Public vs Private IP

IPv4 private space is defined in RFC1918 so organizations can number internal hosts without asking a registry for a unique public block for every printer. Three ranges: 10.0.0.0/8 (10.0.0.0–10.255.255.255) — huge, common in enterprises and cloud VPCs. 172.16.0.0/12 (172.16.0.0–172.31.255.255) — note it is not all of 172.0.0.0/8; 172.15 and 172.32 are not in this reservation. 192.168.0.0/16 (192.168.0.0–192.168.255.255) — home routers and labs. Packets with these destinations are not meant to be forwarded across the public internet. If they leak as a source without NAT, many providers will drop them as martians.

Private is not "secret." It is "not globally unique and not globally routable." Two companies can both use 10.0.0.0/8. That is why VPNs and overlapping RFC1918 blocks hurt. It is also why you must not treat 10.1.1.5 as a password: millions of networks own that pattern. Operational caution still applies: do not paste a full internal diagram (subnet plan, jump hosts, naming) into a public gist. That is topology disclosure, not because 10/8 is cryptographically sensitive.

Public IPv4 is the rest of unicast space that registries assign and that default-free routers know how to reach (plus specials you already met: loopback 127/8, documentation 192.0.2.0/24, etc.). A home ISP used to hand your router a public address. Many now put you behind CGNAT (carrier-grade NAT): your router's WAN address is itself private (often 100.64.0.0/10, RFC6598 shared space), and the ISP NATs many customers onto one public IP. Then "what is my IP" is even further from ip addr — there may be two translation layers.

Network Address Translation, in the common home/enterprise outbound form, rewrites the source of packets as they leave. Many private hosts share one public (or CGNAT) address. The router stores a table: inside 192.168.1.50:54321 maps to public 203.0.113.9:40000 (example). Return packets hit that public IP and port; the router rewrites them back to the laptop. From the outside, the household is one IP. That is many-to-one (NAPT / PAT). Module 5 goes deeper on NAT and firewalls; here you only need the mismatch: local inet ≠ internet-visible source.

That mismatch is why SOC attribution is hard. A public IP in a log may be an ISP NAT pool, a VPN egress, a cloud load balancer, or a coffee shop. It is not a home address you can knock on. Conversely, seeing 192.168.1.50 in an internal log is useful inside that LAN and meaningless as a global locator. Port forwarding (or a firewall DNAT) is the reverse hole: map one public port to one internal host. It is how game servers and cameras get exposed — and how accidental exposure happens. NAT is not a substitute for host firewalls; it is a rewriting trick that also happens to hide inbound paths until you punch them.

How to observe the split safely: ip addr (or ip -br addr) on YOUR machine shows private (or rarely a real public) on the NIC. ip route shows the default via — usually the CPE/router. A "what is my IP" site shows whatever source address arrived at that site after NAT. You do not need to run scanners. You do not need to publish either number. If you check a public-IP site, use a page you already trust; you are making an outbound web request, not attacking anyone. Prefer documenting the disagreement in lab notes over pasting results in public.

Read ip -br addr and ip route on a host you own. Circle whether the non-lo IPv4 sits in 10/8, 172.16/12, or 192.168/16. That is the private side. You already know loopback is neither public nor RFC1918 LAN.

ip -br addr
ip addr
ip route

You numbered IPv4, sliced it with CIDR, met IPv6, and now you can split private RFC1918 from the address the internet sees after NAT or CGNAT. Next up — Quiz — IP Addressing — ten APPLY scenarios on bits, masks, v6, and whether a number in a log is a person, a LAN, or a NAT pool.