IP addresses: octets, binary, public and private

Where you are

In Lesson 1, step 1 of every request turned a name into an IP address. When you asked for api.civicgrid.org, curl said:

* IPv4: 104.21.69.165, 172.67.210.139

Those numbers are what computers actually use to find each other. Names are for people. This lesson opens one of them up, 104.21.69.165, and shows you what's inside: why it's four numbers, why none of them can be bigger than 255, and why your own computer has two different addresses at once.

An address for every device

A street address gets a letter to one particular house. An IP address (Internet Protocol address) gets data to one particular device: a laptop, a phone, a server, a smart TV. Every device on a network has one, and every piece of data sent across a network carries the address it's going to and the address it came from, like the "to" and "from" on an envelope.

The addresses you've seen so far, like 104.21.69.165, are IPv4 addresses, the original kind, still the most common. Each is four numbers, separated by dots. Each number can be anything from 0 to 255, and nothing else: 104.21.69.165 is a real address, but 104.21.69.300 isn't one at all. To see why, you need to see what the numbers are made of.

Octets: eight switches

Inside a computer, everything is stored as bits: tiny switches that are either off, 0, or on, 1. An IPv4 address is 32 bits long, split into four groups of eight. Each group of eight bits is an octet, from the Latin for eight, and each of the four numbers you see is one octet, written in ordinary numbers so people can read it.

Here's how eight switches make a number. Each switch has a value: the first is worth 128, the next 64, then 32, 16, 8, 4, 2 and 1, each half the one before. Turn some switches on, and add up their values. That's the octet. Try it:

A few things to notice as you flip:

• All off is 0, and all on is 255. That's 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1. No combination of eight switches can make more, which is why no octet is ever bigger than 255.
• There are 256 possible values, counting 0. Each switch doubles the number of combinations: 2 × 2 × 2 × 2 × 2 × 2 × 2 × 2 = 256.
• The binary is just the switches written down. 11000000 means the first two are on and the rest are off: 128 + 64 = 192.

Binary is the name for writing numbers with only 0s and 1s, like this. It looks strange at first, but it's the same idea as ordinary numbers, with switches worth 128, 64, 32 and so on, instead of columns worth hundreds, tens and ones.

Converting by hand

To turn a number into binary without the switches, work from the biggest value down. Here's 168:

1. Does 128 fit into 168? Yes. Write 1, and 40 is left over.
2. Does 64 fit into 40? No. Write 0.
3. Does 32 fit into 40? Yes. Write 1, and 8 is left.
4. Does 16 fit into 8? No. 0.
5. Does 8 fit into 8? Yes. 1, and nothing is left.
6. Everything else is 0: 4, 2 and 1 don't fit into nothing.

Read the digits in order: 10101000. Check it the other way: 128 + 32 + 8 = 168. Try 168 on the flipper above to see it.

Now the whole of CivicGrid's first address, 104.21.69.165, one octet at a time:

So to a computer, 104.21.69.165 is 01101000 00010101 01000101 10100101: 32 switches. You'll rarely need to convert whole addresses by hand. But Lesson 3, on subnets, is all about which of those 32 bits are fixed and which can change, and it only makes sense once you can see the bits.

Running out of addresses

32 bits make 2 multiplied by itself 32 times: 4,294,967,296 addresses, about 4.3 billion. That sounded like plenty in the 1980s. Today there are more phones than that, before you count laptops, servers, cars and fridges. The world has, in practice, run out of new IPv4 addresses.

Two things keep the internet working anyway. One is private addresses, below, which let millions of homes and companies reuse the same addresses behind a single public one. The other is IPv6, a newer, much bigger kind of address, near the end of this lesson.

Public and private addresses

A big office has one street address for the post, but inside, every desk has its own internal number that only means something inside the building. Networks work the same way.

• A public address is unique across the whole internet, and anyone can reach it, like 104.21.69.165. They're handed out by internet providers and cloud companies.
• A private address only means something inside one network, like your home or one company's cloud network. The same private addresses are used in millions of networks at once, so they can't be reached directly from the internet.

Three ranges are set aside for private use, and you'll see them everywhere:

Two more are worth knowing by sight:

• 127.0.0.1 always means "this computer". It's called localhost, or the loopback address, and it's what Python Lesson 10's API listened on. Data sent there never leaves your machine.
• 169.254. something means a device asked the network for an address and nobody answered, so it made one up. If you ever see one on your own computer, the problem is the connection to your router, not the internet.

