The tool page is tamperbox.dev/what-is-my-ip. It has no input box: opening it reads your connection and shows the address in large type, with the network it belongs to, and a device test checks IPv4 and IPv6 separately. This page is the long version: where each value comes from, why the page never shows a sample address, how the device test works, and how to use the result for an allowlist or a support ticket.

Where processing happens: opening the page sends one request to the Tamperbox server, which reads the address your browser connected from and the network metadata of that connection, returns that observation. The device test runs only when you press it: your browser sends two requests to the public echo service ipify, one over IPv4 and one over IPv6, without cookies or a referrer. Nothing else is sent, and the address is never passed to advertisers.

What the tool answers

1. What address does the internet see for me? The source address of this connection.
2. Is it IPv4 or IPv6? The family this connection used.
3. Whose network is it? The organisation, AS number and estimated country from the connection’s metadata.
4. Does the other family work too? After the device test: whether this device also reaches the internet over IPv4 and over IPv6, and with which address.

Inputs

There is nothing to type. The page reads the connection it was loaded over. Check again repeats the read, which is useful after switching a VPN on or off, or moving between Wi-Fi and mobile data. Arriving from another tool with a value does not change anything: the address is always read, never taken from the page.

The page never shows a sample address. A made-up address on a “what is my IP” page could be copied into a firewall rule; if the read fails, the page says “Unavailable” and the device test still works without our server.

Reading the result

Your public IP address

The address in large type, with Copy address, and a line naming the network and country. The label says the family: “Your public IPv4 address” or “Your public IPv6 address”.

Verdict and chips

Verdict	When
Connected over IPv4	The connection used IPv4 and the device test has not run
Connected over IPv6	The connection used IPv6
IPv6 works too	The connection used IPv4 and the device test reached the internet over IPv6
Connected over IPv4. No IPv6 found from this device	The IPv6-only request did not complete (a warning)
Your address could not be read	The server read failed

The chips say which families work, and “IPv6 not tested” until the device test runs.

Findings

The caveats for this connection, worst first; see the Finding reference.

IPv4 and IPv6

Two lanes, one per family: Works (with the address), Not found, or Not tested, and the device test button with the hosts it contacts.

Your network

Network name, autonomous system and country, with a link to the full connection details.

Take it further

These links carry values derived from the current result. A link is absent when its required evidence is missing; the tool does not invent a target.

Destination	Value and condition
ASN Lookup	The public address reported for this connection
Reverse DNS	The same observed address
BGP Route Lookup	The same observed address
ASN Lookup for IPv6	The device test’s IPv6 address, when the page connection used IPv4 and the IPv6 test succeeded

Check the rest opens related pages without carrying the address. Take it further is the explicit address transfer. These pages have no editable source, Break it, Heal it or input History; Check again refreshes the connection reading.

What this result means

Six cards explain the current findings: Ask your agent, In plain words, What does it mean?, What good looks like, How to fix it, and Tool limitations. Expand a card to read the explanation and its method or guide link. Copying an agent prompt does not run another check. The cards interpret the evidence already shown; they are not an additional measurement or an independent confirmation.

If the connection reading fails or no result is available, result-specific cards clear and contextual links disappear. Read the verdict before relying on a card, and distinguish a missing observation from a confirmed negative result.

Method

1. Reading the connection

The server takes the address from the CF-Connecting-IP header set by Cloudflare’s edge for every request, not from any header the browser can set. When the edge replaced an IPv6 address with a pseudo IPv4 address (one from 240.0.0.0/4), the real IPv6 address from CF-Connecting-IPv6 is used instead. The family is that address’s version. The network name, AS number and country come from the edge’s connection metadata (request.cf.asOrganization, asn and country); they describe the network the address belongs to, not the person. No other header is consulted, so a forwarded-for header cannot change the answer.

2. Why one connection shows one family

A browser opens each connection over one family. With both available, most clients prefer IPv6 and fall back to IPv4 quickly when IPv6 is slow (“Happy Eyeballs”, RFC 8305, section 5). So a page reached over IPv4 cannot tell whether IPv6 works, and the server answer says so: an IPv4 request returns “not tested”, never “IPv6 unavailable”.

3. The device test

Pressing the test makes two requests from your browser at the same time: https://api.ipify.org?format=json, which answers over IPv4 only, and https://api6.ipify.org?format=json, which answers over IPv6 only. Each has a 5 second limit, sends no cookies and no referrer, and must return a small JSON body (at most 1 KiB) whose address is of the expected family. A request that fails, times out, is blocked or returns the other family counts as “inconclusive”, not “missing”: a content blocker, a DNS filter, a firewall or an outage of the echo service all look the same.

The test runs in the browser on purpose: a server-side request would test the server’s connectivity, not yours.

4. Findings

Rule	Condition	Finding
No IPv6	The connection used IPv4 and the IPv6-only request did not complete	CHECK
Two addresses	The connection used IPv4 and the IPv6-only request returned an address	INFO
IPv6 rotates	The connection used IPv6	INFO
VPN or proxy	An address was read	INFO

The rotation note follows RFC 8981: devices form temporary addresses (section 3.4) with a default preferred lifetime of one day and a valid lifetime of two (section 3.8), so the address a site sees changes about daily while the provider may also change the delegated prefix.

