Hex to IP

A hexadecimal address usually comes from somewhere technical: a hex dump of a packet, a register in a datasheet, a line of /proc/net/tcp, or a log that prints socket addresses as raw integers. The page takes one value per line and returns the familiar dotted form with the other notations next to it.

Accepted spellings

The page reads values in the shapes people actually paste. C0A80101 is eight digits with no separators. 0x0A000001 carries the C-style prefix. AC.10.FE.03 and AC:10:FE:03 use dots or colons between the bytes, as many tools print them. Letters can be upper or lower case. Shorter values are treated as the low-order bytes and padded with zeros on the left, so 7F000001, 0x7F000001 and 7F.00.00.01 all become 127.0.0.1, while 1 becomes 0.0.0.1. A value with more than eight digits cannot be an IPv4 address and is reported instead of truncated.

Byte order is the usual stumbling block

The page reads the first pair of digits as the first octet, which is how an address is stored inside an IP header and how it is printed by packet analysers. Linux’s /proc/net/tcp and similar files print the kernel’s integer as hexadecimal, and on a little-endian processor that puts the last octet first. Pasting 0101A8C0 therefore gives 1.1.168.192, which is not an address you will recognise. Reverse the pairs to C0A80101 and you get the right answer. The same rule applies to values read out of firmware or memory dumps: ask which end of the word holds the most significant byte before trusting the result.

Typical sources

1. A hex dump, where the destination field of an IP header is bytes 16 to 19.
2. /proc/net/tcp, /proc/net/udp and /proc/net/route, whose first columns hold addresses as reversed hex.
3. SNMP and DHCP traces that show an address as an octet string.
4. Source code constants such as 0xC0A80101 that you want to identify.

A worked example

The sample list holds three lines. C0A80101 converts to 192.168.1.1: C0 is 192, A8 is 168, and 01 and 01 are 1 and 1. 0x0A000001 gives 10.0.0.1. AC.10.FE.03 gives 172.16.254.3 because AC is 172, 10 is 16, FE is 254 and 03 is 3. A panel under the output lists the first valid address in decimal, binary and octal forms, with a label such as private use (RFC 1918) or loopback.

Limits

Only IPv4 is covered; a 32-digit hexadecimal string is an IPv6 address and belongs in the IPv6 Compressor. The tool does not know where your value came from, so it cannot tell a big-endian from a little-endian value; if an address looks reversed, reverse it yourself and convert again. It also does not check that the address is in use.

Quick sanity checks

A few leading bytes are worth memorising because they identify the address range at a glance. 7F is the loopback block 127.0.0.0/8, 0A is the private block 10.0.0.0/8, C0A8 begins 192.168, A9FE begins the link-local range 169.254, and AC10 to AC1F are the private 172.16 to 172.31 range. E0 to EF are multicast. If the result of a conversion does not fit what you expected from the first byte, suspect the byte order before suspecting the data.

Related tools

• IP to Hex Converter goes the other way for lists of dotted addresses.
• Integer to IPv4 Converter is the decimal version of the same job.
• Packet Header Decoder reads a whole IPv4 header from hex bytes.
• Hex to Binary Converter converts any hex value to bits when you need the raw pattern.