Why does pinging 192.168.072 (only 2 dots) return a response from 192.168.0.58?

Question

I mistakenly missed the dot off of an IP address and typed in 192.168.072.
To my surprise I connected to a machine at 192.168.0.58

If I ping 192.168.072 I get responses from 192.168.0.58.

Why is this?

---

I'm on a Windows PC on a Windows domain.

---

If I ping 192.168.72 I get a response from 192.168.0.72, so it seems the 0 in 072 (in my original mistake) is significant.

---

_{This question was a Super User Question of the Week.
Read the blog entry for more details or contribute to the blog yourself}

Answer 1

Everybody is over-complicating it with RFCs, IP classes, and such. Simply run a few tests to see how the ping command parses the IP input by the user (extraneous chaff removed):

> ping 1
Pinging 0.0.0.1 with 32 bytes of data:

> ping 1.2
Pinging 1.0.0.2 with 32 bytes of data:

> ping 1.2.3
Pinging 1.2.0.3 with 32 bytes of data:

> ping 1.2.3.4
Pinging 1.2.3.4 with 32 bytes of data:

> ping 1.2.3.4.5
Ping request could not find host 1.2.3.4.5. Please check the name and try again.

> ping 255
Pinging 0.0.0.255 with 32 bytes of data:

> ping 256
Pinging 0.0.1.0 with 32 bytes of data:

As you can see, the ping command (in Windows) allows you to use different IP address formats. An IPv4 address can be broken down into four parts (“dotted-quad”) as so: A.B.C.D, and the ping command allows you to leave some out, filling in a default of 0 as follows:

1 part  (ping A)       : 0.0.0.A
2 parts (ping A.B)     : A.0.0.B
3 parts (ping A.B.C)   : A.B.0.C
4 parts (ping A.B.C.D) : A.B.C.D

If you only supply a single part, then if it is under 255 (the maximum for an octet), it is treated like an octet as above, but if it is greater than 255, then it is converted and rolled over into the next field (i.e., mod 256).

There are a few edge cases like providing more than four parts doesn’t seem to work (e.g., pinging google.com’s IP won’t work for either 0.74.125.226.4 or 74.125.226.4.0).

You can also use hexadecimal notation in both dotted-quad and flat form, but must format it by pre-pending 0x to each octet.

So, there are plenty of ways to represent an (IPv4) IP address. You can use flat or dotted-quad (or dotted-triple, dotted-double, or even dotted-single) format, and for each one, you can use (or even mix and match) decimal, octal, and hexadecimal. For example, you can ping google.com in the following ways:

• google.com  (domain name)
• 74.125.226.4  (dotted decimal)
• 1249763844  (flat decimal)
• 0112.0175.0342.0004  (dotted octal)
• 011237361004  (flat octal)
• 0x4A.0x7D.0xE2.0x04  (dotted hex)
• 0x4A7DE204  (flat hex)
• 74.0175.0xe2.4  (ಠ_ಠ)

(Thank goodness that binary notation support was not added!)

Application:

In your case, pinging 192.168.072 uses the third format in the above table (A.B.0.C), so you are actually pinging 192.168.0.072. Further, because you have a leading zero on the last part, it is treated as octal, which in decimal is 58.

Mystery solved.

Note, that while the Windows ping command allows for such a wide variety of formats for the input and interprets non-standard formats in the ways seen, that does not necessarily mean that you can use such formats everywhere. Some programs may force you to provide all four parts of a dotted-quad, others may not allow mixing and matching decimal and octal, and so on.

Also, IPv6 addresses further complicate the parsing logic and input format acceptability.

Addendum:

syss pointed out that if you use an invalid character in one of the numbers (e.g., an 8 or 9 when using octal, a g in hex-mode, etc.) then ping is smart enough to recognize that and interpret it as a string(-al? -ic?) URL instead of as a numberic IP address.

^{(As someone who has had numerous aneurysms and heart-attacks trying to write supposedly “simple” code to accommodate the exponentially exploding number of permutations of data values, I appreciate that it—seems to—correctly process all of the input variations; in this case, at least 31+32+33+34=120 variations.)}

So, while specifying 010.020.030.040 will ping 8.16.24.32 as expected, passing 010.020.030.080 to ping will be treated like a URL instead of an IP address—like foo.bar.baz.com which could (but sadly does not) exist. In other words, it tries to ping the subdomain 010 on the subdomain 020 on the domain 030 at the top-level domain 080. However, since 080 is not a valid TLD (like .com, .net, and their buddies), the connection fails right at the first step.

