The IPv4 Exhaustion Crisis
Think of IPv4 addresses like phone numbers in a city that's grown too large. At some point, the phone company runs out of unique numbers to assign. The internet hit this wall with IPv4: there are exactly 4,294,967,296 possible addresses, and the last unallocated blocks were distributed to regional registries in 2011. Yet billions of new devices come online every year. Something had to give.
The answer ISPs landed on is Carrier-Grade NAT (CGNAT), also known as Large Scale NAT (LSN). To understand it, you first need to understand regular NAT.
Regular NAT (what your home router does): Your ISP gives your router one public IP address — say 203.0.113.5. Every device in your house (phone, laptop, TV) gets a private IP like 192.168.1.x. When your laptop makes a request to Google, your router rewrites the source address from 192.168.1.10 to 203.0.113.5, sends it out, and keeps a table so it knows to route Google's reply back to your laptop. From the internet's perspective, all your devices look like one machine.
CGNAT adds a second layer of this same trick. Instead of giving your router a real public IP, the ISP gives it a private IP from a special reserved range. The ISP's own massive edge routers then perform NAT on behalf of thousands of customers simultaneously before traffic reaches the public internet. Your traffic passes through two NAT translations before it reaches its destination.
This architecture is often called NAT444, describing the three address spaces the packet traverses:
| Hop | From | To | Address Type |
|---|---|---|---|
| 1 | Your device | Your home router | Private (e.g., 192.168.1.x) |
| 2 | Your home router | ISP edge router | ISP private (e.g., 100.64.x.x) |
| 3 | ISP edge router | Internet | Public (e.g., 203.0.113.x) |
The economic result: One public IP address can be shared by hundreds or even thousands of customers simultaneously. For a mobile carrier with 10 million subscribers, this means they might need only tens of thousands of public IPs instead of millions.
The critical architectural implication for engineers: every assumption you make about a user having a unique, reachable IP address breaks under CGNAT. Logging, rate limiting, geolocation, port forwarding, and peer-to-peer connectivity all behave differently — and often incorrectly — when CGNAT is in the picture.