Uppdaterad för 8 timmar sedan
Run a WHOIS query on any IP address and you'll hit a wall of cryptic strings. APNIC-LABS. CLOUDFLARENET. DNIC-NET-215. HP-INTERNET. NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK.
These look like someone mashed a keyboard. They're actually the most important thing in the record.
Every IP address on the Internet belongs to someone. Not in the way you own a book—more like the way a parcel of land belongs to someone in a county registry. There's a chain of custody. Someone allocated it, someone received it, someone is responsible for it right now. The network name is the label on each link in that chain.
One Man's Notebook
The story starts with Jon Postel.
In 1969, when the ARPANET was a handful of university computers connected by telephone lines, Postel started keeping track of which network numbers were assigned to whom. He did this on a piece of paper1. Literally a notebook. The entire addressing system of what would become the Internet was managed by one person writing things down.
As the network grew, this became the Internet Assigned Numbers Authority—IANA. But the principle didn't change: someone has to keep the list. Someone has to know who has what.
Today that list is a global system spanning five continents, governed by international agreements, maintained in distributed databases. But the function is the same as Postel's notebook: record who is responsible for which numbers.
The Hierarchy
IP address space flows downhill through a strict hierarchy:
IANA sits at the top. It holds the master registry of all IPv4 and IPv6 address space2. IANA doesn't assign addresses to companies or people. It allocates large blocks—historically entire /8 blocks (16.7 million addresses each)—to Regional Internet Registries.
Regional Internet Registries (RIRs) are the five organizations that manage address space for their geographic regions:
| Registry | Region | Headquarters |
|---|---|---|
| ARIN | North America, parts of the Caribbean | Chantilly, Virginia |
| RIPE NCC | Europe, Middle East, Central Asia | Amsterdam, Netherlands |
| APNIC | Asia-Pacific | Brisbane, Australia |
| LACNIC | Latin America, Caribbean | Montevideo, Uruguay |
| AFRINIC | Africa | Ebene, Mauritius |
Each RIR allocates address space to Local Internet Registries (LIRs)—typically ISPs and large organizations—who then assign addresses to their customers and end users.
At every level of this hierarchy, someone names the block. That name is the network name.
What Network Names Actually Are
A network name—called NetName in ARIN's database and netname in RIPE, APNIC, AFRINIC, and LACNIC databases—is a mandatory, human-readable label attached to every registered block of IP address space. It identifies the allocation in a way that makes sense to humans, not just to machines.
Here's a real WHOIS record for Cloudflare's 1.1.1.1 DNS resolver:
APNIC-LABS is the network name. It tells you this block is operated by APNIC's research division. Not Cloudflare—APNIC. Cloudflare routes the traffic (via AS13335), but the address space belongs to APNIC Research and Development. The network name reveals the actual owner, which sometimes differs from who you'd expect.
The Naming Conventions
There's no single global standard for network names. Each RIR has its own conventions, shaped by its history and database architecture. But patterns emerge.
ARIN (North America)
ARIN uses two related fields: NetName and NetHandle.
The NetHandle follows a rigid format: NET- followed by the starting IP address with dashes, followed by a version number. For example:
NET-8-8-8-0-2— Google's DNS address block (8.8.8.0/24)NET-104-16-0-0-1— Cloudflare's allocation (104.16.0.0/12)NET-15-0-0-0-1— HP's legacy block (15.0.0.0/8)
The NetName is freeform but follows conventions:
GOGL— Google's 8.8.8.0/24 blockCLOUDFLARENET— Cloudflare's allocationHP-INTERNET— Hewlett-Packard's legacy blockDNIC-NET-215— Defense Network Information Center's blockELI-NETBLK5— Electric Lightwave's fifth network block
The pattern: an abbreviation of the organization, often followed by a descriptor like NET, NETBLK, or a number indicating which block it is (companies with multiple allocations number them).
RIPE NCC (Europe, Middle East, Central Asia)
RIPE uses the inetnum object type with a netname attribute. Names must start with a letter, contain only uppercase letters, digits, and hyphens3.
Examples:
RIPE-NCC— RIPE's own infrastructure (193.0.0.0 - 193.0.7.255)NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK— A placeholder for address space that falls within RIPE's geographic region but is managed by another RIRTBIT-BUG— A specific assignment to an organization
RIPE also uses distinctive names for autonomous system blocks: RIPE-NCC-AS-BLOCK labels ranges of AS numbers delegated to the RIPE region.
APNIC (Asia-Pacific)
APNIC follows RIPE-style inetnum objects. Network names typically include the suffix -AP to indicate the Asia-Pacific region:
APNIC-LABS— APNIC's research projectsEXAMPLENET-AP— A typical organization assignmentAPNIC-103— APNIC's allocation of the 103.0.0.0/8 block
LACNIC (Latin America, Caribbean)
LACNIC names tend to follow a status model similar to RIPE. Network names are descriptive identifiers for the allocation.
AFRINIC (Africa)
AFRINIC follows the RPSL (Routing Policy Specification Language) conventions shared with RIPE and APNIC. Network names follow the same uppercase-and-hyphens format. An example: ORG-AFNC1-AFRINIC-20050414, which includes the organization identifier, registry name, and a date component.
