CGNAT explained: why one IP address is thousands of people

What CGNAT is, and why it exists

Carrier-grade NAT, also written CGN or large-scale NAT, is an internet provider doing at the scale of a whole network what a home router does for a household: putting many private clients behind a smaller pool of public addresses. The world ran out of new IPv4 space years ago, so rather than give every subscriber a public address, providers, mobile networks especially, share one public address across many subscribers and translate their connections through a central gateway.

The consequence is the whole point. To anything on the public internet, every subscriber behind that gateway appears to be the same address. A mobile carrier can put hundreds or thousands of unrelated customers behind a single public IP, and there is no signal in the packet that tells you which one you are dealing with. The address identifies the carrier's gateway, not the person.

The 100.64.0.0/10 you keep seeing

If you read connection logs from inside a carrier network, or the occasional leaked header, you will run into addresses in 100.64.0.0/10. That block is Shared Address Space, set aside by RFC 6598 specifically for the private side of carrier-grade NAT: the addresses subscribers are given between their device and the carrier's gateway. It is not public space, it has no registry holder, and it is never routed on the open internet, so seeing it as a source outside its own network means something is misconfigured or leaking rather than that you have found the user.

How to recognise a shared address

You will rarely see the shared space itself; what you see is the public address in front of it, and the trick is recognising when a normal-looking address is really a carrier gateway. The tells are in what the address is, not in the number.

• It is a mobile or eyeball ISP address. Mobile networks are the heaviest users of CGNAT, and consumer broadband is close behind. An address that belongs to a mobile carrier or a residential access network should be assumed shared until proven otherwise.
• Its traffic is impossibly diverse. One address showing many simultaneous users, many device types, or logins to unrelated accounts is a gateway, not a person. A single household NAT looks like a few people; a carrier NAT looks like a crowd.
• Feeds flag it as mobile. Reputation data that carries a mobile classification is telling you the same thing from another angle: this is carrier space, and carrier space is shared.

This is one of the things a lookup is for. A report that tells you the address sits in a mobile carrier or eyeball ISP, rather than a datacenter, is telling you to treat it as shared, and the difference between an eyeball ISP and a hosting network is exactly the difference between an address that is probably a crowd and one that is probably a single tenant.

Why it breaks IP-based decisions

Every blunt thing you might do to an IP address is wrong on a shared one.

Blocking. Ban the address and you ban everyone behind it. The abuser reconnects and, on a mobile network, is very likely handed a different public address in minutes, while the innocent subscribers who were sharing the old one stay blocked. You have punished the wrong people and missed the right one.

Rate limiting. A per-IP limit tuned for one user throttles a whole gateway of them, so a busy mobile address trips limits that have nothing to do with abuse, and legitimate users see errors at peak times.

Reputation. Because the address is shared, one bad subscriber earns the whole gateway a reputation the others did not, which is the same shared-fate problem that makes a shared proxy or a mistreated mail IP dangerous. A CGNAT address can carry abuse signals from a user who is long gone, so a point-in-time bad score on a mobile address says less than the same score on a datacenter address, where one tenant really does own the reputation.

What to do instead

The fix is not to ignore IP signals but to weight them by what the address is.

• Identify shared space first. Before acting on an address, establish whether it is mobile or eyeball ISP space, and treat those as shared by default. A confident action belongs on a datacenter or hosting address far more than on a carrier one.
• Prefer per-account signals. On shared addresses, decisions should lean on the account, the device, the session and the behaviour rather than the IP alone. The IP is context, not identity.
• Make bans short and specific. If you must block a shared address, make it temporary, because the abuser has probably already moved and the address will be recycled to innocent users quickly. A permanent ban on a carrier IP is a slow-acting mistake.
• Read the address, do not assume it. The same score means different things on shared and dedicated space, so knowing which you are looking at is the difference between a fair decision and collateral damage.

None of this makes IP addresses useless. It makes them what they always were: one signal among several, whose weight depends on whether the address is one tenant or a thousand. CGNAT is simply the reason you have to know which before you act.