IPv4 ↔ Hex Converter

The IPv4 to Hex Converter transforms IPv4 addresses between dotted decimal notation and hexadecimal representation. Enter 192.168.1.1 to get C0.A8.01.01 (dotted hex), C0A80101 (flat hex), or 0xC0A80101 (prefixed hex). You can also paste a hex string to convert it back to standard dotted decimal notation.

Understanding Hexadecimal IP Addresses

Hexadecimal is the middle ground between the human-readable decimal notation we use in configuration files and the raw binary that hardware actually processes. Each hex digit represents exactly four bits, so a single octet (8 bits) maps to exactly two hex digits. This makes hexadecimal more compact than binary while still preserving byte boundaries. When you see C0A8 in a packet dump, you know immediately that is two octets, and with practice you learn to recognize it as 192.168 without doing any math.

For most network administrators, the primary place you encounter hex-formatted IPv4 addresses is in packet captures. Tools like Wireshark and tcpdump display raw packet data as streams of hex bytes. If you know where the IP header fields sit, you can read the source and destination addresses directly from the hex dump. The source address starts at byte offset 12 and the destination at byte offset 16 within the IP header. Recognizing common hex patterns -- 0A for the 10.x.x.x private range, C0A8 for 192.168.x.x, AC1 for 172.16.x.x through 172.31.x.x -- lets you identify addresses at a glance without switching to a decimal view.

Beyond packet analysis, hex addresses appear in programming contexts where IP addresses are stored as 32-bit integer constants, in memory debuggers that display raw bytes, in certain logging formats, and occasionally in obfuscated URLs. Security researchers encounter hex-encoded IP addresses in malicious payloads and CTF challenges. This converter handles all common hex formats so you can quickly translate between representations regardless of the context where you found the address.

How to Convert an IPv4 Address to Hexadecimal

1. Enter an IPv4 address in dotted decimal format (e.g., 192.168.1.1)
2. The tool converts each octet to its two-digit hexadecimal equivalent
3. View the result in dotted hex (C0.A8.01.01), flat hex (C0A80101), or prefixed format (0xC0A80101)
4. To convert hex back to decimal, enter any supported hex format and get the standard IPv4 address

IPv4 to Hexadecimal Conversion Examples

Octet-to-Hex Quick Reference

When to Use the IPv4 Hex Converter

• Reading packet captures -- tools like Wireshark and tcpdump display raw packet bytes in hexadecimal, requiring hex-to-decimal conversion to identify IP addresses
• Programming and debugging -- languages like C, Python, and Go use hex literals (0xC0A80101) for IP address constants in network code
• Analyzing memory dumps -- raw memory views show IP addresses stored as hex bytes that need to be converted for identification
• URL encoding -- some obfuscated URLs encode IPv4 addresses in hexadecimal format (e.g., http://0xC0A80101/)
• Firewall log analysis -- certain logging formats output addresses in hexadecimal notation
• Security research -- identifying obfuscated or encoded IP addresses in malware payloads and phishing URLs

How IPv4 Hexadecimal Representation Works

Hexadecimal (base-16) provides a compact way to represent binary data. Each hex digit maps to exactly 4 bits, so one octet (8 bits) always maps to exactly two hex digits. This 1:2 relationship makes hex more compact than binary while preserving byte boundaries.

Conversion Process

The conversion from decimal to hex works octet by octet:

IPv4:  192  .  168  .  1   .  1
        |       |      |      |
Hex:   C0   .  A8   . 01   . 01

192 = 12 x 16 + 0  = C0
168 = 10 x 16 + 8  = A8
  1 =  0 x 16 + 1  = 01
  1 =  0 x 16 + 1  = 01

Hex in Packet Captures

When examining a raw Ethernet frame in a packet capture tool, the IP header appears as a continuous stream of hex bytes. The source and destination addresses sit at fixed offsets:

45 00 00 3c 1c 46 40 00 40 06 b1 e6 C0 A8 01 64 AC 10 00 01
                                     |-- src IP -| |-- dst --|
                                     192.168.1.100 172.16.0.1

Recognizing common hex patterns like C0A8 (192.168) and 0A (10.) helps you quickly identify private addresses in hex dumps.

