The internet's addressing problem

This week on African infosec

Author

CybAfrique Media
July 25, 2026

CybAfriqué is a space for news and analysis on cyber, data, and information security on the African continent.

HIGHLIGHTS

The internet's addressing problem

Everything has an IP address. Your phone has one, so does your laptop, your router, and that smart TV. The Internet Assigned Numbers Authority allocates large blocks of numbers to five regional internet registries around the world, and for Africa and the Indian Ocean islands, that registry is AFRINIC. 

AFRINIC then allocates smaller blocks to internet service providers and other members, who assign individual addresses down to your device.

IP assignment is also good business. Sometimes, it ends in criminal corruption investigations and years of receivership. We have written about this before.

The current world functions on IPv4, which was built in the late 1970s by Vint Cerf and Bob Kahn for the US Defense Department's ARPANET, and formally standardised in September 1981. IPv4 is based on a 32-bit addressing scheme, and it yielded a little over 4.3 billion addresses. 

But with your two phones and home WiFi router and laptop and smart doorbell each needing their own address, it's no wonder these addresses are running out; the global pool of unassigned IPv4 has been exhausted region by region since 2011, with AFRINIC the second-to-last registry to run dry, in April 2017. 

IP addresses are being recycled through carrier-grade NAT, where an ISP shares one public address across thousands of customers, and through an increasingly aggressive resale and lease market. Unused blocks now sell for roughly $30 to $55 apiece depending on the region, with African addresses trading at the low end. 

This is bad for security, since it gets much harder to trace who is actually behind an address once it has been subleased through two or three brokers, and it's bad for the continent's own growth, since Africa holds only about 2 to 3 percent of the world's IPv4 space to begin with.

So Algeria and a handful of other African governments are racing to get ahead of the problem with IPv6. Algeria's Minister of Post and Telecommunications, Sid Ali Zerrouki, announced in mid-July 2026 that the country would accelerate its IPv6 rollout following a meeting with AFRINIC on internet governance and digital sovereignty, an ambition that had stalled since AFRINIC allocated the country's first IPv6 blocks back in 2011. 

The type of IP determines how data intended for your device is routed. Devices connecting over LTE or 5G, for instance, are built around IPv6 by design. 3GPP, the body that writes mobile network standards, published IPv6 device profiles for cellular hardware because carriers ran out of room to keep handing out IPv4 addresses to every new phone. Older fixed-line infrastructure and a lot of legacy enterprise and consumer routers, on the other hand, are still IPv4-only.

IPv6 is based on a 128-bit addressing scheme, which sounds like a small step up from IPv4's 32 bits but yields about 340 undecillion possible addresses. It was also designed with security in mind from the start. IPsec, the protocol suite that authenticates and encrypts traffic between devices, was originally written into the IPv6 specification as a mandatory feature, later relaxed to optional in practice, but still far more commonly deployed on IPv6 networks than on IPv4 ones. 

IPv6 is also simpler to route, since it does away with the need for NAT altogether, and it lets devices configure their own addresses automatically. According to Google's own measurement of traffic to its services, which crossed the 50 percent mark for IPv6 access for the first time in March 2026, adoption is most concentrated in France (73 percent), India (72 percent) and Saudi Arabia (65 percent), but it is spreading, including, as noted, in Senegal, Tunisia and Kenya, even as most African and Central Asian countries remain far behind.

But the old IPv4 model will rule for the next few years regardless. It's easier on the human mind (nobody wants to memorize a 32-character hexadecimal string when four short numbers separated by dots will do), it requires less new infrastructure to keep running, and, quite literally, the entire internet as we know it has been built around it. 

Changing over will require running IPv4 and IPv6 side by side for years, retraining engineers, and, increasingly, government mandates forceful enough to actually move the needle, since the market alone hasn't managed it. IPv4 has technically been exhausted everywhere since 2019, and it's still carrying roughly half of global internet traffic.

In Kenya, as part of a broader measure to regulate devices, the government is forcing IMEI registrations and mandating that all devices imported into the country have IPv6 capacity. The Communications Authority of Kenya's new Communications Equipment Distributor licence, which took effect on July 21, 2026, requires anyone importing or wholesaling phones, routers or modems to hold a licence costing KES 250,000, submit each device's IMEI number to the Kenya Revenue Authority, and prove that any internet-connected device meets IPv6 requirements before it can clear customs. We've also written about mandatory IMEI-based electronics regulations before, here.

FEATURE

HEADLINE

ACROSS THE WORLD

Reply

or to participate.