Guide
Writing IPv4 addresses in hexadecimal for packets and logs
Network equipment and debugging tools prefer hexadecimal because two digits describe one byte exactly. A packet capture, a DHCP option, a firewall rule in a vendor syntax or a constant in firmware all use it. The page converts IPv4 addresses to hex and shows the other notations next to it, so you can paste whichever one the target system wants.
How each byte becomes two digits
Take an address octet by octet and write each number in base 16, padded to two digits. 192 is C0 because 12 × 16 is 192, 168 is A8 because 10 × 16 + 8, and so on. Joining the four pairs gives one 32-bit value; putting dots between them gives the dotted hexadecimal form some tools print. Both are the same bits as the dotted decimal address. The page uses upper-case letters, which suits datasheets and Wireshark’s own hex pane, and the 0x prefix is added to the joined form.
Byte order
The page follows network byte order, also called big-endian: the first octet comes first. That is how an address sits inside an IP header, so the hex you see in a capture of the header’s source field reads left to right as the address. Little-endian machines, such as x86 PCs, store a 32-bit integer with its least significant byte first. When Linux prints an address from the kernel’s tables, for instance in /proc/net/tcp, it prints that integer as it sits in memory, so 192.168.1.1 appears as 0101A8C0. If you are matching such a file, reverse the pairs of digits from this page’s result before comparing.
Where hex addresses turn up
- Packet analysers and hex dumps, where the source and destination fields are four bytes each.
- Vendor syntaxes for access control, such as masks entered as
0xFFFFFF00. - DHCP and BOOTP options, which carry addresses as raw bytes.
- Embedded code that stores an address as a constant.
- Firewall logs and tools that print the address as a single integer in base 16.
A worked example
Enter 192.168.1.1. The bytes 192, 168, 1 and 1 become C0, A8, 01 and 01. The page returns 0xC0A80101 (dotted: C0.A8.01.01) and also lists the decimal integer 3232235777, the dotted binary 11000000.10101000.00000001.00000001 and the dotted octal 0300.0250.01.01. On a little-endian host the kernel file form of the same address is 0101A8C0, the same four bytes in reverse.
Limits
IPv4 only: an IPv6 address has sixteen bytes and its own hexadecimal notation, which the IPv6 Expander shows in full. The page converts the text you give it and does not check whether the address is reachable or who owns it. It will also not guess the endianness of a number you paste elsewhere; use the Hex to IP Converter and reverse the pairs yourself if the order is unknown.
Finding the address inside a capture
In the hex pane of a packet analyser the addresses sit at fixed positions in the IPv4 header. The source address occupies bytes 12 to 15 and the destination bytes 16 to 19, counting from zero at the start of the IP header. In the sample packet of the Packet Header Decoder, bytes 12 to 15 read c0 a8 01 0a, which is 192.168.1.10, and bytes 16 to 19 read 08 08 08 08, which is 8.8.8.8. Convert an address here first, then search the dump for those four bytes.
Related tools
- Hex to IP Converter reads hexadecimal addresses back into dotted form.
- IP to Binary Converter writes the same bytes as eight-bit groups.
- IPv4 to Integer Converter gives the decimal number for databases.
- Packet Header Decoder interprets a whole header pasted as hex.
Checked against the current version of the IP to Hex on .