Reading a WHOIS Record
When you run whois 8.8.8.8, you're following the same chain of custody that runs from Postel's notebook to today. Here's what comes back from ARIN:
Every field tells part of the story:
NetRange and CIDR define the boundaries. This is 256 addresses, from 8.8.8.0 to 8.8.8.255.
NetName (GOGL) is the human-readable label. Google abbreviated itself to four characters—common for large organizations with many blocks.
NetHandle (NET-8-8-8-0-2) is the database's unique identifier. The -2 at the end is a version number—this block has been re-registered at least once.
Parent (NET8) reveals the hierarchy. This /24 lives inside the 8.0.0.0/8 block. The parent block has its own record, its own network name, its own history.
NetType tells you how this space was obtained. The main types in ARIN's system:
| NetType | Meaning |
|---|---|
| Direct Allocation | ARIN allocated this block directly to the organization |
| Reallocation | An upstream organization delegated this block to a downstream customer, who can delegate further |
| Reassignment | An upstream organization assigned this block to an end user for their exclusive use—no further delegation allowed |
| Early Registrations | Legacy allocations from the pre-RIR era |
Other RIRs use different terminology. RIPE and AFRINIC distinguish between Provider-Aggregatable (PA) and Provider-Independent (PI) space. APNIC explicitly labels portability: ALLOCATED PORTABLE vs ALLOCATED NON-PORTABLE. But the concept is always the same: who gave this to whom, and can they give it to someone else?
The Legacy Blocks
The most interesting network names belong to the oldest allocations.
Before RIRs existed—before IANA was even formally named—Postel and his successors handed out entire /8 blocks to organizations that asked. Each /8 contains 16,777,216 addresses. In the 1980s and early 1990s, that seemed reasonable. The address space felt infinite.
The IANA IPv4 Address Space Registry reads like a time capsule2:
- 9/8 → IBM (August 1992)
- 12/8 → AT&T Bell Laboratories (June 1995)
- 17/8 → Apple Computer Inc. (July 1992)
- 19/8 → Ford Motor Company (May 1995)
Ford Motor Company owns 16.7 million IP addresses. More than many countries. The network name for HP's legacy block is HP-INTERNET—registered in 1994, still in the database thirty years later.
The US Department of Defense holds twelve /8 blocks—over 200 million addresses4. Their network names carry the prefix DNIC (Defense Network Information Center): DNIC-NET-215, DNIC-NET-006.
These legacy allocations are labeled Early Registrations in ARIN's database. They predate the modern system. They're fossils—evidence of an era when the Internet was small enough that one person could manage it with a notebook, and address space was given away like party favors because nobody imagined running out.
The Placeholder Names
Not every network name represents a real allocation. Some are placeholders—bureaucratic markers that prevent confusion.
RIPE maintains records with the netname NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK. This appears when you query an IP address that geographically falls in RIPE's region but is actually managed by a different RIR. The RIPE database has to say something about that address space. So it says: this isn't ours. Go ask someone else.
Similarly, ARIN maintains parent records like NET192 (NetHandle: NET-192-0-0-0-0) for the entire 192.0.0.0/8 range, even though that range is carved into thousands of smaller allocations managed by various organizations. The parent record is an umbrella—a container that says "everything in this range has been distributed, here's where to start looking."
These placeholder names serve the same purpose as a filing cabinet label. They don't identify an owner. They identify a location in the hierarchy.
Why This Matters
Network names exist for accountability.
When traffic from 8.8.8.0/24 does something malicious, someone needs to be held responsible. The network name GOGL leads to Google LLC, with abuse contacts, technical contacts, and administrative contacts. The chain is traceable.
When an ISP receives a block of addresses from ARIN, the allocation record—including its network name—is a public commitment: this organization is responsible for this address space. They must maintain accurate contact information. They must respond to abuse complaints. They must not use addresses outside their allocation.
The network name is the signature at each handoff. IANA allocates to APNIC (network name in IANA's registry: "APNIC"). APNIC allocates to an ISP (network name in APNIC's database: something like EXAMPLEISP-AP). The ISP assigns to a customer (network name: CUSTOMER-NET-1). Every link in the chain is documented, labeled, and traceable.
This is how the Internet maintains order without a single central authority controlling everything. It's a distributed system of trust, recorded in databases, identified by names that look cryptic but tell a clear story if you know how to read them.
How to Look Up Network Names
You can query any IP address and trace its chain of custody:
Command line:
ARIN (North America): https://whois.arin.net RIPE NCC (Europe): https://apps.db.ripe.net APNIC (Asia-Pacific): https://wq.apnic.net LACNIC (Latin America): https://query.milacnic.lacnic.net AFRINIC (Africa): https://whois.afrinic.net IANA (master registry): https://www.iana.org/whois
If you're unsure which RIR manages a given address, start with IANA. It will tell you which RIR received the parent block, and that RIR's database will have the detailed records.
Try querying your own IP address. Somewhere in the record, there's a network name—a label that connects your connection to the global chain of custody that started in Jon Postel's notebook.
Frequently Asked Questions About Network Names in Internet Registries
Var den här sidan till hjälp?