3

Quote:

For example, 192.168.10.0/24 would scan the 256 hosts between 192.168.10.0 (binary: 11000000 10101000 00001010 00000000) and 192.168.10.255 (binary: 11000000 10101000 00001010 11111111)

Source.

I know 256 is 2 ^ 8 but I don't know what 24 have anything to do with 2 ^ 8? Anybody can enlighten me on this?

migrated from security.stackexchange.com Sep 9 '15 at 9:52

This question came from our site for information security professionals.

  • 4
    It means "use the 24 first bits (out of 32) as mask". And this has nothing to do with infosec – Stephane Sep 9 '15 at 8:16
  • While technically interesting, I've edited your question since it is not actually related to nmap (and not related to IT Security either) but is just about IP addresses notation. – WhiteWinterWolf Sep 9 '15 at 8:49
  • 3
    I'm not sure playing around with nmap is a good idea if you do not even know the basics of subnetting – Stef Heylen Sep 9 '15 at 8:52
  • And, BTW, the first and last addresses, 192.168.10.0 and 192.168.10.255, are not scanned: they are not addresses, they have a special meaning. The first indicates the whole subnet, the second is the broadcast address, i.e. an adress which applies to all machines in the subnet. – MariusMatutiae Sep 9 '15 at 9:57
4

You almost provided the answer yourself. See the IP addresses in binary:

11000000 10101000 00001010 00000000
11000000 10101000 00001010 11111111

Notice how many bits are the same for the range of ip-addresses you are scanning. The answer is 24. The IP-address/X is a way to specify a range of IP addresses. Simply put it means the range of IP addresses where the first X bits are the ones in the IP.

Thus:

127.0.0.0/24 specifies the range 127.0.0.0 - 127.0.0.255
127.0.0.0/20 specifies the range 127.0.0.0 - 127.0.15.255
127.0.0.0/16 specifies the range 127.0.0.0 - 127.0.255.255

and so forth.

A nice online subnet calculator you can play with to understand things.

  • 1
    In your second example the range should be 127.0.0.0-127.0.15.255 – Alex Sep 9 '15 at 11:20
3

As you have mentioned 192.168.10.0/24 specifies the range between 192.168.10.0 to 192.168.10.255, /24 specifies number of masked bits out of 32 starting from left. So, in binary /24 would be represented as 1111 1111 1111 1111 1111 1111 0000 0000 and it is called a mask since first 24 bits of all IP's in this range are going to be same.

How /24 is useful is explained here:

Take an IP in the range, say 192.168.10.12 .When you apply a bitwise And operation on this ip and /24 as follows

192.168.10.12 - 11000000 10101000 00001010 00001100
mask -/24     - 11111111 11111111 11111111 00000000
result of &   - 11000000 10101000 00001010 00000000

you will get the result as 192.168.10.0 which is IP address of the network the host 192.168.10.12 belongs to. This is the way mask is helpful.

  • simply and clear. this is the best explained answer. – Francisco Tapia Sep 9 '15 at 13:58
2

An IPv4 address is composed of 32 bits.

/24 means that the first 24 bits define the network. So you have the remaining 8 bits for the hosts.

2^8 =256 addresses, as the first one defines the network and the last one is the broadcast, you have 254 effective addresses.

decimal  192       168      10       0
binary 11000000 10101000 00001010 00000000
mask   11111111 11111111 11111111 00000000  //24 bits are static and 8 bits are dynamic
  • This is about the clearest short answer I have ever seen to this question. It would have saved me lots of head scratching back when I was learning all this. – GuitarPicker Sep 12 '15 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy