Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 264 down vote favorite
68

I mistakenly missed the dot off of an IP address and typed in 192.168.072.
To my surprise I connected to a machine at 192.168.0.58

If I ping 192.168.072 I get responses from 192.168.0.58.

Why is this?

I'm on a Windows PC on a Windows domain.

If I ping 192.168.72 I get a response from 192.168.0.72, so it seems the 0 in 072 (in my original mistake) is significant.

This question was a Super User Question of the Week.
Read the blog entry for more details or contribute to the blog yourself

share|improve this question
7  
2  
Interestingly, exactly the same thing happens on Linux: ping 192.168.072 prints PING 192.168.072 (192.168.0.58) 56(84) bytes of data.[...]. – Mechanical snail Oct 12 '12 at 18:43
5  
what's even more random is that you had a machine at 192.168.0.58 to get a response. What are the odds of that? – KronoS Oct 12 '12 at 20:27
2  
@KronoS it's actually not so weird if you're on a school or company network. Some DHCP servers will give adresses in increasing order and most of them will be used. – Taum Oct 12 '12 at 22:38
4  
192.168.0.58 is timing out for me.. can all the ping requests have somehow knocked out the server?! – iamserious Oct 16 '12 at 9:19
show 4 more comments

4 Answers

up vote 437 down vote accepted

Everybody is over-complicating it with RFCs, IP classes, and such. Simply run a few tests to see how the ping command parses the IP input by the user (extraneous chaff removed):

C:\>ping 1
Pinging 0.0.0.1 with 32 bytes of data:

C:\>ping 1.2
Pinging 1.0.0.2 with 32 bytes of data:

C:\>ping 1.2.3
Pinging 1.2.0.3 with 32 bytes of data:

C:\>ping 1.2.3.4
Pinging 1.2.3.4 with 32 bytes of data:

C:\>ping 1.2.3.4.5
Ping request could not find host 1.2.3.4.5. Please check the name and try again.

C:\>ping 255
Pinging 0.0.0.255 with 32 bytes of data:

C:\>ping 256
Pinging 0.0.1.0 with 32 bytes of data:

As you can see, the ping command (in Windows) allows you to use different IP address formats. An IPv4 address can be broken down into four parts (“dotted-quad”) as so: A.B.C.D, and the ping command allows you to leave some out, filling in a default of 0 as follows:

1 part  (ping A)       : 0.0.0.A
2 parts (ping A.B)     : A.0.0.B
3 parts (ping A.B.C)   : A.B.0.C
4 parts (ping A.B.C.D) : A.B.C.D

If you only supply a single part, then if it is under 255 (the maximum for an octet), it is treated like an octet as above, but if it is greater than 255, then it is converted and rolled over into the next field (i.e., mod 256).

There are a few edge cases like providing more than four parts doesn’t seem to work (e.g., pinging google.com’s IP won’t work for either 0.74.125.226.4 or 74.125.226.4.0).

You can also use hexadecimal notation in both dotted-quad and flat form, but must format it by pre-pending 0x to each octet.


So, there are plenty of ways to represent an (IPv4) IP address. You can use flat or dotted-quad (or dotted-triple, dotted-double, or even dotted-single) format, and for each one, you can use (or even mix and match) decimal, octal, and hexadecimal. For example, you can ping google.com in the following ways:

  • google.com  (domain name)
  • 74.125.226.4  (dotted decimal)
  • 1249763844  (flat decimal)
  • 0112.0175.0342.0004  (dotted octal)
  • 011237361004  (flat octal)
  • 0x4A.0x7D.0xE2.0x04  (dotted hex)
  • 0x4A7DE204  (flat hex)
  • 74.0175.0xe2.4  (ಠ_ಠ)

(Thank goodness that binary notation support was not added!)


Application:

In your case, pinging 192.168.072 uses the third format in the above table (A.B.0.C), so you are actually pinging 192.168.0.072. Further, because you have a leading zero on the last part, it is treated as octal, which in decimal is 58.

Mystery solved.


