How IPv4 addresses are represented
An IPv4 address is a 32-bit unsigned integer. The human-readable forms are all different ways of writing the same underlying number:
- Dotted decimal: four 8-bit octets, each written as a decimal
number 0–255, separated by periods. Example:
192.168.1.1. - Dotted binary: the same four octets, each expanded to 8 binary
digits. Example:
11000000.10101000.00000001.00000001. Used when working through subnet calculations by hand. - Hexadecimal: each octet as two hex digits. Example:
C0:A8:01:01. Common in packet captures, Cisco debug output, and low-level network programming. - 32-bit integer: the raw unsigned value. Example:
3232235777. Used in routing table comparisons, ACL evaluations, and bitwise operations in code.
Converting manually
To convert a decimal octet to binary, successively subtract powers of 2 starting from 128:
| Bit value | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
|---|---|---|---|---|---|---|---|---|
| Octet 192 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Octet 168 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 |
192 = 128 + 64. 168 = 128 + 32 + 8. Each 1-bit means that power of 2 is included in the sum; each 0-bit means it is not.
Why binary matters for subnetting
Subnet masks work by bitwise AND with the IP address. The network address is the IP AND the mask — all host bits set to zero. The broadcast address sets all host bits to one. Understanding the binary representation lets you verify subnet boundaries without a calculator and catch common errors like non-contiguous masks.
Hexadecimal in network engineering
Hex appears in Cisco IOS debug output (debug ip packet), packet
captures (Wireshark shows IP addresses in hex in the raw bytes view), MAC addresses,
and IPv6 addresses. Being able to mentally convert a hex pair like C0
to 192 or FF to 255 is a useful skill for reading diagnostic output
quickly.
Why network engineers need to understand binary IP
Binary representation is not an academic exercise — it is the foundation of every decision a router makes. When a router receives a packet, it performs a bitwise AND between the destination IP address and each subnet mask in the routing table. The result that produces the longest matching prefix (most specific route) determines the next hop. This operation is purely binary: the router does not interpret dotted-decimal notation at all at the forwarding plane. Understanding binary lets you predict exactly which route will be selected, debug routing table anomalies, and verify that ACL wildcard masks cover the intended address range.
Consider a common troubleshooting scenario: a host at 10.10.1.130 cannot reach a server. You see routes for both 10.10.1.0/24 and 10.10.1.128/26 in the routing table. In binary, 10.10.1.130 is 00001010.00001010.00000001.10000010. The /26 mask covers bits 1–26, so the last six bits are the host portion. The network bits match 10.10.1.128 exactly — so the /26 route wins by longest-prefix match. Without thinking in binary, this kind of routing behavior is opaque. With binary, the answer is immediate.
How IPv4 addresses work in binary — a practical guide
An IPv4 address is a 32-bit number divided into four 8-bit octets. Each octet can represent values from 0 (all bits zero: 00000000) to 255 (all bits one: 11111111). The bit positions within an octet have fixed weights: from left to right they are 128, 64, 32, 16, 8, 4, 2, 1. To convert a decimal octet to binary, find which powers of 2 sum to the decimal value. For 192: 128+64 = 192, so the first two bits are 1 and the remaining six are 0 → 11000000. For 168: 128+32+8 = 168 → 10101000.
Subnet masks in binary are always a contiguous block of 1-bits followed by 0-bits. A /24 mask is 11111111.11111111.11111111.00000000 — 24 ones, 8 zeros. A /26 is 11111111.11111111.11111111.11000000 — 26 ones, 6 zeros, giving 64 addresses (2⁶). The host portion (zero bits) determines how many addresses are in the subnet: 2^(32 − prefix length). The AND operation to find the network address: take each bit of the IP address, AND it with the corresponding bit of the subnet mask. Where the mask bit is 1, the result is the IP bit. Where the mask bit is 0, the result is always 0 (the host bits are zeroed out).
Hexadecimal in networking — practical usage
Hexadecimal uses 16 symbols (0–9 and A–F) so each hex digit represents exactly 4 bits (a nibble), and two hex digits represent one full byte. This makes hex a natural shorthand for binary data: C0 in hex is 1100 0000 in binary = 192 in decimal. Network engineers encounter hex in four major contexts: MAC addresses (written as six colon-separated or hyphen-separated byte pairs, e.g., 00:1A:2B:3C:4D:5E), IPv6 addresses (eight colon-separated 16-bit groups, e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334), packet captures (Wireshark's hex dump view shows the raw bytes of every field), and Cisco IOS debug output where IP addresses and packet fields are displayed in hexadecimal.
For quick mental conversion, memorize the most common values: FF = 255, FE = 254, FC = 252 (the /30 wildcard), F0 = 240, E0 = 224, C0 = 192, 80 = 128, 00 = 0. These eight values cover the majority of subnet-related hex you will see in practice. When reading a Wireshark hex dump, the destination IP in an IP header starts at byte offset 16 in the IP header — four bytes that you can read as four hex pairs and convert to dotted-decimal notation.