Hex IP Addresses in URLs

Browsers can resolve IPv4 addresses in hexadecimal URL format. The address 192.168.1.1 can be written as http://0xC0A80101/ in some systems. Security analysts encounter this format when analyzing obfuscated or malicious URLs that use hex encoding to disguise destination addresses.

Byte Order Considerations

IPv4 addresses are transmitted in network byte order (big-endian), meaning the most significant octet comes first. In a hex dump, the address 192.168.1.1 appears as C0 A8 01 01 with the C0 (192) byte first. On little-endian systems (most modern x86 hardware), the same address stored in memory may appear byte-reversed as 01 01 A8 C0. Being aware of byte order prevents confusion when reading memory dumps versus network captures.

Practical Tips for Working with Hex Addresses

The fastest way to get comfortable reading hex addresses in packet captures is to memorize a few anchor points. The private address ranges have distinctive hex prefixes: 0A is always 10.x.x.x, C0A8 is always 192.168.x.x, and AC1 covers the 172.16.x.x through 172.31.x.x range. Public DNS servers like Google's 8.8.8.8 show up as 08080808, and the broadcast address 255.255.255.255 is FFFFFFFF. Once you know a handful of these patterns, you can scan through a hex dump and pick out addresses without needing to convert each octet individually.

When writing network code, the 0x prefix format is the most useful because it can be used directly in C, Python, Go, and most other languages. For example, in Python you can write socket.inet_ntoa(struct.pack('!I', 0xC0A80101)) to convert the hex literal back to 192.168.1.1. In C, an IP address constant might be defined as #define SERVER_IP 0xC0A80101. Understanding the hex representation saves time when debugging these values in code.

A common pitfall is byte-order confusion. Network protocols use big-endian byte order, but most modern CPUs are little-endian. If you are reading an IP address from a memory dump on a little-endian system, the bytes appear reversed: 192.168.1.1 looks like 01 01 A8 C0 in memory but C0 A8 01 01 on the wire. Always check whether you are looking at a network capture (big-endian) or a host memory dump (potentially little-endian) before converting.

Frequently Asked Questions

Where will I encounter IPv4 addresses in hexadecimal?

The most common places are packet captures (Wireshark, tcpdump), programming source code using hex literals, raw memory or core dumps, certain firewall and system log formats, and obfuscated URLs. Network protocol RFCs also use hexadecimal notation when describing header fields and address encoding.

What is the difference between dotted hex and flat hex?

Dotted hex (C0.A8.01.01) preserves the octet separation for readability. Flat hex (C0A80101) concatenates all octets into a single 8-character string, which is the format used in most programming contexts and memory representations. The 0x prefix (0xC0A80101) is a programming convention indicating a hexadecimal literal.

Can I use hex addresses in commands like ping?

Some operating systems accept hexadecimal IP addresses. On Linux, ping 0xC0A80101 may resolve to 192.168.1.1. However, this behavior is system-dependent and is not universally supported. It is primarily a curiosity used in CTF challenges and security research rather than everyday operations.

Why do packet captures show addresses in hex instead of decimal?

Packet capture tools display the raw bytes as they appear on the wire, and the universal notation for raw bytes is hexadecimal. Converting every field to human-friendly formats would add processing overhead and would not be useful for all protocol fields. The hex view gives analysts a precise, unambiguous look at exactly what was transmitted.

How do I convert a single octet from decimal to hex quickly?

Divide the decimal value by 16. The quotient is the first hex digit and the remainder is the second. For 192: 192 / 16 = 12 remainder 0, and 12 in hex is C, so the result is C0. For 168: 168 / 16 = 10 remainder 8, and 10 in hex is A, so the result is A8. With practice, common values become automatic.

Related Tools

• IPv4 ↔ Binary Converter - Convert IPv4 addresses to/from binary notation
• IPv4 ↔ Integer Converter - Convert IPv4 addresses to/from 32-bit integers
• IPv4 Validator - Validate IPv4 addresses in strict dotted-quad format
• IPv6 Expand ↔ Compress - Convert between expanded and compressed IPv6 notation
• IPv4-Mapped IPv6 Converter - Convert between IPv4 and IPv4-mapped IPv6 addresses
• Extract IPs from Text - Extract IP addresses from logs or text snippets