# Carrier-grade NAT (CGNAT)

Carrier-grade NAT puts many subscribers behind one public IP address, so one address is many people and a per-address decision reaches all of them.

Date: 2026-09-12

Updated: 2026-10-02

Carrier-grade NAT is address sharing at the operator's scale: because there are not enough IPv4 addresses for every subscriber, a mobile carrier or a large ISP gives each customer a private address from the 100.64.0.0/10 block reserved for the purpose (RFC 6598) and translates it to one public address shared by hundreds or thousands of them. The public address a server sees is the carrier's gateway, and it changes as the handset moves.

## What Spaw answers

Two things follow. The shared-address block itself, 100.64.0.0/10, answers `reason: reserved_range` and is free, because it can never be a public visitor. And a carrier's public gateway addresses are where `is_mobile` matters: the flag comes from a curated, positive-only list of mobile-carrier autonomous systems, and `connection_type` reads `mobile` for them. Their located city is the gateway's, so `location_confidence` answers `low` for them even where the carrier's own geofeed names it. Nothing in the answer can separate one subscriber behind that gateway from the next.

## What it does not mean

A block or a rate limit keyed on a CGNAT address hits everyone behind it, which is a lot of innocent handsets. The velocity count in `seen_by_you` and any outcome you report are keyed by address too, so on a mobile network they describe the gateway, not the person; use them with that in mind, and prefer the signals that travel with the session rather than with the address.

Reference: https://spaw.co/glossary/cgnat