IP address management, IPAM, is your record of the address space you hold: how you have divided it and what each prefix and address is used for. It hands out no addresses, which DHCP does, and answers no queries, which DNS does: it is the plan the servers, the firewalls and the registry's records should agree with. For a block you lease or buy, the registry's side belongs in it too.
What an IPAM does
- The address plan. A hierarchy from the blocks you hold down to single addresses: NetBox, for example, starts from an aggregate assigned to its registry, then prefixes, ranges and addresses. IPv6 plans run on 4-bit boundaries, commonly a /48 per business site.
- How full each prefix is. Registries ask for these numbers: the RIPE NCC can audit what sits behind an aggregated assignment, and ARIN tests how much of a block is used before it approves some transfers.
- DHCP and DNS. Tools that also run them are sold as DDI: DNS, DHCP and IPAM together.
- What is really in use. Discovery compares the plan with what answers on the network, and flags conflicts.
- A history of changes, and an API for automation.
How it relates to the registry
The registry holds the public side of the same facts, and each registry has its own rules:
| Record | What it says | The rule |
|---|---|---|
RIPE Database inetnum and inet6num | Who holds a block and who uses it, with a status: allocated, assigned, sub-allocated, aggregated by the LIR, PI or legacy | "All assignments and allocations must be registered in the RIPE Database", and the data "must be correct at all times" (RIPE-826) |
| ARIN reassignments and reallocations | Which customer uses part of a provider's block | Filed for a /29 or more of IPv4 and a /47 or more of IPv6, and visible within seven days (ARIN's NRPM) |
APNIC inetnum and inet6num | The same, and they can be marked private | Required for delegations larger than a /30 of IPv4 or a /48 of IPv6, with an incident response team object validated every six months (APNIC-127) |
| ROA | Which ASN may announce a prefix, signed by the holder | Keep it minimal: RFC 9319 asks operators to avoid the maximum length field |
| Route object | A prefix and its origin ASN, for route filters | In the RIPE Database, authorized by the address space's own maintainers |
| Reverse DNS | Who answers for the block's PTR records | Delegated per /24 for IPv4 and per 4-bit boundary for IPv6 |
For leased space, the holder signs the ROA. In the RIPE NCC region the holder's certificate covers the prefix and may name any ASN as its origin; at ARIN, space a provider has reassigned cannot go on the customer's own certificate, so the provider submits the ROA on the customer's behalf.
What to record when you lease or buy a block
- The block: prefix, registry, and the day you received it. For a purchase that date matters: at the RIPE NCC, IPv4 received through a transfer cannot move again for 24 months; at ARIN, an organization that received space in the past 12 months cannot transfer any out, and space from ARIN's waiting list is locked for 60 months.
- Its registry records: the status, the object names and handles, the maintainers, and who the legal holder is if that is not you.
- How a lease is registered: an assignment object for you, or at the RIPE NCC a temporary transfer, which returns the block to its holder on the date in the transfer agreement.
- The contract: start, end, renewal and notice, and what the lease says about readdressing.
- For a purchase: the transfer type, the registry's ticket numbers, the date it was registered, and the documents.
- Routing: each ROA (prefix, origin ASN, maximum length, who created it), each route object, and each letter of authorization with its scope and date.
- Reverse DNS: the zones and their name servers.
- Location: the geofeed URL and its entries, and any open correction requests with location databases.
- The abuse contact, and when the registry last validated it.
- Reputation at handover: blocklist results with their dates (IP blacklisting).
- What the previous holder left: old ROAs, route objects and geofeed entries, until they are cleaned up.
- The hand-back: the return date, and what has to be removed then.
IPAM tools in 2026
Checked on 16 October 2026; every one was current that day.
| Tool | Kind | What it is |
|---|---|---|
| NetBox | Open source (Apache 2.0), with paid cloud and enterprise editions | A network source of truth: IPAM and data center inventory, modeling the network as it should be |
| Nautobot | Open source (Apache 2.0), with paid editions | A fork of NetBox, built around automation |
| phpIPAM | Open source (GPL 3.0) | A light web IPAM with subnet scanning, an API and an import from the RIPE Database |
| NIPAP | Open source (MIT) | A prefix-centric IPAM for service providers |
| Infrahub | Open source (Apache 2.0), with an enterprise edition | A source of truth with branches, like Git, and IPAM with resource pools |
| Infoblox | Commercial | DDI appliances (NIOS) and a cloud-managed DDI (Universal DDI, which replaced BloxOne DDI in 2025) |
| BlueCat | Commercial | Integrity for enterprise DDI, and Micetro, formerly Men&Mice, as a layer over existing DNS and DHCP |
| EfficientIP SOLIDserver | Commercial | A DDI suite, with a module that files RIPE Database updates |
| SolarWinds IP Address Manager | Commercial | IPAM with scanning, conflict detection and DHCP management |
| ManageEngine OpUtils | Commercial, with a free edition | IPAM with a switch port mapper |
| Device42 | Commercial | An inventory and discovery platform with IPAM built in |
| Windows Server IPAM | Built into Windows Server | IPAM for Microsoft DHCP and DNS, with a field for the registry and the date a block was received |
| Amazon VPC IP Address Manager | AWS, free and advanced tiers | Plans and tracks address space across AWS accounts and regions, including addresses you bring; the advanced tier can watch the ROAs of those |
| Azure Virtual Network Manager IPAM | Azure | Pools that hand non-overlapping ranges to virtual networks |
Two names that turn up in older guides have moved on: Nokia's VitalQIP now belongs to Cygna Labs, and Cisco's Prime Network Registrar no longer includes IPAM. Google Cloud has no separate IPAM product; it handles IPAM inside a VPC through internal ranges.
Where RTM Networks fits
Every lease from us includes reverse DNS and RPKI, and geolocation corrections on request: we set up the block's ROA and reverse DNS with you, a geofeed reference when you ask for one, and the Letter of Authorization your upstream or cloud provider asks for. Ask us for the registry details your IPAM needs.
Contact
Need address space, or a hand with your registry?
Tell us what you need: a block to lease or buy, IPv6, or an AS number through our sponsorship. We usually reply in 1-3 business hours.
