169.254.0.0/16 — link-local, APIPA, and one very famous IP
If a machine shows up with a 169.254.x.x address, it did not get a DHCP lease. 169.254.0.0/16 is the IPv4 link-local block from RFC 3927: 65,536 addresses that hosts self-assign for communication on the local link only, with no router involved and no way off the segment.
One address in the block overshadows the rest: 169.254.169.254, the instance metadata endpoint used by AWS, GCP, Azure and most other clouds. So a 169.254 address means one of two things — "DHCP failed" or "cloud plumbing".
| Range start | 169.254.0.0 |
| Range end | 169.254.255.255 |
| Subnet mask | 255.255.0.0 |
| Wildcard mask | 0.0.255.255 |
| Total addresses | 65,536 |
Link-local (RFC 3927) is self-assigned per-link space, not a routed subnet — the table shows the block's boundaries rather than a network/broadcast pair.
APIPA: the DHCP failure symptom
When DHCP fails, modern operating systems do not give up — they pick a random address in 169.254.1.0–169.254.254.255, probe it with ARP to make sure nobody else has it, and carry on. Microsoft calls this Automatic Private IP Addressing (APIPA); avahi does the same on Linux. The result: two laptops on a dumb switch can still talk to each other with zero configuration.
For troubleshooting, a 169.254 address is a verdict, not a choice: the machine wanted DHCP and did not get it. Check the cable, the DHCP server, the VLAN — the address itself is just the smoke.
169.254.169.254: the metadata endpoint
Every major cloud hangs a magic HTTP service off 169.254.169.254, reachable only from inside the instance. It serves the machine's identity, user-data scripts, network config — and, on AWS, temporary IAM credentials for the instance's role. AWS's IMDSv2 made the credential path session-oriented (a PUT for a token first) precisely because the v1 endpoint was being pillaged.
That pillaging is SSRF: if your app fetches a user-supplied URL, an attacker supplies http://169.254.169.254/latest/meta-data/ and your server helpfully returns its own cloud credentials. Every URL-fetching feature must block 169.254.0.0/16 — along with the RFC 1918 ranges — before making the request, and re-validate after every redirect.
CIDR Calculator
Run the math on 169.254.0.0/16 — or any other block
Frequently asked questions
Why is my IP address 169.254.x.x?
Your device asked for a DHCP lease, got no answer, and self-assigned a link-local address (APIPA). It can talk to neighbors on the same segment, but it has no gateway and no Internet until DHCP is fixed.
What is 169.254.169.254?
The link-local instance metadata service used by AWS, Google Cloud, Azure and others. From inside a cloud VM it returns the instance's configuration — and on AWS, temporary IAM credentials — over plain HTTP.
Is 169.254.0.0/16 routable?
No. RFC 3927 forbids routers from forwarding link-local packets; the addresses only have meaning on the local link — which is exactly why clouds can hang per-instance magic on 169.254.169.254.
Is a 169.254 address dangerous?
The range itself is benign, but if your application fetches arbitrary URLs, 169.254.169.254 is the classic SSRF target for stealing cloud credentials. Filter the whole block in outbound requests.