192.0.2.0/24: TEST-NET-1

192.0.2.0/24 is TEST-NET-1, one of three ranges RFC 5737 reserves for use in documentation and example code. It is guaranteed never to be routed on the public internet, which is why RFCs, vendor manuals, and textbooks use it instead of picking a real address.

Why documentation needs its own addresses

Before the reservation, authors wrote examples using whatever addresses came to mind. Those addresses belonged to real organisations, and readers copied the examples into real configurations. The result was traffic arriving at innocent networks from people following a tutorial, and support burden for whoever happened to own 10.1.1.1’s public equivalent that week.

RFC 5737, published in January 2010, formalised three blocks for the purpose and told authors to use them. It also documents the same reasoning behind example.com, example.net, and example.org, which RFC 2606 reserved for the same reason in the DNS.

Block	Name
192.0.2.0/24	TEST-NET-1
198.51.100.0/24	TEST-NET-2
203.0.113.0/24	TEST-NET-3

Three blocks rather than one, because an example that shows routing between networks needs at least two distinct networks, and an example with a client, a server, and a middlebox needs three.

Where the block sits

192.0.2.0/24 is carved out of 192.0.0.0/24’s neighbourhood, an area of IANA’s registry full of special assignments. 192.0.0.0/24 itself is the IETF Protocol Assignments block, which holds addresses such as 192.0.0.8 (the IPv4 dummy address) and 192.0.0.170 and .171 (NAT64 discovery). None of it behaves like ordinary unicast space.

Look up any address to see whether it falls in a special-purpose registry entry with /ip-lookup, which recognises reserved ranges and explains them instead of attempting a geolocation.

When you see it

• In RFC text, where it is the default example address.
• In Cisco, Juniper, and Palo Alto configuration guides.
• In API documentation showing a sample response containing an IP address.
• In test suites, where 192.0.2.1 is a safe value that no test can accidentally connect to.
• In a production configuration, where it means someone pasted an example and did not substitute their own values. This is the case worth acting on.

Using it deliberately

The guarantee that nothing routes makes the block useful beyond documentation. Test suites use it for addresses that must never resolve to a real host. Load generators use it as a source range when they need addresses that will not collide. Some networks use 192.0.2.1 as a blackhole next-hop for filtered routes, though a dedicated discard interface is cleaner.

What it should not be is a private LAN. RFC 1918 space is the correct choice, and a network numbered out of TEST-NET-1 will confuse every engineer who reads its diagram and every automated tool that classifies addresses.

What it is not

192.0.2.0/24 is not private address space, and it does not appear in the RFC 1918 list. It is not a real destination, so pinging 192.0.2.1 tests nothing. It is not assigned to any organisation, so a whois lookup returns IANA’s special-purpose registry rather than an owner. And an address in this range in a log is documentation residue or synthetic traffic, never a genuine visitor.