IP List Sorter & Deduplicator
Paste a list of IP addresses — one per line — then sort, deduplicate, or filter by public or private range. Sorting is numerical (not lexical), so 10.0.0.2 comes before 10.0.0.10.
Reviewed by the ToolNestr Editorial Team — July 2026
Process IP list
How IP list processing works
Processing a list of IP addresses may seem straightforward, but doing it correctly requires careful attention to sorting order, duplicate detection, and address classification. The most common mistake in IP sorting is using lexical (string) ordering instead of numerical ordering. When sorted as strings, the IP 10.0.0.9 appears after 10.0.0.10 because the character "9" is greater than "1" in the Unicode collation sequence. This produces a counterintuitive and practically useless ordering for network engineers who need to scan ranges or identify gaps.
Correct numerical sorting treats an IPv4 address as a 32-bit unsigned integer. Each octet contributes 8 bits: the first octet is shifted left by 24 positions, the second by 16, the third by 8, and the fourth occupies the least significant byte. The resulting integer is then used as the sort key. For example, 192.168.1.1 becomes 3232235777 in decimal. Sorting by this integer value naturally groups addresses by their network prefix and produces the familiar sequential order that network professionals expect.
Deduplication is handled using a JavaScript Set object, which maintains a collection of unique values. As each valid IP is parsed from the input text, it is inserted into the Set. Duplicate entries are automatically rejected because a Set will not store a value it already contains. This approach is both simple and efficient for any reasonable input size. The tool also tracks how many total lines were entered (including duplicates and blanks) versus how many unique IPs were found, giving you clear visibility into your data quality.
Public versus private IP classification
The private IP detection follows RFC 1918, which reserves three ranges for private internal use. The 10.0.0.0/8 block covers all addresses from 10.0.0.0 to 10.255.255.255 — a single /8 that provides over 16 million addresses and is commonly used by large enterprises and cloud VPCs. The 172.16.0.0/12 block covers 172.16.0.0 through 172.31.255.255, providing roughly one million addresses often seen in medium-sized deployments. The 192.168.0.0/16 block covers 192.168.0.0 through 192.168.255.255, the most familiar range to home network users who see it in their router configuration pages.
Any IP address that does not fall into one of these three ranges is classified as public. This includes all other addresses like 8.8.8.8 (Google DNS), 1.1.1.1 (Cloudflare DNS), 203.0.113.0/24 (documentation range per RFC 5737), and everything else routable on the internet. Note that some addresses have special purposes — 127.0.0.0/8 is loopback, 169.254.0.0/16 is link-local, 224.0.0.0/4 is multicast — but these are not considered private under RFC 1918 and are classified as non-private by this tool.
The ability to filter public or private IPs from a mixed list is valuable in several scenarios. Security analysts reviewing firewall logs may want to isolate private-source addresses to investigate internal traffic patterns. Network architects planning IP migrations need to identify which addresses in a spreadsheet are routable versus reserved. Cloud engineers configuring VPC peering connections need to ensure that overlapping private ranges are detected before linking networks together. The filtering buttons make these tasks instantaneous.
Common use cases
Cleaning up DHCP lease lists
DHCP servers often show lease lists with duplicates, expired entries, and out-of-order addresses. Pasting the active IPs into this sorter gives you a clean, sorted inventory of all assigned addresses in your subnet, making it easy to spot address exhaustion or reservation gaps.
Auditing firewall rule logs
Firewall logs contain both public source IPs (internet traffic) and private destination IPs (internal hosts). Filter out the private or public subset to analyze traffic patterns by address class. The numerical sort order also helps correlate with other sorted log data sources.
Preparing IP lists for tools
Many network tools expect sorted, deduplicated IP lists as input — ping sweeps, port scanners, and configuration management scripts all benefit from clean input. Running a raw list through this sorter ensures you are not wasting time scanning duplicate or out-of-range addresses.
VPC peering conflict detection
When setting up VPC peering between cloud environments (AWS, Azure, GCP), you must ensure the CIDR blocks do not overlap. Pasting the route tables from both VPCs into the sorter and sorting them numerically helps you quickly identify overlapping private ranges before attempting the peering connection.
IP address structure primer
An IPv4 address is a 32-bit number conventionally written in dotted-decimal notation as four octets separated by periods (e.g., 192.168.1.1). Each octet is an 8-bit value ranging from 0 to 255. The total address space is 2^32 = 4,294,967,296 addresses. The Internet Assigned Numbers Authority (IANA) manages the global allocation of this space, delegating large blocks to Regional Internet Registries (RIRs) such as ARIN (North America), RIPE NCC (Europe), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa).
