RFC 5737 reserves 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 for documentation, and RFC 3849 reserves 2001:db8::/32 for the same purpose in IPv6. Nothing in those ranges routes anywhere, which makes them the only truly safe addresses to paste into a test.
What you can control
- Documentation ranges by default, so a leaked fixture cannot point at somebody's server.
- Full IPv6 support, including the compressed
::form that trips up naive parsers. - CIDR suffixes for testing subnet logic, with sensible prefix lengths per version.
- Optional ports weighted toward the ones that actually appear — 80, 443, 8080.
What this is not
The arbitrary-public option generates addresses that may belong to a real network. Use documentation ranges unless you specifically need addresses outside them.
Questions
Which range should I use for tests?
Documentation, always, unless you have a specific reason not to. Those addresses are guaranteed unroutable, so a fixture that escapes into production cannot reach anything.
Why do IPv6 addresses have a double colon?
It compresses the longest run of zero groups. 2001:db8:0:0:0:0:0:1 becomes 2001:db8::1, and a parser that does not expand it will compare two forms of the same address as unequal.
Are the private-range addresses safe?
Safer than public ones, but they may match a host on your own network. Documentation ranges are the only ones that cannot.