Most home and office networks number their devices from a small set of private IPv4 ranges. RFC 1918 reserves three blocks for this. Anyone can use them inside their own network without asking a registry, which is why so many routers hand out 192.168.1.x by default.
The three private blocks
| Prefix | Range | Addresses |
|---|---|---|
10.0.0.0/8 | 10.0.0.0 – 10.255.255.255 | 16,777,216 |
172.16.0.0/12 | 172.16.0.0 – 172.31.255.255 | 1,048,576 |
192.168.0.0/16 | 192.168.0.0 – 192.168.255.255 | 65,536 |
The address counts are powers of two: a /8 leaves 24 host bits (224), a /12 leaves 20, and a /16 leaves 16.
The 172.16/12 mistake
The middle block trips people up because it doesn't line up with an octet boundary. A /12 fixes the first 12 bits, which covers 172.16.0.0 through 172.31.255.255 and nothing beyond. So 172.20.5.9 is private, but 172.32.0.1 and 172.15.255.1 are public addresses.
A quick test: an address starting with 172 is private only if its second octet is between 16 and 31.
Why private addresses stay inside
RFC 1918 says routing information about private networks shall not be propagated on links between enterprises, and packets with private source or destination addresses should not be forwarded across them. Because thousands of organizations reuse the same blocks, a private address only means something inside its own network.
That's why a device with a private address reaches the internet through network address translation: the router replaces the private source address with its own public one on the way out and reverses the change for the replies.
Ranges that look private but aren't RFC 1918
169.254.0.0/16is link-local. A host assigns one to itself when DHCP fails, and routers don't forward it. What a 169.254 address means.100.64.0.0/10is Shared Address Space, set aside in RFC 6598 for carrier-grade NAT between an internet provider and its customers. It isn't globally routable, but it's a separate block from the RFC 1918 ranges, so don't use it for your own LAN.127.0.0.0/8is loopback. Traffic to it never leaves the host, so it's never used to number devices on a network.
Spotting them in a scenario
When a question shows ipconfig output, check the first octets before anything else. A 10, a 192.168, or a 172 followed by 16 through 31 means the device is on a private network and depends on NAT for internet access. A 169.254 means it never got a lease at all.
To check which block an address belongs to and work out its subnet, try the subnet calculator.