resolving…

127.0.0.1

the address that never leaves the building.

A packet sent here never reaches a cable. The kernel turns it around before it touches the network card. It is the most-used address on Earth and the only one guaranteed to mean you. This is a field guide to it — where the number came from, why IPv4 burned 16.7 million addresses on a job that needed one, and every strange way to spell it.

loopback · packet 1 of ∞

you are here
rtt 0.000 ms mtu 65536 loss 0%
01

say it another way

runs in your browser

127.1, 2130706433 and 0x7f000001 are all the same address. That's inet_aton(): when you give it fewer than four parts, the last one absorbs all the remaining bytes — and every part may be decimal, octal (leading zero) or hex (0x). Type anything below and watch it resolve. This is the real algorithm, not a lookup table.

$ ping
try
waiting for input
dotted quad
32-bit value
hex
binary
02

three things that are not the same

this is the bug you keep hitting

localhost

a name

A special-use domain name (RFC 6761, 2013). Resolvers are supposed to answer it locally and never send it to a DNS server.

It can resolve to ::1 before 127.0.0.1. If your server bound only to IPv4, localhost fails while 127.0.0.1 works. That's the classic "connection refused" that makes no sense.

127.0.0.1

an address

One specific IPv4 loopback address out of 16,777,216. No name resolution involved, no ambiguity, IPv4 only.

Routers must drop any packet with a 127/8 address that appears on a real network (RFC 1122). It cannot travel.

0.0.0.0

a wildcard

Not a destination. When a server binds it, it means "every interface I have" — which is why your dev server is suddenly reachable from the coffee shop wifi.

In Aug 2024 Oligo Security showed browsers would let a public website POST to 0.0.0.0 and land on your localhost services. An 18-year-old hole. Windows was immune — it blocks it at the OS.

03

the /8 that got away

16,777,216 addresses, one job

IPv4 has about 4.3 billion addresses and we ran out. One in every 256 of them is reserved for talking to yourself. IPv6 looked at this and assigned exactly one: ::1/128. There is an active IETF draft to claw most of 127/8 back for normal unicast use.

16,777,216ipv4 loopback addresses
1ipv6 loopback addresses

Every cell is 65,536 addresses. The lit one is 127.0.0.1. On Linux the whole block already answers — try it.

04

how 127 got the job

nobody planned this
Sep 1981RFC 790

Jon Postel lists network 127 as "reserved" — and doesn't say what for. His habit was to hold back the first and last network of every class. Class A ran 0–127, so 127 was simply the last one on the shelf. No technical reason. No plan.

19834.2BSD

Bill Joy and Sam Leffler wire 127.0.0.1 into the loopback code. 4.2BSD spreads everywhere, and the convention becomes fact by shipping — the way most standards actually happen.

1986RFC 990

Postel and Joyce Reynolds write down what the code has already been doing for three years. The documentation catches up with the implementation.

Oct 1989RFC 1122 §3.2.1.3

The rule gets teeth: 127.0.0.0/8 is the internal host loopback address, and it must never appear on a network outside the host. A whole Class A, locked, forever.

1998IPv6 · ::1/128

Learning from the waste, IPv6 assigns loopback exactly one address out of 340 undecillion. Sixteen million down to one.

Feb 2013RFC 6761

"localhost" becomes an official special-use domain name. Resolvers should answer it themselves and never leak it to a DNS server — which, in practice, they sometimes still do.

Aug 20240.0.0.0 Day

Oligo Security discloses that Chrome, Firefox and Safari all let public websites reach services on your machine through 0.0.0.0, sidestepping CORS and Private Network Access. The bug was roughly 18 years old.

nowdraft-schoen-intarea-unicast-127

An IETF draft proposes returning most of 127/8 to ordinary use, keeping only what's actually needed. Forty years on, someone is finally trying to tidy up.

05

ports you already know by heart

no lookup needed
addresswhat's listening# note
127.0.0.1:3000a Node app# the default default
127.0.0.1:5173Vite# the new 3000
127.0.0.1:8080something in Java, probably# or a proxy you forgot
127.0.0.1:5432PostgreSQL# still running from last year
127.0.0.1:6379Redis# do not expose this one. ever.
127.0.0.1:631CUPS# your printer has a web server. it has opinions.
127.0.0.53:53systemd-resolved# yes, that's a different loopback address
127.0.0.1:11434Ollama# the GPU is warm for a reason

Browsers treat http://localhost, 127.0.0.0/8 and ::1/128 as potentially trustworthy origins. That's why service workers, getUserMedia and the other HTTPS-only APIs work on your dev server without a certificate. The reasoning is simple: the bytes never left your machine, so there was nothing to intercept.

06

ask it yourself

try: rfc 1122
guest@localhost — /home/nobody
guest@localhost:~$

type help · for history · everything runs in your browser and touches nothing