A request arrives at an ISP naming an IP address and a moment in time. Fifteen years ago that pair identified one subscriber line. Today, for a large fraction of mobile and fixed customers, it identifies a pool of several hundred people who were all using that address simultaneously, and the ISP may have kept nothing that narrows it further.
The mechanism is carrier-grade NAT, also written CGNAT or large-scale NAT. It is the same translation your home router performs, moved up one level so that the carrier does it on behalf of many customers at once. Your router already hides a dozen devices behind one address. CGNAT hides a neighbourhood behind one address.
This is a deployment detail with consequences well outside networking. It quietly changed what an IP address means as evidence, it breaks a category of software that assumed one address meant one household, and it created a logging problem that carriers and law enforcement have been arguing about for over a decade.
Why carriers ran out of addresses to hand out
IPv4 addresses are 32 bits, which caps the total at roughly 4.3 billion, minus large reserved ranges. IANA handed out the last of its free blocks to the regional registries in February 2011. RIPE NCC, covering Europe and the Middle East, reached its final block in 2012 and declared full exhaustion in 2019. Mobile networks in particular grew past the point where a public address per subscriber was arithmetically possible.
The workaround was to give subscribers an address from a private range and translate at the carrier's edge. This needed its own address block, because reusing 192.168.0.0/16 or 10.0.0.0/8 would collide with the customer's own LAN. RFC 6598 set aside 100.64.0.0/10 as Shared Address Space for exactly this purpose. If your router's WAN interface holds an address in that range, you are behind a carrier NAT right now.
What it breaks for you
The first casualty is inbound connections. There is no port to forward, because the port on the public address is not yours and can be reassigned. Self-hosting anything at home, running a game server, or accepting a direct file transfer all stop working. Some carriers sell a static address or an opt-out as an add-on, which is the clearest signal of what has actually been taken away.
Peer-to-peer protocols degrade rather than fail. Two parties behind separate carrier NATs cannot always establish a direct path, so they fall back to a relay, which means a third party carries the traffic and can see its volume and timing even when it cannot read it. Anything built on WebRTC hits this constantly, which is why TURN relays exist.
The consequence people actually notice is shared reputation. When one person behind your address gets the address blocked, everyone behind it inherits the block. That is the source of the endless CAPTCHA, the mail server rejection, the forum ban you did not earn, the Wikipedia edit block on a whole mobile carrier. A blocklist entry that was written against a person now lands on a few hundred strangers.
What it breaks for attribution
To resolve an address back to a subscriber behind a carrier NAT you need three things: the public address, the exact time, and the source port. Without the port, the translation table cannot be reversed, because the port is the only field that distinguishes one customer's session from another's.
RFC 6302 asks internet-facing servers to log the source port alongside an accurate UTC timestamp for precisely this reason. Most server software still does not, by default. So a large amount of retained log data is now unresolvable in principle: it names an address that hundreds of people were sharing, and the field that would have separated them was never recorded.
RFC 6888 sets out the requirements for carrier NAT deployments, including the expectation that translations can be logged, and acknowledges the volume problem that creates. A busy gateway produces a record per connection, and a phone browsing the web opens a great many connections. Europol has named carrier-grade NAT as an obstacle to attribution in its public cybercrime assessments and has argued for either mandatory logging or a move to IPv6.
Key distinction
An IP address was never an identity. Courts and engineers have said so for years, usually against a service provider's assumption otherwise. Carrier NAT is the point where the argument stops being a subtle one about households and shared Wi-Fi, and becomes arithmetic: one address, several hundred subscribers, one timestamp.
The two exits, and what each one costs
The first exit is to log less by making the mapping predictable. RFC 7422 describes deterministic address mapping: give each subscriber a fixed block of ports on a shared address for a defined period, and the carrier only has to record one row per subscriber per block instead of one per connection. Operators like this because the storage problem disappears.
Read it from the other direction and deterministic mapping is a much more durable surveillance record than per-connection logs. A single compact table lets anyone holding it reverse an address and port to a named subscriber for the whole retention window, without needing to have captured the moment. The engineering tradeoff is log volume against permanent legibility, and the version that is cheaper to keep is the version that is easier to query later.
The second exit is IPv6, which ends the sharing by giving every subscriber real addresses. That fixes attribution by removing the ambiguity, which is not the same thing as fixing privacy. IPv6 introduces its own exposure: an address derived from a stable interface identifier follows a device between networks and works as a tracking cookie you cannot clear. RFC 8981 temporary addresses exist to blunt that, and whether they are enabled depends on your operating system's defaults. We covered the detail in IPv6 privacy extensions.
If you build things, stop using IP as identity
This is the practical half. A lot of production code still treats a client address as a proxy for a person: one signup per IP, per-IP rate limits, per-IP bans, fraud scores weighted on address reputation, geo-blocking, session pinning to an address.
| What you want to know | What an IP address tells you |
|---|---|
| Is this the same person as before? | Nothing reliable. Mobile addresses rotate, and a shared address is shared with strangers. |
| Is this one person or a thousand? | Undecidable from the address. A carrier NAT, a university, and a VPN exit all look the same. |
| Where is this person? | Where the carrier's gateway is, which can be a different region or country from the subscriber. |
| Did this address do the thing? | Only with the source port and an accurate timestamp, and only if the carrier still holds the mapping. |
Three changes follow. Log the source port and a UTC timestamp with sub-second precision if you log addresses at all, because a record without the port has no evidentiary value and you are retaining personal data that cannot answer the question you kept it for. Move abuse controls onto authenticated identity, proof of work, or per-account budgets rather than address buckets. And when you do block an address, set an expiry, because you are blocking whoever holds it next.
If you are a subscriber
Check first. Compare the WAN address on your router's status page against what an external address-lookup service reports. If they differ and your WAN address is in 100.64.0.0/10, you are behind a carrier NAT. Some deployments use other ranges, so a mismatch alone is the signal.
What you get from it is a form of deniability you did not choose and cannot depend on. Your carrier still holds the subscriber record, still sees every destination you connect to, and can still be compelled to produce both. Address sharing obscures you from the far end of the connection, not from the party in the middle. For that problem the tools are different, and both their limits are worth knowing: see what a VPN actually does and what your ISP can see.
The broader point is that a piece of infrastructure adopted for a purely economic reason, the price of IPv4, ended up rewriting the evidentiary weight of the most commonly cited identifier on the internet. Nobody designed that. It is a side effect, and it is now the environment everything else is built in.
Originally published at havenmessenger.com
Top comments (0)