One IP in a hundred places: how anycast works

You type 1.1.1.1. Someone in Tokyo types 1.1.1.1. You reach different machines, each one nearby, each one fast. Same IP, different machines.

The first rule you learn about IP is: one IP, one machine. Anycast breaks it on purpose. Here is how.

The rule it breaks: unicast

Almost every IP you have used is unicast: one address, one machine, like a street address. Two devices with the same IP would conflict. This habit is exactly why anycast feels wrong at first.

Anycast: one IP, many machines

Anycast puts the same IP on many machines, in many cities at once. A server in Asia and one in Europe both have 1.1.1.1. Both are the real one. Nothing rewrites your packet; the destination stays 1.1.1.1 the whole way.

The part that trips everyone:

An IP being unique means its ownership is unique, not its location.

Only one organization holds 1.1.1.0/24, so the number is owned once. But that owner can put the number on a hundred machines worldwide. One owner, one number, many machines. "One IP, one machine" was a property of unicast, never a law of IP.

Who sends you to the nearest one: BGP

If the same IP is announced from many places, who picks which you reach? Not a central brain. Every router on the internet, on its own, using BGP.

Each location announces "to reach 1.1.1.0/24, come through me." Routers hear this and write a direction into their routing tables, before your packet exists:

• A router in Asia learns the shortest path points at the Asia location.
• A router in Europe learns it points at the Europe location.

When your packet arrives, the router does not compute anything. It looks up the table and forwards. The destination IP never changes; only the path differs.

Tokyo  --> packet to 1.1.1.1 --> ... --> Asia server   (it IS 1.1.1.1)
Paris  --> packet to 1.1.1.1 --> ... --> Europe server (it IS 1.1.1.1)

Picture many stores all named "#1234" in different cities. You address a parcel to "#1234." The post delivers it to the nearest one. The label never changes, and nobody rewrites "#1234" into "#5678."

Why it matters

This is how a CDN serves you from a nearby edge: one IP, announced everywhere, each user routed to the closest copy. It also absorbs attacks. A real DDoS comes from machines all over the world, so anycast sends each attacker to its own local edge, and the flood spreads across the network instead of hitting one box.

The big clouds use the same trick, with one twist. Their global entry points (AWS Global Accelerator, Google's global load balancer) use anycast to get you to the nearest edge, but that edge is not the server. It is the door onto the provider's private network, which then carries your traffic to a healthy backend over its own fiber instead of the public internet.

One line to remember

An IP is owned once but can live in many places. The network delivers your packet to the nearest copy, deciding the path ahead of time, never touching the address.