Standards and conformance

Specification	Sections used	How the tool applies them	Where it stops
RFC 4291 IPv6 addressing	2.5.4	Addresses are shown in their canonical compressed form	The page does not split prefix and interface ID
RFC 8981 temporary addresses	3.4, 3.8	Explains why an IPv6 address changes	Obsoletes RFC 4941
RFC 8305 Happy Eyeballs v2	5	Explains why one connection shows one family
RFC 6598 shared address space	4	Background for carrier-grade NAT: the address shown is the provider’s gateway	The page cannot see your router’s WAN address
RFC 1918 private addresses	3	Your device’s address at home is private and never shown here

Finding reference

Finding	Severity	What it means for you	Fix
No IPv6 from this device	CHECK	The IPv6-only request failed; other destinations or routes may still work	Enable IPv6 in the router; ask the provider; test without blockers
This device has two public addresses	INFO	Logs and allowlists may show either	Account for both families under your access policy
Your IPv6 address may change	INFO	Temporary addresses rotate about daily	Confirm the assigned prefix and authorize only the intended scope
A VPN or proxy changes this address	INFO	The address shown may be the exit of a tunnel	Check again with it off to compare

Guide

Adding your connection to a firewall allowlist

1. Read the address and its family here.
2. For IPv4, allowlist the address; ask your provider whether it is static, because many home addresses change after a router restart.
3. For IPv6, confirm the assigned prefix and its stability with your network administrator. Do not infer authorization scope from four printed groups: compressed notation can omit groups, and permitting a /64 permits many devices. Use the narrowest scope that meets the access policy.
4. Run the device test and account for both families if the destination uses both, subject to the same access policy.

Giving your address to support

Copy address puts it on the clipboard. Mention the time and whether a VPN was on: an address is only meaningful together with when it was used.

IPv6 missing

Look for IPv6 in the router’s WAN or internet settings (often “IPv6”, “DHCPv6” or “prefix delegation”), and ask your provider whether your plan includes it. Then run the device test again.

Reading the network row

The network row names the organisation that announces your address (your provider, a mobile operator, a VPN company or a cloud provider), its autonomous system number, and the country the edge associates with the connection. A VPN or private relay shows the relay operator here, which can help compare before and after an intended network change but does not prove that every application uses the tunnel. A mobile connection often shows a country or city far from you, because mobile operators route traffic through a few central gateways. None of these values locates a household: the provider holds the mapping from address to customer and its subscriber records are not part of this tool.

Why the address is shared

Your devices at home have private addresses (RFC 1918, section 3), such as 192.168.1.20, that never appear on the internet. The router translates them to its one public address, so every phone and laptop at home shows the same address here. Some providers add a second translation, carrier-grade NAT, and many customers then share one public address; your router’s own WAN address is then in 100.64.0.0/10 (RFC 6598, section 4) and differs from the address on this page. With IPv6 there is usually no translation: each device has its own global address within the prefix your provider delegates, which is why the IPv6 lane can show an address no other device at home uses.

Confirm without Tamperbox

curl -4 https://api.ipify.org
curl -6 https://api6.ipify.org

The first prints your IPv4 address, the second your IPv6 address or an error if that request cannot complete.

Worked example

On a typical home connection over IPv4, the page shows the router’s public address with the provider’s name and country, the verdict “Connected over IPv4”, and “IPv6 not tested”. Pressing the device test sends the two echo requests. If the IPv6 request returns an address, the verdict becomes “IPv6 works too”, both lanes read Works, and a finding notes that the device has two public addresses. If it fails, the verdict warns that no IPv6 was found, and the findings lists the router and provider steps. This page never shows a sample address, so there is no fixed example to describe.

For agents

Through the Tamperbox MCP server, what_is_my_ip describes the connection of whatever calls it: the agent’s outbound service or gateway, not the person using the agent. The result carries that warning. Use it to learn the request source seen by the service, never to answer “what is my IP” for a user; send the user to the page instead.

See Connect an MCP client and Security and privacy. ASN Lookup explains the network behind an address.

Transfers to another tool

Ordinary tool links carry no input. Explicit result actions can carry the domain, address or other value supplied by the displayed result to another page. The shared navigation stores that value temporarily in tab-scoped sessionStorage, accepts a transfer for at most one minute, and puts a random transfer token in the URL fragment. The input itself is not placed in the URL. The receiving page consumes the transfer and applies its own input rules; tools with a manual Run button still require that action for live checks. This is not a saved result, and the destination can send the value to the services it needs. Ordinary edits and lookups do not create a durable report archive.

Limits

• One connection, at one moment; Check again after any network change.
• A VPN, proxy or private relay is shown in place of your connection.
• The country is an estimate for the network.
• A failed device test is inconclusive.
• The address is shown to you and not stored.

References

• RFC 4291, IP Version 6 Addressing Architecture: section 2.5.4.
• RFC 8981, Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6: sections 3.4 and 3.8. Obsoletes RFC 4941.
• RFC 8305, Happy Eyeballs Version 2: section 5.
• RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space: section 4.
• RFC 1918, Address Allocation for Private Internets: section 3.