3

Quote:

For example, 192.168.10.0/24 would scan the 256 hosts between 192.168.10.0 (binary: 11000000 10101000 00001010 00000000) and 192.168.10.255 (binary: 11000000 10101000 00001010 11111111)

Source.

I know 256 is 2 ^ 8 but I don't know what 24 have anything to do with 2 ^ 8? Anybody can enlighten me on this?

4
  • 5
    It means "use the 24 first bits (out of 32) as mask". And this has nothing to do with infosec
    – Stephane
    Sep 9, 2015 at 8:16
  • While technically interesting, I've edited your question since it is not actually related to nmap (and not related to IT Security either) but is just about IP addresses notation. Sep 9, 2015 at 8:49
  • 3
    I'm not sure playing around with nmap is a good idea if you do not even know the basics of subnetting Sep 9, 2015 at 8:52
  • And, BTW, the first and last addresses, 192.168.10.0 and 192.168.10.255, are not scanned: they are not addresses, they have a special meaning. The first indicates the whole subnet, the second is the broadcast address, i.e. an adress which applies to all machines in the subnet. Sep 9, 2015 at 9:57

3 Answers 3

6

You almost provided the answer yourself. See the IP addresses in binary:

11000000 10101000 00001010 00000000
11000000 10101000 00001010 11111111

Notice how many bits are the same for the range of ip-addresses you are scanning. The answer is 24. The IP-address/X is a way to specify a range of IP addresses. Simply put it means the range of IP addresses where the first X bits are the ones in the IP.

Thus:

127.0.0.0/24 specifies the range 127.0.0.0 - 127.0.0.255
127.0.0.0/20 specifies the range 127.0.0.0 - 127.0.15.255
127.0.0.0/16 specifies the range 127.0.0.0 - 127.0.255.255

and so forth.

A nice online subnet calculator you can play with to understand things.

1
  • 1
    In your second example the range should be 127.0.0.0-127.0.15.255
    – Alex
    Sep 9, 2015 at 11:20
3

As you have mentioned 192.168.10.0/24 specifies the range between 192.168.10.0 to 192.168.10.255, /24 specifies number of masked bits out of 32 starting from left. So, in binary /24 would be represented as 1111 1111 1111 1111 1111 1111 0000 0000 and it is called a mask since first 24 bits of all IP's in this range are going to be same.

How /24 is useful is explained here:

Take an IP in the range, say 192.168.10.12 .When you apply a bitwise And operation on this ip and /24 as follows

192.168.10.12 - 11000000 10101000 00001010 00001100
mask -/24     - 11111111 11111111 11111111 00000000
result of &   - 11000000 10101000 00001010 00000000

you will get the result as 192.168.10.0 which is IP address of the network the host 192.168.10.12 belongs to. This is the way mask is helpful.

1
  • simply and clear. this is the best explained answer. Sep 9, 2015 at 13:58
2

An IPv4 address is composed of 32 bits.

/24 means that the first 24 bits define the network. So you have the remaining 8 bits for the hosts.

2^8 =256 addresses, as the first one defines the network and the last one is the broadcast, you have 254 effective addresses.

decimal  192       168      10       0
binary 11000000 10101000 00001010 00000000
mask   11111111 11111111 11111111 00000000  //24 bits are static and 8 bits are dynamic
1
  • This is about the clearest short answer I have ever seen to this question. It would have saved me lots of head scratching back when I was learning all this. Sep 12, 2015 at 7:23

You must log in to answer this question.