Note, that while the Windows ping command allows for such a wide variety of formats for the input and interprets non-standard formats in the ways seen, that does not necessarily mean that you can use such formats everywhere. Some programs may force you to provide all four parts of a dotted-quad, others may not allow mixing and matching decimal and octal, and so on.

Also, IPv6 addresses further complicate the parsing logic and input format acceptability.

share|improve this answer
12  
Thanks for the detailed explanation. – George Duckett Oct 12 '12 at 18:33
14  
Overcomplicating? Experimentation can be very useful, and in this case produced a good answer; but without a theory or documentation or standards, you can be missing a critical factor and not know it. Or you could be determining how one particular version works and be wrong about 90% of the implementations out there. Or you could come up with rules that explain your experiments' results but are more complicated than the intended rules. In this case I think the documentations' rules (for inet_aton()) are simpler in one respect - no conditionals for "under/over 255". – LarsH Oct 12 '12 at 18:35
43  
Hey, look! The "science" part of Computer Science makes an appearance! (hypothesize, experiment, verify) – Izkata Oct 12 '12 at 19:20
9  
@LarsH, that’s my point though, that the ping command (at least on Windows) is like many of Microsoft’s programs (especially the notorious) IE. It tries to be too forgiving and take anything you throw at it and tries to interpret it. Yes, there is an official document on IP address formats, but that this isn’t a question about ISOs and RFCs, it’s practical, I did something and it’s being weird question which can be answered without resorting to (admittedly long, dry, boring technical specifications)—though linking to them in case the OP wants to read them is good too. – Synetech Oct 12 '12 at 19:47
5  
0-prefixed octal parsing should be completely abandoned, save for chmod. That's it. That's the only exception for octal allowed. Period. – James Dunne Oct 12 '12 at 23:42
show 11 more comments
up vote 127 down vote

There are two reasons for this:

First, a '0' prefix indicates an octal number. Since oct(072) = dec(58), 192.168.072 = 192.168.58.

Second, the second-to-last 0 can be dropped from IP addresses as a shorthand. 127.0.1 is interpreted as 127.0.0.1, and in your case 192.168.58 is interpreted as 192.168.0.58.

share|improve this answer
6  
It does not group zeroes. It actually treats each dot as a separator corresponding to the next byte boundary. Thus, the IP addresses 2130706433 and 127.0.0.1 are the same addresses. – Serge Oct 12 '12 at 12:07
2  
more precisly it's the quad dotted notation in the case of an IP address – Guillaume86 Oct 12 '12 at 13:24
2  
The famous leading zero has hit once more time! – Luc M Oct 12 '12 at 14:21
1  
I'm surprised at so many upvotes, since this answer doesn't account for (all of) what the OP observed, unless we know there are rules for adding missing zero-bytes into a received IP address notation. – LarsH Oct 12 '12 at 14:45
1  
now this is the real answer! – Артём Царионов Oct 12 '12 at 18:48
show 6 more comments
up vote 78 down vote

In addition to @neu242's important point about octal notation, and observation that IP addresses can be shortened, the other critical piece is knowing how shortened IP addresses are interpreted.

One might naively guess that if some of the four numbers are missing, the parser would add zero-filled bytes onto the end (or the beginning) of the sequence of bytes. But this doesn't match the behavior the OP reported: 192.168.072 was parsed as 192.168.0.58, not as 192.168.58.0, nor 0.192.168.58.

Apparently Windows and Linux ping (the version you tried and the ones I tried) use something equivalent to inet_aton() to parse the IP address argument. The man page for inet_aton() says:

The address supplied in cp can have one of the following forms:

 a.b.c.d   Each of the four numeric parts specifies a byte of the address; the
           bytes are assigned in left-to-right order to produce the binary
           address.

 a.b.c     Parts a and b specify the first two bytes of the binary address.
           Part c is interpreted as a 16-bit value that defines the rightmost
           two bytes of the binary address.  This notation is suitable for
           specifying (outmoded) Class B network addresses.

 a.b       Part a specifies the first byte of the binary address.  Part b is
           interpreted as a 24-bit value that defines the rightmost three bytes
           of the binary address.  This notation is suitable for specifying
           (outmoded) Class C network addresses.

 a         The value a is interpreted as a 32-bit value that is stored directly
            into the binary address without any byte rearrangement.

