0.0/8 is loopback, the RFC 1918 blocks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are private, 100.64.0.0/10 is carrier-grade NAT (RFC 6598), 169.254.0.0/16 is link-local, the RFC 5737 blocks are documentation, 255.255.255.255 is broadcast, and 224.0.0.0/4 is multicast; anything left is public. For IPv6 it validates the group syntax, the single permitted double-colon, optional embedded IPv4 and zone index, then classifies ::1 as loopback, fe80::/10 as link-local, 2001:db8::/32 as documentation, ff00::/8 as multicast, and fc00::/7 as unique local.
Take 100.64.0.1 as a worked example. It parses as valid IPv4, and a naive checker would call it public because it does not fall into any RFC 1918 block. But 100.64.0.0/10 is the carrier-grade NAT range defined by RFC 6598, used by ISPs to share a pool of addresses among many subscribers behind a large NAT. The tool classifies it correctly as CGNAT and flags the distinction, because treating a CGNAT address as public would mislead anyone trying to reach it directly. As additional detail for IPv4, the tool also shows the 32-bit integer form, the hexadecimal form, the binary form, and the reverse-DNS name — for 100.64.0.1 that reverse name is 1.0.64.100.in-addr.arpa, the format used for PTR record lookups.
Support engineers paste a batch of addresses from a log file into the batch mode and instantly see which are internal, which are public, and which are suspicious special-purpose ranges that should not be originating traffic. Developers building a signup form use the classification to reject obviously non-routable input, or to detect when a client is behind CGNAT and may share an address with thousands of others, which matters for rate-limiting by IP. Security analysts investigating a scan cross-check source addresses against the documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) because those should only ever appear in examples, never in real traffic, so their presence signals spoofing or a misconfiguration.
The classification most people get wrong is CGNAT: 100.64.0.0/10 is neither private in the RFC 1918 sense nor genuinely public, and naive validators consistently mislabel it, which is exactly why this tool calls it out explicitly with a note. A second subtlety is that IPv6 link-local addresses (fe80::/10) are only meaningful within a single link and require a zone index like %eth0 to be usable, so the validator accepts and preserves that suffix rather than rejecting it as invalid. It is also worth remembering that classification describes the range an address belongs to, not whether a device is actually reachable there — a valid public address can still be offline, and a private address is only reachable from inside its own network. Every address is validated and classified entirely in your browser using pure range checks and bit masks; nothing you enter is uploaded, and the tool needs no network access to do its job, so it is safe to paste production log data into it.