The original classful addressing scheme divided the address space into fixed-size blocks: Class A (0.0.0.0–127.255.255.255, /8 networks), Class B (128.0.0.0–191.255.255.255, /16 networks), and Class C (192.0.0.0–223.255.255.255, /24 networks). This was replaced by CIDR in 1993, which allows variable-length prefixes and much more efficient allocation. Private addresses were defined under the classful system but remain in use under CIDR because they were carved out of the classful space in a way that CIDR naturally accommodates.
Understanding IP structure is essential for this tool because the numerical sort key is derived directly from the 32-bit representation. The same integer that is used for comparison also determines whether an address falls into a private range — for example, any address whose first octet equals 10 is in the 10.0.0.0/8 private block. The 172.16.0.0/12 check requires that the first octet is 172 and the second octet is between 16 and 31 inclusive, which matches the bit pattern of 172.16.0.0 (10101100.00010000.00000000.00000000) with a 12-bit prefix.
Limitations
This tool processes IPv4 addresses only. IPv6 support would require 128-bit integer arithmetic and different parsing logic. The tool silently ignores invalid lines rather than reporting errors, so you should manually verify that the input count matches expectations. Very large lists (tens of thousands of IPs) may cause brief UI lag since all processing happens on the main thread — for production-scale processing of millions of addresses, command-line tools are more appropriate.
The public/private classification follows strict RFC 1918 rules. Some organizations use additional ranges like 100.64.0.0/10 (Carrier-Grade NAT, RFC 6598) or 198.18.0.0/15 (benchmarking, RFC 2544), which are not classified as private by this tool. If you need to include those ranges, you should manually filter the output or use a more configurable network tool.
Frequently asked questions
Why does numerical sorting matter for IP addresses?
Lexical (alphabetical) sorting compares strings character by character, so 10.0.0.10 appears before 10.0.0.2 because "1" is less than "2" after the second dot. Numerical sorting converts each IP to a 32-bit integer, producing the correct logical order: 10.0.0.1, 10.0.0.2, ..., 10.0.0.10. This is essential for subnet planning, log analysis, and firewall rule ordering.
What is considered a private IP address?
RFC 1918 defines three private IPv4 ranges: 10.0.0.0/8 (16.7 million addresses), 172.16.0.0/12 (1,048,576 addresses spanning 172.16.0.0 through 172.31.255.255), and 192.168.0.0/16 (65,536 addresses). These addresses are not routable on the public internet and are used exclusively within private networks such as home LANs, corporate intranets, and cloud VPCs.
How does IP deduplication work?
The tool uses a JavaScript Set to track unique IP addresses. As each IP is parsed and validated, it is added to the Set — duplicate entries are automatically discarded because a Set can only hold each unique value once. This is equivalent to running `sort -u` on a Unix command line but with correct numerical ordering rather than lexical sorting.
What happens to invalid IPs?
Invalid lines are silently ignored. This includes blank lines, whitespace-only lines, and lines that do not contain a valid IPv4 address (e.g., missing octets, values outside 0–255, extra characters). Tolerating extra whitespace and blank lines makes the tool convenient when pasting logs or config extracts without manual cleanup.
Can I use this with IPv6 addresses?
No — this tool processes IPv4 addresses only. IPv6 addresses are 128-bit and use hexadecimal colon notation, which requires a different parsing and sorting approach. For IPv6 sorting, consider a tool that converts addresses to 128-bit integers or uses BigInt arithmetic.
What is the difference between public and private IPs?
Public IPs are globally unique and routable on the internet — they are assigned by regional internet registries (RIRs) to ISPs and organizations. Private IPs are non-routable on the internet and can be reused across different private networks. NAT (Network Address Translation) allows multiple private IPs to share a single public IP when accessing the internet, which is how most home and office networks operate.
How does this compare to command-line tools?
On Unix/Linux, you can sort IPs numerically with `sort -t. -k1,1n -k2,2n -k3,3n -k4,4n` and deduplicate with `sort -u`. This web tool provides the same functionality in your browser without needing a terminal, plus adds public/private filtering with visual counts and a copy button. It is especially useful for non-technical users or when working on systems that lack standard command-line tools.
Why are 172.16.0.0 to 172.31.255.255 private?
The 172.16.0.0/12 range is a contiguous block of 16 class-B networks (172.16.x.x through 172.31.x.x) reserved by RFC 1918. Note that 172.32.0.0 and above are public addresses, as is 172.0.0.0 through 172.15.0.0. Many people assume the entire 172.x.x.x range is private, but only the 172.16.x.x–172.31.x.x subset falls under RFC 1918 — a common source of misconfiguration in firewall rules.