So there you have it... 192.168.072 fits the a.b.c pattern, so the 072 (after parsing as an octal number) was interpreted as a 16-bit value that defines the rightmost 2 bytes of the binary address, equivalent to 0.58.

The above rules are equivalent to saying that if any of the four numbers are missing, the needed zero-filled bytes are added immediately before the last number given... not at the end nor at the beginning of the string of bytes. (Expressing it this way works if the last number given is less than 256.)

Note that newer versions of ping may not allow this kind of shorthand, nor the octal interpretation. The 2010 source code for iputils (including ping) that I found uses inet_pton() rather than inet_aton() to parse the IP address argument. The man page for inet_pton() says:

Unlike inet_aton(3) and inet_addr(3), inet_pton() supports IPv6 addresses. On the other hand, inet_pton() only accepts IPv4 addresses in dotted-decimal notation, whereas inet_aton(3) and inet_addr(3) allow the more general numbers-and-dots notation (hexadecimal and octal number formats, and formats that don't require all four bytes to be explicitly written).

share|improve this answer
5  
This is by far the best answer IMHO. – Josh Oct 12 '12 at 17:07
On Windows you're looking for inet_addr in Winsock. – sixlettervariables May 17 at 19:57
up vote 23 down vote

You have to consider also that an ip can be represented by integers added together in significance to their position.

192.168.0.58 is :
  192 * 256^3
+ 168 * 256^2
+   0 * 256^1
+  58 * 256^0

Here's the cool thing:

192.168.58 will be 192.168.0.58 because

    0 * 256^1 
+  58 * 256^0 
=  58

192.11010106 will also be 192.168.0.58 because

  168 * 256^2 
+   0 * 256^1 
+  58 * 256^0 
= 11010106

3232235578 will also be 192.168.0.58 because

  192 * 256^3 
+ 168 * 256^2 
+   0 * 256^1 
+  58 * 256^0 
= 3232235578
share|improve this answer
"192.168.56 will be 192.168.0.56 because 0*256^1 + 58*256^0 = 58" Are you sure? You would expect 168 to be multiplied by 256^1 in the first case, and by 256^2 in the second case. Similarly 192 would be multiplied by 256^2 vs. 256^3. So 192.168.56 could only = 192.168.0.56 if there are additional rules in place, such as the dropping of zeroes. – LarsH Oct 12 '12 at 14:35
@LarsH, I think what's being said here is that it's left-to-right based, unlike "normal" counting where we base everything from the 1's place. So the first dot causes whatever is to the left of it to be multiplied by 256^3, the second by 256^2, the third by 256. if there's no dot to the left of it then it's added w/o multiplying by 256^n. So 1.2.3. (1.2.3.0) would be different than 1.2.3 (1.2.0.3), if I understand correctly. – iX3 Oct 12 '12 at 14:59
@iX3: if that were the case, then "192.168.56 will be 192.168.0.56" would be incorrect, because in the first case, 56 would be multiplied by 256^1, whereas in the second case, 56 would only be multiplied y 256^0. And the OP's 192.168.072 would be interpreted as 192.168.58.0 instead of 192.168.0.58. – LarsH Oct 12 '12 at 15:02
What's a bit misleading is the fact the the address has 0 has the 3rd digit. Consider this address 192.168.1.56 The 3 digit form would be 192.168.312 Because 1*256^1 + 56*256^0 is 312 – matt_levesque Oct 12 '12 at 15:40
The dots only serve to delineate which numbers should be multiplied by which power of 256. The parser looks for the first dot, and multiplies the number before it by 256^3. Repeat for 2nd and 3rd dot, but by 256^2 and 256^1, respectively. Then it adds all of the results together (some impl. may keep a running total instead, though the result is the same). If any of those dots are missing, it simply doesn't do the multiplication and just adds the final number to the running total. That's also why 1.2.3. results in an error, because the parser can't find the last number to add to the total. – Justin ᚅᚔᚈᚄᚒᚔ Oct 12 '12 at 16:26
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.