TL;DR: Some IPv4 addresses are reserved for documentation, loopback, link-local, or future use, and a random draw can still print them. They are the wrong sample when you meant “an ordinary public host,” and the right sample when you are teaching a validator to reject them. Know the famous blocks well enough to spot them before a config copies them. Generate a few on the random IP page and practice saying “reserved” out loud.
The health check that pinged itself
A developer added a configurable “upstream IP” to a service and, lacking a value, pasted a generated address into the example config that shipped in the repo. The address was 127.0.0.8. In the lab it happened to be harmless. In a container layout they copied for a demo, the health check followed the example and started probing the container’s own loopback, reported success, and hid a dead upstream for a day. Loopback is reserved so that 127.0.0.0/8 always means “this machine.” It is a terrible stand-in for a remote service and a perfect test case for a validator that should have refused it. The generator was not wrong to be able to produce it. The example config was wrong to keep it.
Blocks that should trigger a second look
You do not need the entire IANA registry in your head. You need the blocks that regularly confuse tools and docs. 0.0.0.0/8 is “this network” territory and a common way to say “unspecified,” not a host you dial. 127.0.0.0/8 is loopback. 169.254.0.0/16 is link-local. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are documentation. 224.0.0.0/4 is multicast. 240.0.0.0/4 is reserved. 255.255.255.255 is a broadcast, not a generator’s idea of a witty host. Private ranges are a related but separate list.
- 127.x.x.x: this machine. Never a remote example.
- 169.254.x.x: automatic link-local, often a DHCP failure.
- 192.0.2.x, 198.51.100.x, 203.0.113.x: safe documentation specimens.
- 224 and above: multicast or reserved, not an ordinary client.
- 0.x.x.x: do not use it as a server address in a tutorial.
Validators deserve these on purpose
If you are writing a form that accepts an IPv4 address, reserved blocks are how you test the error path. Generate or hand-pick one of each, and assert that the form explains the refusal. A form that accepts 127.0.0.1 as a “remote callback” will eventually be used against itself. A form that accepts 240.0.0.1 will eventually be copied into a firewall that surprises everyone. Rejection with a clear message is the feature. The generator is a convenient way to discover you forgot a case, if you actually look at what it printed.
The inverse bug is a validator that rejects documentation ranges in a documentation tool. A slide builder that forbids 203.0.113.5 will push authors back toward live addresses. Match the strictness to the product. A packet sender should be strict. A prose editor can allow the documentation ranges and warn on loopback.
Broadcast and network addresses
Even inside a block you own, the first and last addresses of a subnet are often not hosts. A generator does not know your subnet mask. A draw ending in .0 or .255 is not automatically illegal — masks vary — and it is a bad casual example because readers assume /24. If you did not mean to teach subnetting, draw again when you see those endings, or explain the mask in the same sentence.
A reject list for public writing
Before an address goes into a repo, a slide, or a ticket template, check loopback, link-local, documentation (allowed if labeled), multicast, and the 240/4 cloud. This takes less time than the health-check outage. If the draw is ordinary-looking and the audience is public, still prefer to swap in a documentation address. Reserved-and-labeled beats random-and-live. Reserved-and-unlabeled is how 127.0.0.8 shipped as an upstream.
0.0.0.0 means different things in different boxes
On one system 0.0.0.0 means “bind every interface.” On another form it is rejected as not a host. A generated or hand-typed 0.0.0.0 dropped into a tutorial as if it were a peer will be copied into a bind address and change the program’s exposure. If your paragraph is about listening on all interfaces, say that phrase, then mention 0.0.0.0 as the spelling that particular daemon uses. If your paragraph is about a remote peer, draw again. The same four zeros are a footgun precisely because they are famous.
Multicast is a similar footgun for logs. A line that shows 224.0.0.1 is group traffic, not a laptop you should put in a blocklist. Teach the first octet 224–239 as “stop and read” before students export a deny file from a noisy capture. The health-check bug was loopback. The next bug in the same team is usually multicast treated as a client.
Spot them, then choose them only on purpose
The developer did not notice 127 because the generator’s authority felt stronger than the first octet. Read the first octet every time. Keep loopback and multicast for the chapter about loopback and multicast. Keep documentation ranges for everything else you publish. The button can print reserved numbers. Your example config does not have to keep them.
