169.254.0.0/16: link-local addresses
169.254.0.0/16 is the IPv4 link-local range (RFC 3927). A device gives itself an address here when it gets no answer from DHCP, and the address only works on the local link. In the cloud, 169.254.169.254 is the instance metadata service.
169.254.0.0/16 is 65,536 addresses: 169.254.0.0 to 169.254.255.255. 65,534 usable for hosts (the first is the network address, the last is broadcast).
- Network
169.254.0.0- First usable
169.254.0.1- Last usable
169.254.255.254- Broadcast
169.254.255.255- Addresses
65,536- Usable hosts
65,534- Netmask
255.255.0.0- Wildcard (ACL) mask
0.0.255.255- Historic class
B- Range type
Link-local · not routed on the internet
Special-purpose range
Link-local 169.254.0.0/16 RFC 3927
Self-assigned when no DHCP server answers, and valid only on the local link. 169.254.169.254 is the metadata service on most cloud platforms.
Split it into subnets
4 subnets.
| Subnet | Usable range | Hosts | Broadcast |
|---|---|---|---|
169.254.0.0/18 | 169.254.0.1 – 169.254.63.254 | 16,382 | 169.254.63.255 |
169.254.64.0/18 | 169.254.64.1 – 169.254.127.254 | 16,382 | 169.254.127.255 |
169.254.128.0/18 | 169.254.128.1 – 169.254.191.254 | 16,382 | 169.254.191.255 |
169.254.192.0/18 | 169.254.192.1 – 169.254.255.254 | 16,382 | 169.254.255.255 |
Is this IP in the range?
Range to CIDR blocks
What to know
If a computer shows a 169.254.x.x address, it almost always means DHCP failed: the cable, Wi-Fi association, VLAN or DHCP server is the problem, not the IP settings. Windows calls this APIPA. Hosts pick from 169.254.1.0 to 169.254.254.255; the first and last /24 are reserved.
AWS, Google Cloud, Azure and others serve instance metadata (instance ID, network config and temporary credentials) at 169.254.169.254. AWS also uses 169.254.169.253 for its DNS resolver and 169.254.169.123 for its time service.
Gotchas
- Server-side request forgery (SSRF) bugs that let an attacker make your server fetch http://169.254.169.254/ can leak cloud credentials. On AWS, require IMDSv2, which needs a session token obtained with a PUT request; Google Cloud and Azure require a special request header.
- Routers do not forward link-local traffic. Containers and VMs behind extra network hops may need explicit settings (on AWS, the IMDSv2 hop limit) to reach the metadata service.
Related explainers
- 127.0.0.0/8: loopback127.0.0.0/8 is loopback: every address from 127.0.0.1 to 127.255.255.254 refers to the local machine. How...
- 100.64.0.0/10: shared address space100.64.0.0/10 is shared address space for carrier-grade NAT (RFC 6598), 100.64.0.0 to 100.127.255.255. Why...
- fe80::/10: IPv6 link-localfe80::/10 is the IPv6 link-local range. Every IPv6 interface has an fe80:: address, valid only on its own...
- Private IPv4 address ranges (RFC 1918)The three private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Their sizes, exact...