Routers read an address like the post reads a PIN
Delhi reads the start of the PIN to send it south; Bengaluru reads all of it; the postman reads the flat. Routers read the prefix.
Four routes match 10.20.9.5. The most specific one wins.
Prefixes nest, and the router takes the entry with the most matching bits. The default route wins only when nothing else matches.
Does an IP address identify a user?
Bad: One address, one user
IPv4 ran out. Carrier NAT puts thousands of phones behind one address.
Good: It names an interface
A place in the routing map. Tokens identify users.
Three users, one public address, told apart only by port
The carrier’s NAT rewrites each source to 203.0.113.7 and a free port. Your load balancer sees one client.
0.2/min
each phone’s share of a 100/min per-IP limit
500 phones behind one carrier gateway share one counter. During a Flipkart-style sale, that gateway looks like your worst abuser.
IPv6 needs no NAT. Hosts usually pick their own 64-bit interface ID; phones rotate it for privacy.
The flip side
One user now arrives from many addresses. Key limits on the /64, one household or phone.
Four rules for your design
- One non-overlapping /16 per VPC, from a central plan
- Budget NAT ports for every hot dependency
- Send partner traffic out from fixed IPs
- Use names, not hard-coded addresses
Remember
An IP address is a location, not an identity: routers deliver by longest prefix, NAT puts thousands behind one address, IPv6 gives one user many. Limit coarsely by IP; authenticate with tokens.