Find your own addresses

Your computer has a private address on your home network. Find it. On a Mac, for Wi-Fi:

ipconfig getifaddr en0

en0 is usually the Mac's Wi-Fi connection; if nothing prints, try en1. On Linux, or in WSL on Windows, run hostname -I. You'll see something like this; yours will differ:

192.168.1.23

A private address, from your router. Now ask a website what address it sees when you visit:

curl -s https://ifconfig.me && echo

ifconfig.me is a small free service that replies with the address your request came from. && echo just adds a new line afterwards, so your prompt doesn't end up on the same line. You'll see a public address, something like:

203.0.113.45

Two different addresses for the same computer. Your laptop's private address is only known inside your home; your router has one public address, shared by every device in the house, and it's the only one the internet ever sees. How the router juggles that is called NAT (network address translation), and it's Lesson 6. Your public address is worth keeping to yourself, like a home address: don't paste it in public places.

IPv6: the bigger address

IPv6 is the long-term answer to running out. Its addresses are 128 bits long instead of 32, which makes more of them than there are grains of sand on Earth, by an enormous margin. They're written differently too: eight groups of four hexadecimal digits, a way of writing numbers that uses 0 to 9 and then a to f, separated by colons:

2001:0db8:0000:0000:0000:0000:0000:0001

That's long, so there are two shortcuts: leading zeros in each group can be dropped, and one run of all-zero groups can be replaced with ::. So that address is usually written 2001:db8::1. (The 2001:db8 start is set aside for examples, so this one can't belong to anyone, like the 203.0.113.45 above.)

Remember the line * IPv6: (none) from Lesson 1? That's curl saying it found no IPv6 address to use for that request. Plenty of networks and sites now support IPv6, but IPv4 is still what most of the internet runs on day to day, and it's what this track focuses on. The ideas, like public and private addresses and the subnets in Lesson 3, carry over.

Break it on purpose

Three cases. Work out the cause before you read the explanation.

An address that isn't one. Try visiting an address with 300 in it:

curl -sv --connect-timeout 3 -o /dev/null http://192.168.1.300/

* Could not resolve host: 192.168.1.300

It's the same error as a misspelled name in Lesson 1. 300 can't fit in eight bits, so 192.168.1.300 isn't an IP address at all, and curl treated it as a name instead, which DNS had never heard of. When an "address" gives you a name error, check each octet is 255 or less.

Knocking on your own door. Ask your own computer for a website on port 8000, with nothing running there:

curl -sv -o /dev/null http://127.0.0.1:8000/

*   Trying 127.0.0.1:8000...
* connect to 127.0.0.1 port 8000 from 127.0.0.1 port 33068 failed: Connection refused

The exact lines vary between curl versions, but you'll see Connection refused, and it happens instantly. Compare that with Lesson 1's port 12345, which waited until it timed out. Refused means the computer was reached, and it said "nobody's listening on that port". A timeout means nothing answered at all. That difference tells you a lot when you're tracking down a problem, and Lesson 12 uses it.

The address that means "no network". Imagine a friend tells you their laptop's address is 169.254.12.7, and nothing works: no websites, nothing. What's wrong? It's not the internet, and it's not the websites. A 169.254 address means their laptop asked the network for an address and got no answer, so it gave itself one. The problem is between the laptop and the router: the Wi-Fi password, the cable, or the router itself. The address alone told you where to look.

Where you are now

You can read an IP address as four octets, convert an octet to binary and back, tell public addresses from private ones, and find your own. But you've only looked at single addresses. Networks are built from ranges of addresses, like "everything starting with 192.168.1.". Lesson 3 shows how ranges work, with subnets and CIDR, and that's where the bits really start to matter.

Check yourself

Key terms

• IP address: the number that gets data to one device. IPv4 addresses are four numbers, like 104.21.69.165.
• Bit: a single 0 or 1, like a switch that's off or on.
• Octet: eight bits, written as one number from 0 to 255. An IPv4 address has four.
• Binary: writing numbers with only 0s and 1s, like 10101000.
• Public address: unique across the internet, and reachable from anywhere.
• Private address: only meaningful inside one network. Starts with 10., 172.16. to 172.31., or 192.168..
• Localhost (127.0.0.1): always this computer.
• IPv6: the newer, 128-bit kind of address, written in groups of hexadecimal digits, like 2001:db8::1.

Go deeper

• Cloudflare's Learning Center on what an IP address is (opens in a new tab).
• RFC 1918 (opens in a new tab), the short official document that set aside the private ranges, if you'd like to see where the rules come from.