The same thing happens with 090.010.010.010 where the invalid character is in a different octet. Likewise, 0xf.0xf.0xf.0xf pings 15.15.15.15, but 0xh1.0x1.0xg0.0f fails.

Oh well, I guess that’s what you get for not being fluent in multiple number-bases.

It’s probably easier and safer to just make sure to always use 4–dotted-quad (“40q”? “quaddy-quad”? “cutie-q”?) addresses.

So go forth and learn some number bases. You’ll be able to show off at and be the life of parties, and as they say, there are 10 types of people: those who know binary and those who don’t.

_{Let’s not even think about IPv6 addresses; I think they’re one of the 111 seals!!!}

Answer 2

There are two reasons for this:

First, a '0' prefix indicates an octal number. Since oct(072) = dec(58), 192.168.072 = 192.168.58.

Second, that second-to-last 0 can be dropped from IP addresses as a shorthand. 127.0.1 is interpreted as 127.0.0.1, and in your case 192.168.58 is interpreted as 192.168.0.58.

Answer 3

In addition to @neu242's important point about octal notation, and observation that IP addresses can be shortened, the other critical piece is knowing how shortened IP addresses are interpreted.

One might naively guess that if some of the four numbers are missing, the parser would add zero-filled bytes onto the end (or the beginning) of the sequence of bytes. But this doesn't match the behavior the OP reported: 192.168.072 was parsed as 192.168.0.58, not as 192.168.58.0, nor 0.192.168.58.

Apparently Windows and Linux ping (the version you tried and the ones I tried) use something equivalent to inet_aton() to parse the IP address argument. The man page for inet_aton() says:

The address supplied in cp can have one of the following forms:

 a.b.c.d   Each of the four numeric parts specifies a byte of the address; the
           bytes are assigned in left-to-right order to produce the binary
           address.

 a.b.c     Parts a and b specify the first two bytes of the binary address.
           Part c is interpreted as a 16-bit value that defines the rightmost
           two bytes of the binary address.  This notation is suitable for
           specifying (outmoded) Class B network addresses.

 a.b       Part a specifies the first byte of the binary address.  Part b is
           interpreted as a 24-bit value that defines the rightmost three bytes
           of the binary address.  This notation is suitable for specifying
           (outmoded) Class C network addresses.

 a         The value a is interpreted as a 32-bit value that is stored directly
            into the binary address without any byte rearrangement.

So there you have it... 192.168.072 fits the a.b.c pattern, so the 072 (after parsing as an octal number) was interpreted as a 16-bit value that defines the rightmost 2 bytes of the binary address, equivalent to 0.58.

The above rules are equivalent to saying that if any of the four numbers are missing, the needed zero-filled bytes are added immediately before the last number given... not at the end nor at the beginning of the string of bytes. (Expressing it this way works if the last number given is less than 256.)

Note that newer versions of ping may not allow this kind of shorthand, nor the octal interpretation. The 2010 source code for iputils (including ping) that I found uses inet_pton() rather than inet_aton() to parse the IP address argument. The man page for inet_pton() says:

Unlike inet_aton(3) and inet_addr(3), inet_pton() supports IPv6 addresses. On the other hand, inet_pton() only accepts IPv4 addresses in dotted-decimal notation, whereas inet_aton(3) and inet_addr(3) allow the more general numbers-and-dots notation (hexadecimal and octal number formats, and formats that don't require all four bytes to be explicitly written).

Answer 4

You have to consider also that an ip can be represented by integers added together in significance to their position.

192.168.0.58 is :
  192 * 256^3
+ 168 * 256^2
+   0 * 256^1
+  58 * 256^0

Here's the cool thing:

192.168.58 will be 192.168.0.58 because

    0 * 256^1 
+  58 * 256^0 
=  58

192.11010106 will also be 192.168.0.58 because

  168 * 256^2 
+   0 * 256^1 
+  58 * 256^0 
= 11010106

3232235578 will also be 192.168.0.58 because

  192 * 256^3 
+ 168 * 256^2 
+   0 * 256^1 
+  58 * 256^0 
= 3232235578