IP Addresses in Hexadecimal Format

An IPv4 address is a 32-bit number, which can be represented as four decimal octets (the familiar dotted notation), a single 32-bit integer, or four hexadecimal bytes. In network packet captures, hex editors, and low-level network programming, IP addresses appear in their raw hex form. Understanding the conversion is essential for analyzing network traffic.

Converting 192.168.1.1 to hex:

Each octet of the dotted-decimal IP address is converted independently to a two-digit hex value:

1. 192 → C0 (12 × 16 + 0 = 192)
2. 168 → A8 (10 × 16 + 8 = 168)
3. 1 → 01
4. 1 → 01

Result: C0 A8 01 01

In a network packet, these four bytes appear consecutively in the IP header at the source or destination address field.

Common IP addresses in hex:

IP Address	Hex	Usage
0.0.0.0	00 00 00 00	Default/unspecified
127.0.0.1	7F 00 00 01	Loopback (localhost)
192.168.1.1	C0 A8 01 01	Common router gateway
10.0.0.1	0A 00 00 01	Private network
255.255.255.0	FF FF FF 00	/24 subnet mask
255.255.255.255	FF FF FF FF	Broadcast
8.8.8.8	08 08 08 08	Google DNS

Recognizing private IP ranges in hex:

• 10.0.0.0/8: Starts with 0A — any address beginning with hex 0A is in the Class A private range
• 172.16.0.0/12: Starts with AC 10 through AC 1F — hex second byte from 10 to 1F
• 192.168.0.0/16: Starts with C0 A8 — this two-byte prefix is one of the most commonly seen patterns in packet captures

IP addresses in packet headers:

In a raw IPv4 packet, the source IP address is at offset 12-15 and the destination IP address is at offset 16-19 from the beginning of the IP header. When viewing a packet capture in a hex editor, you can directly read these four-byte fields. For example, seeing C0 A8 00 65 at offset 16 tells you the destination is 192.168.0.101.

Hex representation in URLs and APIs:

Some systems express IP addresses as a single hex number. The IP 192.168.1.1 as a 32-bit hex integer is 0xC0A80101. This compact form is sometimes used in database storage, firewall rules, and network programming APIs. The C function inet_addr() returns the IP in this network byte order (big-endian) 32-bit format.

IPv6 — natively hexadecimal:

IPv6 addresses are 128 bits and written natively in hex notation (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). Each group of four hex digits represents 16 bits. Understanding hex-to-IP conversion for IPv4 naturally extends to reading IPv6 addresses.