--- id: CP-465 slug: ip-address-nat-ipv4-ipv6 lang: en title: IP Address, IPv4 and IPv6 description: What an IP address tells others about an organization, what it does not, IPv4 and IPv6, and the steps an employee can take. canonical_url: https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6/ markdown_url: https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "IP Address, IPv4 and IPv6", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6/ (CC BY 4.0) wing: 3 theme: understand_cyberspace reflex: cr-034 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6/ fr: https://startbrain.io/cyberpedia/fr/articles/adresse-ip-nat-ipv4-ipv6/ de: https://startbrain.io/cyberpedia/de/articles/ip-adresse-nat-ipv4-ipv6/ es: https://startbrain.io/cyberpedia/es/articles/direccion-ip-nat-ipv4-ipv6/ sources: - "n": 1 title: "Gather Victim Network Information: IP Addresses" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1590/005/ accessed: "2026-11-03" - "n": 2 title: Guidelines for the Secure Deployment of IPv6 publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/119/final published: "2010-12-29" accessed: "2026-11-03" - "n": 3 title: Gestion des adresses IP (IPAM) publisher: Microsoft url: https://learn.microsoft.com/fr-fr/windows-server/networking/technologies/ipam/ipam-top published: "2025-08-14" accessed: "2026-11-03" - "n": 4 title: Guidelines on Firewalls and Firewall Policy publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/41/r1/final published: "2009-09-28" accessed: "2026-11-03" - "n": 5 title: Guide to IPsec VPNs publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/77/r1/final published: "2020-06-30" accessed: "2026-11-03" - "n": 6 title: Proxy publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1090/ accessed: "2026-11-03" - "n": 7 title: Understanding Patches and Software Updates publisher: CISA url: https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates published: "2023-02-23" accessed: "2026-11-03" --- # IP Address, IPv4 and IPv6 An IP address identifies a machine or a service on a network. This page explains what the address tells an outsider about an organization, what it does not tell, and what an employee can do to avoid saying more than necessary. The sources gathered for this page are security documents (NIST, MITRE, CISA, Microsoft). None of them describes in detail how NAT works or the CNIL's position on the IP address: these points are therefore not covered here. ## In 30 seconds - Where it happens: whenever an IP address of the organization is exposed or collected, by direct means as well as through online datasets [1]. - What the attacker wants: to infer the size of the organization, the location of its sites and the hosting of its services visible from the Internet [1]. - The reflex: do not share the company's network addresses, and report any unusual connection alert to the IT department. - If it is already done: tell the IT department, which can judge whether the address that was shared is exposed. ## Straight answers ### What are IPv4 and IPv6? They are two versions of the IP protocol. NIST cites the exhaustion of the IPv4 address space and an OMB mandate for US federal agencies as reasons for writing its guide, and states that IPv6 is not backward compatible with IPv4 [2]. An organization that adopts it must therefore change its network infrastructure and its systems [2]. ### What does an IP address reveal? According to MITRE, public IP addresses may be assigned to an organization in blocks, that is, in ranges of consecutive addresses [1]. From them, an adversary can infer the size of the organization, the physical location of its sites, its Internet service provider, and where and how its infrastructure visible from the Internet is hosted [1]. ### What does it not reveal? The sources cited here describe what the address allows one to infer about an organization. None of them says that it gives a person's name. ### Does a VPN make you anonymous? The sources do not say so. NIST presents the IPsec VPN as a way to protect communications and to reduce the risks of transmitting sensitive information over networks [5]. CISA recommends, when an update must go through an untrusted network (airport, hotel, café), using a VPN to a trusted network [7]. ### How does a company keep track of its addresses? In Windows Server environments, the IPAM feature is used to plan, deploy, manage and monitor the IP address infrastructure, and it automatically discovers the IP address and DNS servers on the network [3]. ## How it works MITRE specifies that information about assigned addresses can also appear in online datasets or datasets open to everyone [1]. This exposure is not easy to fix: MITRE writes that the technique cannot be easily mitigated with preventive controls, because it relies on behaviors outside the enterprise's perimeter, and recommends reducing the amount and sensitivity of data available to third parties [1]. The firewall controls the flow of traffic between networks or machines that do not have the same security posture [4]. NIST details its types, its advantages and its limits in its guide on firewalls [4]. Attackers also use relays, called proxies. A proxy acts as an intermediary between systems, and adversaries use it to avoid a direct connection to their own infrastructure [6]. They can chain several proxies to better hide the source of the malicious traffic [6]. An address seen in a log is therefore not always that of the real perpetrator. ## What you do - Do not give out the company's network addresses (ranges, server addresses) in a message, a forum or a form. MITRE recommends limiting the data available to third parties [1]. - Report an unusual connection alert to the IT department, even if it seems harmless. - Use the VPN provided by the company when you have to work on an untrusted network. CISA recommends avoiding updates on an untrusted network and, if that is impossible, going through a VPN to a trusted network [7]. - Install updates as soon as they are available: CISA specifies that attackers can target flaws for months, even years, after a patch is published [7]. - Download updates only from the vendor's website, never from a link received by email [7]. ## Pitfalls Believing that an address proves who carried out an action. Adversaries chain proxies to disguise the source of traffic [6]. The address seen by the victim can therefore be that of a relay. Believing that an address is worthless. It can help an attacker locate the hosting of services visible from the Internet, and MITRE lists this collection among the steps that can lead to initial access [1]. Believing that a VPN solves everything. NIST describes IPsec as a network-layer security control [5]. ## Real cases ### Wiper attacks in Poland, 2025 MITRE reports that, during the 2025 wiper attacks in Poland, the adversaries used the tools rsocx.exe and r.exe to establish a tunnel into the internal infrastructure by means of a reverse SOCKS proxy [6]. ### Address collection by known groups MITRE gives three examples with no date of their own. The Magic Hound group captured the IP addresses of visitors to its phishing sites [1]. HAFNIUM obtained the IP addresses of publicly accessible Exchange servers [1]. Andariel limited its watering hole attacks to specific IP address ranges [1]. ## Sources 1. MITRE ATT&CK, "Gather Victim Network Information: IP Addresses". https://attack.mitre.org/techniques/T1590/005/ (accessed 3 November 2026) 2. NIST, "Guidelines for the Secure Deployment of IPv6", 29 December 2010. https://csrc.nist.gov/pubs/sp/800/119/final (accessed 3 November 2026) 3. Microsoft, "Gestion des adresses IP (IPAM)", 14 August 2025. https://learn.microsoft.com/fr-fr/windows-server/networking/technologies/ipam/ipam-top (accessed 3 November 2026) 4. NIST, "Guidelines on Firewalls and Firewall Policy", 28 September 2009. https://csrc.nist.gov/pubs/sp/800/41/r1/final (accessed 3 November 2026) 5. NIST, "Guide to IPsec VPNs", 30 June 2020. https://csrc.nist.gov/pubs/sp/800/77/r1/final (accessed 3 November 2026) 6. MITRE ATT&CK, "Proxy". https://attack.mitre.org/techniques/T1090/ (accessed 3 November 2026) 7. CISA, "Understanding Patches and Software Updates", 23 February 2023. https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/ip-address-nat-ipv4-ipv6/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.